watchtower: set interval to 8 hours

caddy/Caddyfile

@@ -43,7 +43,9 @@
     }
     route {
         import security
-        reverse_proxy http://grafana:3000
+        reverse_proxy http://grafana:3000 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -51,11 +53,15 @@
 {$GITEA_DOMAIN} {
     import access-log
     request_body {
-        max_size 512MB
+        max_size 2048MB
     }
+    @not_registry not path /v2/*
     route {
-        import security
-        reverse_proxy http://gitea:3000
+        crowdsec
+        appsec @not_registry
+        reverse_proxy http://gitea:3000 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -67,7 +73,9 @@
     }
     route {
         import security
-        reverse_proxy http://slash:5231
+        reverse_proxy http://slash:5231 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -79,7 +87,9 @@
     }
     route {
         import security
-        reverse_proxy http://memos:5230
+        reverse_proxy http://memos:5230 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -91,7 +101,9 @@
     }
     route {
         import security
-        reverse_proxy http://wg-easy:51821
+        reverse_proxy http://wg-easy:51821 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -103,7 +115,9 @@
     }
     route {
         import security
-        reverse_proxy http://vaultwarden
+        reverse_proxy http://vaultwarden {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -115,7 +129,9 @@
     }
     route {
         import security
-        reverse_proxy http://sftpgo:8080
+        reverse_proxy http://sftpgo:8080 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -127,7 +143,9 @@
     }
     route {
         import security
-        reverse_proxy http://glance:8080
+        reverse_proxy http://glance:8080 {
+            header_up Host {http.request.host}
+        }
     }
 }
 
@@ -140,7 +158,6 @@
     route {
         import security
         reverse_proxy http://ghost:2368 {
-            header_up X-Forwarded-Proto {http.request.scheme}
             header_up Host {http.request.host}
         }
     }
@@ -155,7 +172,6 @@
     route {
         import security
         reverse_proxy http://immich_server:2283 {
-            header_up X-Forwarded-Proto {http.request.scheme}
             header_up Host {http.request.host}
         }
     }
@@ -170,7 +186,6 @@
     route {
         import security
         reverse_proxy http://uptime_kuma:3001 {
-            header_up X-Forwarded-Proto {http.request.scheme}
             header_up Host {http.request.host}
         }
     }
@@ -185,8 +200,6 @@
     route {
         import security
         reverse_proxy http://stalwart:8080 {
-            header_up X-Forwarded-Proto {http.request.scheme}
-            header_up X-Forwarded-For {http.request.remote_host}
             header_up Host {http.request.host}
         }
     }
@@ -212,7 +225,9 @@
     }
     route {
         import security
-        reverse_proxy http://gopkg_proxy:8421
+        reverse_proxy http://gopkg_proxy:8421 {
+            header_up Host {http.request.host}
+        }
     }
 }
 

crowdsec/.env.example

@@ -4,9 +4,19 @@
 # and in caddy/.env (CADDY) and the host firewall bouncer config (FW).
 CROWDSEC_BOUNCER_KEY_CADDY=
 CROWDSEC_BOUNCER_KEY_FW=
+CROWDSEC_BOUNCER_KEY_EXPORTER=
 
 ############# Console enrollment #############
 # Enroll key from https://app.crowdsec.net (free).
 # Leave blank to run without Console (no community blocklist subscriptions).
 CROWDSEC_ENROLL_KEY=
 CROWDSEC_ENROLL_INSTANCE_NAME=
+
+############# MaxMind GeoIP #############
+# Free account: https://www.maxmind.com/en/geolite2/signup
+# After signup: Manage License Keys -> Generate new license key.
+# Used by the geoipupdate sidecar to download/refresh GeoLite2-City.mmdb,
+# consumed by the exporter for the Country column in the Local bans table.
+# Leave blank to disable: exporter still runs, country labels will be empty.
+MAXMIND_ACCOUNT_ID=
+MAXMIND_LICENSE_KEY=

