root
72 lines
2.1 KiB
YAML
72 lines
2.1 KiB
YAML
services:
|
|
haproxy:
|
|
image: haproxy:3.4.0-alpine
|
|
container_name: haproxy
|
|
user: "0:0"
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- /srv/nfs/infra/haproxy/conf:/usr/local/etc/haproxy:ro
|
|
- /srv/nfs/infra/haproxy/certs:/etc/haproxy/certs:ro
|
|
- /srv/nfs/infra/haproxy/logs:/var/log/haproxy
|
|
|
|
# SPOA Lua/Templates (выдаются spoa-bouncer, читаются haproxy)
|
|
- /srv/nfs/infra/haproxy/crowdsec/lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua:ro
|
|
- /srv/nfs/infra/haproxy/crowdsec/templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html:ro
|
|
networks:
|
|
- interdock
|
|
depends_on:
|
|
- crowdsec
|
|
- crowdsec_spoa_bouncer
|
|
restart: unless-stopped
|
|
|
|
crowdsec:
|
|
image: crowdsecurity/crowdsec:latest
|
|
container_name: crowdsec
|
|
restart: unless-stopped
|
|
env_file:
|
|
- /srv/nfs/infra/haproxy/.env
|
|
ports:
|
|
- "127.0.0.1:8087:8087"
|
|
environment:
|
|
COLLECTIONS: "crowdsecurity/haproxy"
|
|
GID: "${DOCKER_GID}"
|
|
volumes:
|
|
# CrowdSec persist -> NFS
|
|
- /srv/nfs/infra/haproxy/crowdsec/data:/var/lib/crowdsec/data/
|
|
- /srv/nfs/infra/haproxy/crowdsec/config:/etc/crowdsec/
|
|
|
|
# acquisition
|
|
#- /srv/nfs/infra/haproxy/crowdsec/acquis.d:/etc/crowdsec/acquis.d:ro
|
|
|
|
# docker logs datasource
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
networks:
|
|
- interdock
|
|
|
|
crowdsec_spoa_bouncer:
|
|
image: crowdsecurity/spoa-bouncer:latest
|
|
container_name: crowdsec-spoa-bouncer
|
|
restart: unless-stopped
|
|
env_file:
|
|
- /srv/nfs/infra/haproxy/.env
|
|
depends_on:
|
|
- crowdsec
|
|
environment:
|
|
CROWDSEC_URL: "http://crowdsec:8080/"
|
|
LISTEN_TCP: "0.0.0.0:9000"
|
|
CROWDSEC_KEY: "${BOUNCER_KEY_SPOA}"
|
|
volumes:
|
|
# SPOA bouncer пишет lua/templates в NFS, haproxy читает их
|
|
- /srv/nfs/infra/haproxy/crowdsec/lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua/
|
|
- /srv/nfs/infra/haproxy/crowdsec/templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html/
|
|
networks:
|
|
- interdock
|
|
|
|
networks:
|
|
interdock:
|
|
external: true
|