home-docker/terraform/CROWDSEC.md

CrowdSec Setup

Deploys CrowdSec security engine to monitor NGINX Ingress Controller and protect against malicious traffic.

What's Deployed

• LAPI: Central API for decision-making (1 replica)
• Agent: DaemonSet monitoring NGINX ingress logs
• Storage: /mnt/k8s/crowdsec/ on server-3
• Collections: nginx, base-http-scenarios, linux

Deploy

terraform apply

This will:

1. Create crowdsec namespace
2. Set up persistent volumes at /mnt/k8s/crowdsec/
3. Deploy CrowdSec LAPI and Agent
4. Create NGINX bouncer and store credentials in ingress-nginx namespace

Useful Commands

# Check status
kubectl get pods -n crowdsec

# View metrics (attacks detected, IPs banned, etc.)
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli metrics

# List banned IPs
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions list

# View alerts
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli alerts list

# List bouncers
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli bouncers list

# Whitelist an IP
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions add --ip YOUR_IP --type whitelist

# Remove a ban
kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions delete --ip BANNED_IP

Storage

Data is persisted at /mnt/k8s/crowdsec/ on your server (192.168.1.2):

• lapi-config/ - LAPI configuration
• lapi-data/ - Decisions and alerts database

Integration with NGINX Ingress

The bouncer credentials are automatically created in the ingress-nginx namespace as secret crowdsec-bouncer-tls.

To enable blocking, you'll need to configure your NGINX Ingress Controller to use the CrowdSec bouncer plugin. This typically involves:

1. Adding the Lua bouncer script to NGINX
2. Configuring NGINX to call CrowdSec API before serving requests
3. Using the API key from the secret

Check the CrowdSec documentation for specific NGINX integration steps.

Monitoring

CrowdSec monitors logs from:

• Namespace: ingress-nginx
• Pods: ingress-nginx-controller-*

It detects:

• HTTP attacks (SQL injection, XSS, etc.)
• Brute force attempts
• Suspicious scanning activity
• Rate limiting violations

Uninstall

terraform destroy -target=helm_release.crowdsec -target=kubernetes_namespace.crowdsec

Or manually:

kubectl delete namespace crowdsec