crowdsec/data/.gitignore

@@ -1,3 +1,4 @@
 /db/*
 /config/*
+/geoip/*
 !.gitkeep

crowdsec/docker-compose.yaml

@@ -26,6 +26,7 @@ services:
         Dominic-Wagner/vaultwarden
       BOUNCER_KEY_caddy: "${CROWDSEC_BOUNCER_KEY_CADDY}"
       BOUNCER_KEY_firewall: "${CROWDSEC_BOUNCER_KEY_FW}"
+      BOUNCER_KEY_exporter: "${CROWDSEC_BOUNCER_KEY_EXPORTER}"
       ENROLL_KEY: "${CROWDSEC_ENROLL_KEY:-}"
       ENROLL_INSTANCE_NAME: "${CROWDSEC_ENROLL_INSTANCE_NAME:-aykhans-prod}"
     ports:
@@ -36,6 +37,7 @@ services:
       - ./data/db:/var/lib/crowdsec/data
       - ./data/config:/etc/crowdsec
       - ./acquis.d:/etc/crowdsec/acquis.d:ro
+      - ./profiles/profiles.yaml:/etc/crowdsec/profiles.yaml:ro
       - ./parsers/s00-raw/stalwart-logs.yaml:/etc/crowdsec/parsers/s00-raw/stalwart-logs.yaml:ro
       - ./parsers/s01-parse/stalwart-logs-extended.yaml:/etc/crowdsec/parsers/s01-parse/stalwart-logs-extended.yaml:ro
       - ./parsers/s02-enrich/whitelist-trusted.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-trusted.yaml:ro
@@ -51,3 +53,44 @@ services:
       options:
         max-size: "100m"
         max-file: "3"
+
+  exporter:
+    build: ./exporter
+    container_name: crowdsec_exporter
+    restart: unless-stopped
+    networks:
+      - caddy
+    environment:
+      CROWDSEC_LAPI_URL: "http://crowdsec:8080"
+      CROWDSEC_API_KEY: "${CROWDSEC_BOUNCER_KEY_EXPORTER}"
+      POLL_INTERVAL_SECS: "30"
+      LISTEN_PORT: "9100"
+      GEOIP_CITY_DB: "/geoip/GeoLite2-City.mmdb"
+    volumes:
+      - ./data/geoip:/geoip:ro
+    depends_on:
+      - crowdsec
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  geoipupdate:
+    image: ghcr.io/maxmind/geoipupdate:v7
+    container_name: crowdsec_geoipupdate
+    restart: unless-stopped
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    environment:
+      GEOIPUPDATE_ACCOUNT_ID: "${MAXMIND_ACCOUNT_ID}"
+      GEOIPUPDATE_LICENSE_KEY: "${MAXMIND_LICENSE_KEY}"
+      GEOIPUPDATE_EDITION_IDS: "GeoLite2-City"
+      GEOIPUPDATE_FREQUENCY: "24"
+    volumes:
+      - ./data/geoip:/usr/share/GeoIP
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "2"

crowdsec/exporter/Dockerfile

@@ -0,0 +1,12 @@
+FROM golang:1.26-alpine AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY main.go ./
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags='-s -w' -o /exporter .
+
+FROM scratch
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /exporter /exporter
+EXPOSE 9100
+ENTRYPOINT ["/exporter"]

crowdsec/exporter/go.mod

@@ -0,0 +1,22 @@
+module crowdsec-exporter
+
+go 1.26.3
+
+require (
+	github.com/oschwald/geoip2-golang/v2 v2.1.0
+	github.com/prometheus/client_golang v1.23.2
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/oschwald/maxminddb-golang/v2 v2.1.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	golang.org/x/sys v0.44.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+)

