# CrowdSec Setup

Deploys CrowdSec security engine to monitor NGINX Ingress Controller and protect against malicious traffic.

## What's Deployed

- **LAPI**: Central API for decision-making (1 replica)
- **Agent**: DaemonSet monitoring NGINX ingress logs
- **Storage**: `/mnt/k8s/crowdsec/` on server-3
- **Collections**: nginx, base-http-scenarios, linux

## Deploy

```bash
terraform apply
```

This will:
1. Create `crowdsec` namespace
2. Set up persistent volumes at `/mnt/k8s/crowdsec/`
3. Deploy CrowdSec LAPI and Agent
4. Create NGINX bouncer and store credentials in `ingress-nginx` namespace

## Useful Commands

```bash
# Check status
kubectl get pods -n crowdsec

# View metrics (attacks detected, IPs banned, etc.)
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli metrics

# List banned IPs
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions list

# View alerts
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli alerts list

# List bouncers
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli bouncers list

# Whitelist an IP
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions add --ip YOUR_IP --type whitelist

# Remove a ban
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions delete --ip BANNED_IP
```

## Storage

Data is persisted at `/mnt/k8s/crowdsec/` on your server (192.168.1.2):
- `lapi-config/` - LAPI configuration
- `lapi-data/` - Decisions and alerts database

## Integration with NGINX Ingress

The bouncer credentials are automatically created in the `ingress-nginx` namespace as secret `crowdsec-bouncer-tls`.

To enable blocking, you'll need to configure your NGINX Ingress Controller to use the CrowdSec bouncer plugin. This typically involves:

1. Adding the Lua bouncer script to NGINX
2. Configuring NGINX to call CrowdSec API before serving requests
3. Using the API key from the secret

Check the CrowdSec documentation for specific NGINX integration steps.

## Monitoring

CrowdSec monitors logs from:
- Namespace: `ingress-nginx`
- Pods: `ingress-nginx-controller-*`

It detects:
- HTTP attacks (SQL injection, XSS, etc.)
- Brute force attempts
- Suspicious scanning activity
- Rate limiting violations

## Uninstall

```bash
terraform destroy -target=helm_release.crowdsec -target=kubernetes_namespace.crowdsec
```

Or manually:
```bash
kubectl delete namespace crowdsec
```
