new config

.env.example

@@ -1,4 +1,5 @@
 CF_DNS_API_TOKEN=
+CF_TUNNEL_TOKEN=
 ROOT_DOMAIN=tips-of-mine.com
 HTTP_TIMEOUT=60
 POLLING_INTERVAL=10

crowdsec/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+  - /var/log/traefik/access.log
+labels:
+  type: traefik

docker-compose.yml

@@ -2,9 +2,26 @@ networks:
   back_network:
     driver: bridge
     attachable: true
+    ipam:
+      config:
+        - subnet: 10.0.111.0/29
   front_network:
     driver: bridge
     attachable: true
+    ipam:
+      config:
+        - subnet: 10.0.110.0/24
+  socket_proxy_network:
+    driver: bridge
+    internal: true
+    ipam:
+      config:
+        - subnet: 10.0.120.0/29
+  cloudflare_network:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 10.0.100.0/29
 
 ### Volumes
 #volumes:
@@ -36,7 +53,6 @@ services:
       - "/etc/localtime:/etc/localtime:ro"
       - "./configs/traefik.yml:/etc/traefik/traefik.yml"
       - "./configs/dynamic:/etc/traefik/dynamic:rw"
-#      - "./certificates/acme.json:/etc/traefik/acme/acme.json:rw"
       - "./certificates:/var/traefik/certs:rw"
       - "./certificates:/etc/traefik/ssl:rw"
       - "./certificates:/certs:ro"
@@ -53,6 +69,7 @@ services:
     networks:
       - back_network
       - front_network
+      - cloudflare_network
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
       - "fathom.vault.CF_DNS_API_TOKEN=secret/cloudflare"
@@ -72,14 +89,48 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
 
+### Cloudflare:
+  cloudflare:
+    container_name: cloudflared-tunnel
+    hostname: cloudflared-tunnel
+    image: cloudflare/cloudflared:latest
+    restart: unless-stopped
+    command: tunnel run --protocol http2
+    volumes:
+      - "/etc/localtime:/etc/localtime:ro"
+    environment:
+      - TZ=Europe/Paris
+      - TUNNEL_TOKEN=${CF_TUNNEL_TOKEN}
+    networks:
+      - cloudflare_network
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    security_opt:
+      - no-new-privileges
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_BIND_SERVICE
+    read_only: true
+    tmpfs:
+      - /tmp
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 256M
+
 ### Crowdsec:
   crowdsec:
     container_name: crowdsec-app
     hostname: crowdsec-app
     image: crowdsecurity/crowdsec:latest
     restart: unless-stopped
-    ports:
-      - "8090:8080"
+#    ports:
+#      - "8090:8080"
     environment:
       COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
       GID: "1000"
@@ -91,9 +142,27 @@ services:
       - "./crowdsec-db:/var/lib/crowdsec/data/"
       - "./crowdsec-config:/etc/crowdsec/"
     networks:
-      - front_network
+      - back_network
 
-### error-pages
+### socket-proxy:
+  socket-proxy:
+    container_name: socket-proxy
+    hostname: socket-proxy
+    image: ghcr.io/tecnativa/docker-socket-proxy:latest
+    restart: always
+    security_opt:
+      - no-new-privileges:true
+    environment:
+      - CONTAINERS=1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - socket_proxy_network
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+      - "fathom.exempt.socket-docker=proxy de socket filtrant, c'est sa raison d'etre"
+
+### error-pages:
 #  error-pages:
 #    image: ghcr.io/tarampampam/error-pages:3
 #    container_name: traefik-error-pages
@@ -103,7 +172,7 @@ services:
 #      - front_network
 #    restart: unless-stopped
 
-### whoami
+### whoami:
   whoami:
     container_name: traefik-whoami
     hostname: traefik-whoami
@@ -126,8 +195,6 @@ services:
       - "traefik.http.routers.whoami-https.tls=true"
       - "traefik.http.routers.whoami-https.service=whoami-service"
 # Middleware
-#      - "traefik.http.routers.whoami-https.middlewares=forward-auth"
-#      - "traefik.http.routers.whoami-https.middlewares=cloudflarewarp@file,my-crowdsec-bouncer-traefik-plugin@file"
 # Service
       - "traefik.http.services.whoami-service.loadbalancer.server.port=80"
 # Homepage
@@ -137,6 +204,7 @@ services:
       - "homepage.href=https://whoami.tips-of-mine.com"
       - "homepage.description=whoami"
 
+### whoami-tcp:
   whoami-tcp:
     image: traefik/whoamitcp:latest
     container_name: traefik-whoami-tcp
@@ -152,6 +220,7 @@ services:
       - "traefik.tcp.routers.whoami-tcp.rule=HostSNI(`*`)"
       - "traefik.tcp.services.whoami-tcp.loadbalancer.server.port=8080"
 
+### whoami-udp:
   whoami-udp:
     image: traefik/whoamiudp:latest
     container_name: traefik-whoami-udp