crowdsec/exporter/go.sum

@@ -0,0 +1,40 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/oschwald/geoip2-golang/v2 v2.1.0 h1:DjnLhNJu9WHwTrmoiQFvgmyJoczhdnm7LB23UBI2Amo=
+github.com/oschwald/geoip2-golang/v2 v2.1.0/go.mod h1:qdVmcPgrTJ4q2eP9tHq/yldMTdp2VMr33uVdFbHBiBc=
+github.com/oschwald/maxminddb-golang/v2 v2.1.1 h1:lA8FH0oOrM4u7mLvowq8IT6a3Q/qEnqRzLQn9eH5ojc=
+github.com/oschwald/maxminddb-golang/v2 v2.1.1/go.mod h1:PLdx6PR+siSIoXqqy7C7r3SB3KZnhxWr1Dp6g0Hacl8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

crowdsec/exporter/main.go

@@ -0,0 +1,250 @@
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"net/netip"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/oschwald/geoip2-golang/v2"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+var geoDB *geoip2.Reader
+
+// countryFlag converts a 2-letter ISO-3166-1 alpha-2 country code into its
+// emoji flag using the Unicode regional indicator pairs trick (A-Z -> 0x1F1E6-FF).
+func countryFlag(iso string) string {
+	if len(iso) != 2 {
+		return ""
+	}
+	a, b := iso[0], iso[1]
+	if a < 'A' || a > 'Z' || b < 'A' || b > 'Z' {
+		return ""
+	}
+	return string([]rune{rune(a-'A') + 0x1F1E6, rune(b-'A') + 0x1F1E6})
+}
+
+// lookupGeo returns "<flag> <country name> (<city>)" for the given IP, falling
+// back gracefully (empty string, missing flag, missing city) when the DB is
+// unavailable or the IP can't be resolved.
+func lookupGeo(ip string) string {
+	if geoDB == nil {
+		return ""
+	}
+	addr, err := netip.ParseAddr(ip)
+	if err != nil {
+		return ""
+	}
+	rec, err := geoDB.City(addr)
+	if err != nil || rec == nil {
+		return ""
+	}
+	iso := rec.Country.ISOCode
+	name := rec.Country.Names.English
+	if name == "" {
+		name = iso
+	}
+	out := name
+	if flag := countryFlag(iso); flag != "" {
+		out = flag + " " + name
+	}
+	if city := rec.City.Names.English; city != "" {
+		out += " (" + city + ")"
+	}
+	return out
+}
+
+var (
+	decisionsActive = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "crowdsec_decisions_active",
+		Help: "Active CrowdSec decisions counted directly from LAPI (no gauge drift).",
+	}, []string{"origin", "scenario", "type"})
+
+	decisionsUniqueIPs = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "crowdsec_decisions_unique_ips",
+		Help: "Unique IPs with at least one active decision, grouped by origin.",
+	}, []string{"origin"})
+
+	decisionsUniqueIPsTotal = prometheus.NewGauge(prometheus.GaugeOpts{
+		Name: "crowdsec_decisions_unique_ips_total",
+		Help: "Unique IPs with at least one active decision across all origins.",
+	})
+
+	decisionRemaining = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: "crowdsec_decision_remaining_seconds",
+		Help: "Remaining seconds before each local decision expires. Only origin=crowdsec is exposed to keep cardinality bounded (CAPI/lists can contain tens of thousands of IPs).",
+	}, []string{"origin", "ip", "country", "scenario", "type"})
+
+	lastFetchUnix = prometheus.NewGauge(prometheus.GaugeOpts{
+		Name: "crowdsec_exporter_last_fetch_unix",
+		Help: "Unix timestamp of the last successful LAPI fetch.",
+	})
+
+	fetchErrors = prometheus.NewGauge(prometheus.GaugeOpts{
+		Name: "crowdsec_exporter_fetch_errors",
+		Help: "1 if the most recent fetch errored, else 0.",
+	})
+)
+
+type decision struct {
+	Origin   string `json:"origin"`
+	Scenario string `json:"scenario"`
+	Type     string `json:"type"`
+	Value    string `json:"value"`
+	Duration string `json:"duration"`
+}
+
+func init() {
+	prometheus.MustRegister(
+		decisionsActive,
+		decisionsUniqueIPs,
+		decisionsUniqueIPsTotal,
+		decisionRemaining,
+		lastFetchUnix,
+		fetchErrors,
+	)
+}
+
