Skip to content

Commit a638e49

Browse files
LePresidenteLePresidente
committed
Install Crowdsec OpenResty Directly into docker container. Removed all environment variables due to future integration with NPM.
1 parent 71f5053 commit a638e49

File tree

2 files changed

+34
-52
lines changed

2 files changed

+34
-52
lines changed

‎Dockerfile

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,17 @@ ARG DOCKER_IMAGE_VERSION=unknown
1212

1313
# Define software versions.
1414
ARG OPENRESTY_VERSION=1.19.9.1
15+
ARG CROWDSEC_OPENRESTY_BOUNCER_VERSION=0.1.1
1516
ARG NGINX_PROXY_MANAGER_VERSION=2.9.15
1617
ARG NGINX_HTTP_GEOIP2_MODULE_VERSION=3.3
1718
ARG LIBMAXMINDDB_VERSION=1.5.0
1819
ARG WATCH_VERSION=0.3.1
1920

2021
# Define software download URLs.
2122
ARG OPENRESTY_URL=https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz
23+
#Offical Crowdsec download location is currently blocked due to two pull requests waiting to be added for full support for Docker installs
24+
#ARG CROWDSEC_OPENRESTY_BOUNCER_URL=https://github.com/crowdsecurity/cs-openresty-bouncer/releases/download/v${CROWDSEC_OPENRESTY_BOUNCER_VERSION}/crowdsec-openresty-bouncer.tgz
25+
ARG CROWDSEC_OPENRESTY_BOUNCER_URL=https://github.com/LePresidente/cs-openresty-bouncer/releases/download/v${CROWDSEC_OPENRESTY_BOUNCER_VERSION}/crowdsec-openresty-bouncer.tgz
2226
ARG NGINX_PROXY_MANAGER_URL=https://github.com/jc21/nginx-proxy-manager/archive/v${NGINX_PROXY_MANAGER_VERSION}.tar.gz
2327
ARG NGINX_HTTP_GEOIP2_MODULE_URL=https://github.com/leev/ngx_http_geoip2_module/archive/${NGINX_HTTP_GEOIP2_MODULE_VERSION}.tar.gz
2428
ARG LIBMAXMINDDB_URL=https://github.com/maxmind/libmaxminddb/releases/download/${LIBMAXMINDDB_VERSION}/libmaxminddb-${LIBMAXMINDDB_VERSION}.tar.gz
@@ -372,6 +376,20 @@ RUN \
372376
del-pkg build-dependencies && \
373377
rm -rf /tmp/* /tmp/.[!.]*
374378

379+
# Install Crowdsec OpenResty Bouncer.
380+
RUN \
381+
# Download the Crowdsec OpenResty Bouncer package.
382+
echo "Downloading Crowdsec Openresty Bouncer package..." && \
383+
mkdir crowdsec-openresty-bouncer && \
384+
curl -# -L ${CROWDSEC_OPENRESTY_BOUNCER_URL} | tar xz --strip 1 -C crowdsec-openresty-bouncer && \
385+
# Deploy Crowdsec Openresty Bouncer.
386+
echo "Deploy Crowdsec Openresty Bouncer.." && \
387+
cd /tmp/crowdsec-openresty-bouncer && \
388+
bash ./install.sh --NGINX_CONF_DIR=/etc/nginx/conf.d --LIB_PATH=/var/lib/nginx/lualib --CONFIG_PATH=/defaults/crowdsec/ --DATA_PATH=/defaults/crowdsec/ --docker && \
389+
sed-patch 's|ENABLED=.*|ENABLED=false|' /defaults/crowdsec/crowdsec-openresty-bouncer.conf && \
390+
# Cleanup.
391+
rm -rf /tmp/* /tmp/.[!.]*
392+
375393
# Add files.
376394
COPY rootfs/ /
377395

‎rootfs/etc/cont-init.d/99_crowdsec-openresty-bouncer.sh

Lines changed: 16 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -6,57 +6,21 @@ log() {
66
echo "[cont-init.d] $(basename $0): $*"
77
}
88

