crowdsec config

[jsapede]

Hello,

i've setup npmplus and crowdsec according to the docs, ... i think

im not sure its OK, changing mode from bridge to host doesnt seem to have an effect, so i'm not quite sure its efficient

the docker stack is set as follows :

services:
npmplus:
container_name: npmplus
image: zoeyvid/npmplus
restart: always
network_mode: host
volumes:
- "/opt/npm:/data"
environment:
- "TZ=Europe/Paris"
- "LOGROTATE=true"
- "GOA=true"
- "GOACLA=--agent-list --real-os --double-decode --anonymize-ip --anonymize-level=2 --keep-last=7 --with-output-resolver --no-query-string"
crowdsec:
container_name: crowdsec
image: crowdsecurity/crowdsec
restart: always
network_mode: host
ports:
- "127.0.0.1:7422:7422"
- "127.0.0.1:8080:8080"
environment:
- "TZ=Europe/Paris"
- "COLLECTIONS=ZoeyVid/npmplus"
volumes:
- "/opt/crowdsec/conf:/etc/crowdsec"
- "/opt/crowdsec/data:/var/lib/crowdsec/data"
- "/opt/npm/nginx:/opt/npm/nginx:ro"
- "/var/run/docker.sock:/var/run/docker.sock:ro"

and crowdsec.conf is set as this :

ENABLED=true
API_URL=http://127.0.0.1:8080
API_KEY=XXXXXXXXXXXXXXXXXX
CACHE_EXPIRATION=1
BOUNCING_ON_TYPE=ban
FALLBACK_REMEDIATION=ban
REQUEST_TIMEOUT=3000
UPDATE_FREQUENCY=10
MODE=live
EXCLUDE_LOCATION=
BAN_TEMPLATE_PATH=/data/etc/crowdsec/ban.html
REDIRECT_LOCATION=
RET_CODE=
CAPTCHA_PROVIDER=
SECRET_KEY=
SITE_KEY=
CAPTCHA_TEMPLATE_PATH=/data/etc/crowdsec/captcha.html
CAPTCHA_EXPIRATION=3600
APPSEC_URL=http://127.0.0.1:7422
APPSEC_FAILURE_ACTION=deny

reverting back network_mode from host to bridge in the crowdsec section of the stack induces blocked first acces on the IP:81 of the NPM but after reloading ip:81 from another tab in the browser, access becomes possible witch looks quite strange.

Would you mind having a look ? i'm quite unfamiliar with crowdsec

[Zoey2936]

If you don't use network_mode npmplus can't connect to crowdsec

[jsapede]

So i understand that the configuration IS correct

[Zoey2936]

It should work

[gabriel-gfs]

i'm not sure if this is the right place. i was wondering if there is a way to run npmplus with crowdsec while not using network mode bridge. my setup would need to change significantly to accomodate npm running in network host mode. couldnt npmplus communicate with crowdsec if they are in the same docker network?

[Zoey2936]

it can work, if you add both to the same network, give them static ips, expose the ports of npmplus and NOT expose ports of crowdsec and the replace 127.0.0.1 in the crowdsec config with the ip of the crowdsec container