+func getenv(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}
+
+func fetchAndUpdate(client *http.Client, lapiURL, apiKey string) {
+	req, err := http.NewRequest("GET", lapiURL+"/v1/decisions", nil)
+	if err != nil {
+		log.Printf("[error] build request failed: %v", err)
+		fetchErrors.Set(1)
+		return
+	}
+	req.Header.Set("X-Api-Key", apiKey)
+	req.Header.Set("User-Agent", "crowdsec-exporter/1.0")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Printf("[error] fetch failed: %v", err)
+		fetchErrors.Set(1)
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		log.Printf("[error] LAPI returned status %d", resp.StatusCode)
+		fetchErrors.Set(1)
+		return
+	}
+
+	var data []decision
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		log.Printf("[error] decode failed: %v", err)
+		fetchErrors.Set(1)
+		return
+	}
+
+	type key struct{ origin, scenario, dtype string }
+	counts := map[key]int{}
+	ips := map[string]map[string]struct{}{}
+	allIPs := map[string]struct{}{}
+	type localDecision struct {
+		origin, ip, country, scenario, dtype string
+		remaining                            float64
+	}
+	var locals []localDecision
+
+	for _, d := range data {
+		origin := d.Origin
+		if origin == "" {
+			origin = "unknown"
+		}
+		scenario := d.Scenario
+		if scenario == "" {
+			scenario = "unknown"
+		}
+		dtype := d.Type
+		if dtype == "" {
+			dtype = "unknown"
+		}
+		counts[key{origin, scenario, dtype}]++
+		if d.Value != "" {
+			if _, ok := ips[origin]; !ok {
+				ips[origin] = map[string]struct{}{}
+			}
+			ips[origin][d.Value] = struct{}{}
+			allIPs[d.Value] = struct{}{}
+		}
+		if origin == "crowdsec" {
+			dur, perr := time.ParseDuration(d.Duration)
+			if perr != nil {
+				dur = 0
+			}
+			locals = append(locals, localDecision{origin, d.Value, lookupGeo(d.Value), scenario, dtype, dur.Seconds()})
+		}
+	}
+
+	decisionsActive.Reset()
+	decisionsUniqueIPs.Reset()
+	decisionRemaining.Reset()
+	for k, n := range counts {
+		decisionsActive.WithLabelValues(k.origin, k.scenario, k.dtype).Set(float64(n))
+	}
+	for origin, s := range ips {
+		decisionsUniqueIPs.WithLabelValues(origin).Set(float64(len(s)))
+	}
+	decisionsUniqueIPsTotal.Set(float64(len(allIPs)))
+	for _, l := range locals {
+		decisionRemaining.WithLabelValues(l.origin, l.ip, l.country, l.scenario, l.dtype).Set(l.remaining)
+	}
+
+	fetchErrors.Set(0)
+	lastFetchUnix.Set(float64(time.Now().Unix()))
+
+	log.Printf("[ok] %d decisions, %d unique IPs across %d origins",
+		len(data), len(allIPs), len(ips))
+}
+
+func main() {
+	lapiURL := getenv("CROWDSEC_LAPI_URL", "http://crowdsec:8080")
+	apiKey := os.Getenv("CROWDSEC_API_KEY")
+	if apiKey == "" {
+		log.Fatal("CROWDSEC_API_KEY env var required")
+	}
+	intervalStr := getenv("POLL_INTERVAL_SECS", "30")
+	interval, err := strconv.Atoi(intervalStr)
+	if err != nil || interval < 1 {
+		log.Fatalf("invalid POLL_INTERVAL_SECS: %q", intervalStr)
+	}
+	port := getenv("LISTEN_PORT", "9100")
+
+	geoDBPath := getenv("GEOIP_CITY_DB", "")
+	if geoDBPath != "" {
+		if db, err := geoip2.Open(geoDBPath); err == nil {
+			geoDB = db
+			defer geoDB.Close()
+			log.Printf("[start] GeoIP DB loaded: %s", geoDBPath)
+		} else {
+			log.Printf("[warn] GeoIP DB unavailable (%v); country label will be empty", err)
+		}
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+
+	go func() {
+		for {
+			fetchAndUpdate(client, lapiURL, apiKey)
+			time.Sleep(time.Duration(interval) * time.Second)
+		}
+	}()
+
+	http.Handle("/metrics", promhttp.Handler())
+	log.Printf("[start] listening :%s, polling %s every %ds", port, lapiURL, interval)
+	if err := http.ListenAndServe(":"+port, nil); err != nil {
+		log.Fatal(err)
+	}
+}