9-
CROWDSEC_OPENRESTY_BOUNCER_VERSION=${CROWDSEC_BOUNCER_VERSION}
10-
CROWDSEC_OPENRESTY_BOUNCER_URL=https://github.com/crowdsecurity/cs-openresty-bouncer/releases/download/v${CROWDSEC_OPENRESTY_BOUNCER_VERSION:=0.1.1}/crowdsec-openresty-bouncer.tgz
11-
12-
if [ ${CROWDSEC_BOUNCER} == "1" ]; then
13-
#Create required folders if they don't exist
14-
mkdir -p /tmp/crowdsec/ /config/crowdsec/templates /config/crowdsec/static_package
15-
#Download the Crowdsec Openresty Bouncer if a static package is not found, this is useful for testing new versions or if we don't want to update
16-
if [ -f /config/crowdsec/static_package/crowdsec-openresty-bouncer.tgz ]; then
17-
tar -xf /config/crowdsec/static_package/crowdsec-openresty-bouncer.tgz --strip=1 -C /tmp/crowdsec/
18-
else
19-
wget ${CROWDSEC_OPENRESTY_BOUNCER_URL} -O /tmp/crowdsec-openresty-bouncer.tgz
20-
tar -xf /tmp/crowdsec-openresty-bouncer.tgz --strip=1 -C /tmp/crowdsec/
21-
rm /tmp/crowdsec-openresty-bouncer.tgz
22-
fi
23-
24-
# Manually Deploy Crowdsec Openresty Bouncer, this will be done by the install.sh script in crowdsec-openresty-bouncer in future.
25-
#https://github.com/crowdsecurity/cs-openresty-bouncer/pull/18
26-
if grep 'docker' /tmp/crowdsec/install.sh; then
27-
cd /tmp/crowdsec && bash ./install.sh --NGINX_CONF_DIR=/etc/nginx/conf.d --LIB_PATH=/var/lib/nginx/lualib --CONFIG_PATH=/config/crowdsec --DATA_PATH=/config/crowdsec --docker
28-
else
29-
echo "Deploy Crowdsec Openresty Bouncer manually.."
30-
echo "Patching crowdsec_openresty.conf.."
31-
#this will be handled by the installer but due to the current manual process this has to happen.
32-
sed -i 's|/etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf|/config/crowdsec/crowdsec-openresty-bouncer.conf|' /tmp/crowdsec/openresty/crowdsec_openresty.conf
33-
sed -i 's|/usr/local/openresty/lualib/plugins/crowdsec|/var/lib/nginx/lualib/plugins/crowdsec|' /tmp/crowdsec/openresty/crowdsec_openresty.conf
34-
sed -i 's|${SSL_CERTS_PATH}|/etc/ssl/certs/ca-certificates.crt|' /tmp/crowdsec/openresty/crowdsec_openresty.conf
35-
sed -i 's|resolver local=on ipv6=off;||' /tmp/crowdsec/openresty/crowdsec_openresty.conf
36-
echo "Deploy crowdsec_openresty.conf.."
37-
cp /tmp/crowdsec/openresty/crowdsec_openresty.conf /etc/nginx/conf.d/
38-
echo "Deploy lau files.."
39-
cp -r /tmp/crowdsec/lua/lib/* /var/lib/nginx/lualib/
40-
if [ -f /config/crowdsec/crowdsec-openresty-bouncer.conf ]; then
41-
echo "Patch crowdsec-openresty-bouncer.conf .."
42-
sed "s/=.*//g" /config/crowdsec/crowdsec-openresty-bouncer.conf > /tmp/crowdsec.conf.raw
43-
sed "s/=.*//g" /tmp/crowdsec/config/config_example.conf > /tmp/config_example.conf.raw
44-
if grep -vf /tmp/crowdsec.conf.raw /tmp/config_example.conf.raw ; then
45-
grep -vf /tmp/crowdsec.conf.raw /tmp/config_example.conf.raw > /tmp/config_example.newvals
46-
cp /config/crowdsec/crowdsec-openresty-bouncer.conf /config/crowdsec/crowdsec-openresty-bouncer.conf.bak
47-
grep -f /tmp/config_example.newvals /tmp/crowdsec/config/config_example.conf >> /config/crowdsec/crowdsec-openresty-bouncer.conf
48-
fi
49-
else
50-
echo "Deploy new crowdsec-openresty-bouncer.conf .."
51-
cp /tmp/crowdsec/config/config_example.conf /config/crowdsec/crowdsec-openresty-bouncer.conf
52-
53-
fi
54-
echo "Deploy Templates .."
55-
sed -i 's|/var/lib/crowdsec/lua/templates|/config/crowdsec/templates|' /config/crowdsec/crowdsec-openresty-bouncer.conf
56-
cp -r /tmp/crowdsec/templates/* /config/crowdsec/templates/
9+
mkdir -p /config/crowdsec
10+
echo "Deploy Crowdsec Openresty Bouncer manually.."
11+
if [ -f /config/crowdsec/crowdsec-openresty-bouncer.conf ]; then
12+
echo "Patch crowdsec-openresty-bouncer.conf .."
13+
sed "s/=.*//g" /config/crowdsec/crowdsec-openresty-bouncer.conf > /tmp/crowdsec.conf.raw
14+
sed "s/=.*//g" /defaults/crowdsec/config_example.conf > /tmp/config_example.conf.raw
15+
if grep -vf /tmp/crowdsec.conf.raw /tmp/config_example.conf.raw ; then
16+
grep -vf /tmp/crowdsec.conf.raw /tmp/config_example.conf.raw > /tmp/config_example.newvals
17+
cp /config/crowdsec/crowdsec-openresty-bouncer.conf /config/crowdsec/crowdsec-openresty-bouncer.conf.bak
18+
grep -f /tmp/config_example.newvals /defaults/crowdsec/config_example.conf >> /config/crowdsec/crowdsec-openresty-bouncer.conf
5719
fi
58-
59-
[ -n "${CROWDSEC_APIKEY}" ] && sed -i 's|API_KEY=.*|API_KEY='${CROWDSEC_APIKEY}'|' /config/crowdsec/crowdsec-openresty-bouncer.conf
60-
[ -n "${CROWDSEC_HOSTNAME}" ] && sed -i 's|API_URL=.*|API_URL='${CROWDSEC_HOSTNAME}'|' /config/crowdsec/crowdsec-openresty-bouncer.conf
20+
else
21+
echo "Deploy new crowdsec-openresty-bouncer.conf .."
22+
cp /defaults/crowdsec/config_example.conf /config/crowdsec/crowdsec-openresty-bouncer.conf
6123
fi
62-
exit 0
24+
echo "Deploy Templates .."
25+
sed -i 's|/defaults/crowdsec/templates|/config/crowdsec/templates|' /config/crowdsec/crowdsec-openresty-bouncer.conf
26+
cp -r /defaults/crowdsec/templates/* /config/crowdsec/templates/

0 commit comments

Comments
 (0)