Initial infrastructure configuration

2026-09-28 19:14:40 +03:00
commit 78c5ad051b
4 changed files with 881 additions and 0 deletions
@@ -0,0 +1,71 @@
+services:
+  haproxy:
+    image: haproxy:3.4.0-alpine
+    container_name: haproxy
+    user: "0:0"
+    cap_add:
+      - NET_BIND_SERVICE
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /srv/nfs/infra/haproxy/conf:/usr/local/etc/haproxy:ro
+      - /srv/nfs/infra/haproxy/certs:/etc/haproxy/certs:ro
+      - /srv/nfs/infra/haproxy/logs:/var/log/haproxy
+
+      # SPOA Lua/Templates (выдаются spoa-bouncer, читаются haproxy)
+      - /srv/nfs/infra/haproxy/crowdsec/lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua:ro
+      - /srv/nfs/infra/haproxy/crowdsec/templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html:ro
+    networks:
+      - interdock
+    depends_on:
+      - crowdsec
+      - crowdsec_spoa_bouncer
+    restart: unless-stopped
+
+  crowdsec:
+    image: crowdsecurity/crowdsec:latest
+    container_name: crowdsec
+    restart: unless-stopped
+    env_file:
+      - /srv/nfs/infra/haproxy/.env
+    ports:
+      - "127.0.0.1:8087:8087"
+    environment:
+      COLLECTIONS: "crowdsecurity/haproxy"
+      GID: "${DOCKER_GID}"
+    volumes:
+      # CrowdSec persist -> NFS
+      - /srv/nfs/infra/haproxy/crowdsec/data:/var/lib/crowdsec/data/
+      - /srv/nfs/infra/haproxy/crowdsec/config:/etc/crowdsec/
+
+      # acquisition
+      #- /srv/nfs/infra/haproxy/crowdsec/acquis.d:/etc/crowdsec/acquis.d:ro
+
+      # docker logs datasource
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - interdock
+
+  crowdsec_spoa_bouncer:
+    image: crowdsecurity/spoa-bouncer:latest
+    container_name: crowdsec-spoa-bouncer
+    restart: unless-stopped
+    env_file:
+      - /srv/nfs/infra/haproxy/.env
+    depends_on:
+      - crowdsec
+    environment:
+      CROWDSEC_URL: "http://crowdsec:8080/"
+      LISTEN_TCP: "0.0.0.0:9000"
+      CROWDSEC_KEY: "${BOUNCER_KEY_SPOA}"
+    volumes:
+      # SPOA bouncer пишет lua/templates в NFS, haproxy читает их
+      - /srv/nfs/infra/haproxy/crowdsec/lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua/
+      - /srv/nfs/infra/haproxy/crowdsec/templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html/
+    networks:
+      - interdock
+
+networks:
+  interdock:
+    external: true