crowdsec/profiles/profiles.yaml

@@ -0,0 +1,18 @@
+name: default_ip_remediation
+filters:
+  - Alert.Remediation == true && Alert.GetScope() == "Ip"
+duration_expr: Sprintf('%dh', min(730, (GetDecisionsCount(Alert.GetValue())+1)*4))
+decisions:
+  - type: ban
+    duration: 4h
+on_success: break
+
+---
+name: default_range_remediation
+filters:
+  - Alert.Remediation == true && Alert.GetScope() == "Range"
+duration_expr: Sprintf('%dh', min(730, (GetDecisionsCount(Alert.GetValue())+1)*4))
+decisions:
+  - type: ban
+    duration: 4h
+on_success: break

grafana/data/grafana/dashboards/crowdsec.json

@@ -0,0 +1,496 @@
+{
+  "annotations": {
+    "list": []
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "id": null,
+  "uid": "crowdsec",
+  "title": "CrowdSec",
+  "tags": [
+    "crowdsec",
+    "security"
+  ],
+  "timezone": "browser",
+  "schemaVersion": 39,
+  "version": 1,
+  "refresh": "30s",
+  "time": {
+    "from": "now-24h",
+    "to": "now"
+  },
+  "templating": {
+    "list": []
+  },
+  "panels": [
+    {
+      "id": 2,
+      "type": "stat",
+      "title": "Total active bans",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "targets": [
+        {
+          "expr": "crowdsec_decisions_unique_ips_total",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "noValue": "0",
+          "color": {
+            "mode": "thresholds"
+          },
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "yellow",
+                "value": 100
+              },
+              {
+                "color": "red",
+                "value": 10000
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "textMode": "value",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 3,
+      "type": "stat",
+      "title": "CAPI (community)",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 6,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "targets": [
+        {
+          "expr": "crowdsec_decisions_unique_ips{origin=\"CAPI\"}",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "noValue": "0",
+          "color": {
+            "mode": "purple"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "textMode": "value",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 4,
+      "type": "stat",
+      "title": "Blocklist subs",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 12,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "targets": [
+        {
+          "expr": "crowdsec_decisions_unique_ips{origin=\"lists\"}",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "noValue": "0",
+          "color": {
+            "mode": "blue"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "textMode": "value",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 5,
+      "type": "stat",
+      "title": "Local detections",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 18,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "targets": [
+        {
+          "expr": "crowdsec_decisions_unique_ips{origin=\"crowdsec\"}",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "noValue": "0",
+          "color": {
+            "mode": "red"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "textMode": "value",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 9,
+      "type": "piechart",
+      "title": "Bans by origin",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 4,
+        "w": 12,
+        "h": 9
+      },
+      "targets": [
+        {
+          "expr": "sum by (origin) (crowdsec_decisions_unique_ips)",
+          "legendFormat": "{{origin}}",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "options": {
+        "pieType": "donut",
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "values": [
+            "value",
+            "percent"
+          ]
+        },
+        "tooltip": {
+          "mode": "single"
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 10,
+      "type": "piechart",
+      "title": "Top 10 bans by reason",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 12,
+        "y": 4,
+        "w": 12,
+        "h": 9
+      },
+      "targets": [
+        {
+          "expr": "topk(10, sum by (scenario) (crowdsec_decisions_active))",
+          "legendFormat": "{{scenario}}",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "options": {
+        "pieType": "donut",
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "values": [
+            "value",
+            "percent"
+          ]
+        },
+        "tooltip": {
+          "mode": "single"
+        },
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 14,
+      "type": "bargauge",
+      "title": "Top scenarios by alerts (total)",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 23,
+        "w": 24,
+        "h": 8
+      },
+      "targets": [
+        {
+          "expr": "topk(10, sum by (reason) (cs_alerts))",
+          "legendFormat": "{{reason}}",
+          "refId": "A",
+          "instant": true,
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "color": {
+            "mode": "continuous-GrYlRd"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "orientation": "horizontal",
+        "displayMode": "gradient",
+        "showUnfilled": true,
+        "valueMode": "color",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      }
+    },
+    {
+      "id": 15,
+      "type": "table",
+      "title": "Local bans detail",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "prometheusdatasource"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 13,
+        "w": 24,
+        "h": 10
+      },
+      "targets": [
+        {
+          "expr": "crowdsec_decision_remaining_seconds{origin=\"crowdsec\"}",
+          "refId": "A",
+          "instant": true,
+          "format": "table",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "prometheusdatasource"
+          }
+        }
+      ],
+      "transformations": [
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time": true,
+              "__name__": true,
+              "instance": true,
+              "job": true,
+              "origin": true
+            },
+            "indexByName": {
+              "country": 0,
+              "ip": 1,
+              "scenario": 2,
+              "type": 3,
+              "Value": 4
+            },
+            "renameByName": {
+              "country": "Country",
+              "ip": "IP",
+              "scenario": "Scenario",
+              "type": "Type",
+              "Value": "Time remaining"
+            }
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "custom": {
+            "align": "auto",
+            "filterable": true,
+            "inspect": false
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Time remaining"
+            },
+            "properties": [
+              {
+                "id": "unit",
+                "value": "s"
+              },
+              {
+                "id": "custom.cellOptions",
+                "value": {
+                  "type": "color-text"
+                }
+              },
+              {
+                "id": "color",
+                "value": {
+                  "mode": "continuous-GrYlRd"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "options": {
+        "showHeader": true,
+        "sortBy": [
+          {
+            "displayName": "Time remaining",
+            "desc": true
+          }
+        ],
+        "footer": {
+          "show": false
+        }
+      }
+    }
+  ]
+}

