73 lines
2 KiB
HCL
73 lines
2 KiB
HCL
variable "tls_secret_name" {}
|
|
variable "homepage_username" {}
|
|
variable "homepage_password" {}
|
|
variable "db_password" {}
|
|
variable "enroll_key" {}
|
|
|
|
module "tls_secret" {
|
|
source = "../setup_tls_secret"
|
|
namespace = "crowdsec"
|
|
tls_secret_name = var.tls_secret_name
|
|
}
|
|
|
|
resource "kubernetes_namespace" "crowdsec" {
|
|
metadata {
|
|
name = "crowdsec"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_config_map" "crowdsec_custom_scenarios" {
|
|
metadata {
|
|
name = "crowdsec-custom-scenarios"
|
|
namespace = "crowdsec"
|
|
labels = {
|
|
"app.kubernetes.io/name" = "crowdsec"
|
|
}
|
|
}
|
|
|
|
data = {
|
|
"http-403-abuse.yaml" = <<-YAML
|
|
type: leaky
|
|
name: crowdsecurity/http-403-abuse
|
|
description: "Detect IPs triggering too many HTTP 403s in NGINX ingress logs"
|
|
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.status == '403'"
|
|
groupby: "evt.Meta.source_ip"
|
|
leakspeed: "10s"
|
|
capacity: 5
|
|
blackhole: 1m
|
|
labels:
|
|
service: http
|
|
behavior: abusive_403
|
|
remediation: true
|
|
YAML
|
|
"http-429-abuse.yaml" : <<-YAML
|
|
type: leaky
|
|
name: crowdsecurity/http-429-abuse
|
|
description: "Detect IPs repeatedly triggering rate-limit (HTTP 429)"
|
|
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.status == '429'"
|
|
groupby: "evt.Meta.source_ip"
|
|
leakspeed: "10s"
|
|
capacity: 5
|
|
blackhole: 1m
|
|
labels:
|
|
service: http
|
|
behavior: rate_limit_abuse
|
|
remediation: true
|
|
YAML
|
|
}
|
|
}
|
|
|
|
|
|
resource "helm_release" "crowdsec" {
|
|
namespace = "crowdsec"
|
|
create_namespace = true
|
|
name = "crowdsec"
|
|
atomic = true
|
|
version = "0.19.4"
|
|
|
|
repository = "https://crowdsecurity.github.io/helm-charts"
|
|
chart = "crowdsec"
|
|
|
|
values = [templatefile("${path.module}/values.yaml", { homepage_username = var.homepage_username, homepage_password = var.homepage_password, DB_PASSWORD = var.db_password, ENROLL_KEY = var.enroll_key })]
|
|
timeout = 3600
|
|
}
|