grafana/data/provisioning/dashboard.yaml

@@ -14,9 +14,9 @@ providers:
     disableDeletion: false
     # Optional: Allow users to edit dashboards in the Grafana UI.
     # Changes will be overwritten on restart unless you save them elsewhere.
-    editable: true
+    editable: false
     updateIntervalSeconds: 10
-    allowUiUpdates: true
+    allowUiUpdates: false
     # Options specific to the 'file' type provider
     options:
       # Path inside the container where Grafana should look for dashboard JSON files.

memos/docker-compose.yaml

@@ -6,7 +6,7 @@ networks:
 
 services:
   memos:
-    image: neosmemo/memos:0.27
+    image: neosmemo/memos:0.29
     restart: unless-stopped
     container_name: memos
     labels:

prometheus/data/config/prometheus.yaml

@@ -16,3 +16,13 @@ scrape_configs:
       scrape_interval: 2s
       static_configs:
           - targets: ["caddy:2019"]
+
+    - job_name: crowdsec
+      scrape_interval: 10s
+      static_configs:
+          - targets: ["crowdsec:6060"]
+
+    - job_name: crowdsec_exporter
+      scrape_interval: 30s
+      static_configs:
+          - targets: ["crowdsec_exporter:9100"]

watchtower/docker-compose.yaml

@@ -10,7 +10,7 @@ services:
       - "--label-enable"
       - "--cleanup"
       - "--interval"
-      - "600" # 10 minutes
+      - "28800" # 8 hours
     logging:
       driver: "json-file"
       options: