Initial commit

2026-08-20 23:16:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,132 @@
+# CrowdSec Helm chart values
+# IP reputation + behavioral detection (Layer 0 of zero-trust stack)
+#
+# Components:
+#   LAPI - Central decision engine (PostgreSQL backend via CNPG)
+#   Agent - DaemonSet parsing pod logs from /var/log/pods/
+#   Firewall Bouncer - Deployed separately (see firewall-bouncer.yaml)
+
+container_runtime: containerd
+
+lapi:
+  env:
+    # PostgreSQL password from CNPG auto-generated secret
+    - name: DB_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: pg-crowdsec-app
+          key: password
+    # CAPI enrollment (optional — user registers at app.crowdsec.net)
+    - name: ENROLL_KEY
+      valueFrom:
+        secretKeyRef:
+          name: crowdsec-capi-key
+          key: enrollment-key
+          optional: true
+    - name: ENROLL_INSTANCE_NAME
+      value: "homelabv5"
+    - name: ENROLL_TAGS
+      value: "k8s homelab talos"
+    # Registration token for agent auto-registration (from chart-generated secret)
+    - name: REGISTRATION_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: crowdsec-lapi-secrets
+          key: registrationToken
+    # Pre-register firewall bouncer API key
+    - name: BOUNCER_KEY_firewall
+      valueFrom:
+        secretKeyRef:
+          name: crowdsec-bouncer-key
+          key: api-key
+          optional: true
+  persistentVolume:
+    data:
+      enabled: false
+    config:
+      enabled: false
+  securityContext:
+    capabilities:
+      drop:
+        - ALL
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+  dashboard:
+    enabled: false
+  strategy:
+    type: Recreate
+
+agent:
+  # Log acquisition sources
+  acquisition:
+    # Istio ingress gateway logs (all external traffic)
+    - namespace: istio-system
+      podName: istio-ingressgateway-*
+      program: nginx
+      poll_without_inotify: true
+    # Netbird management logs
+    - namespace: netbird
+      podName: netbird-management-*
+      program: netbird
+      poll_without_inotify: true
+    # Authentik server logs
+    - namespace: authentik
+      podName: authentik-server-*
+      program: authentik
+      poll_without_inotify: true
+
+  env:
+    # Install community collections for log parsing
+    - name: COLLECTIONS
+      value: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/http-cve"
+
+  securityContext:
+    capabilities:
+      drop:
+        - ALL
+  resources:
+    requests:
+      cpu: 25m
+      memory: 128Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
+  # Wait for LAPI to be ready (must be a map, not scalar)
+  wait_for_lapi:
+    image:
+      repository: busybox
+      tag: "1.28"
+
+# PostgreSQL database backend (CNPG) + auto-registration for agents
+config:
+  config.yaml.local: |
+    db_config:
+      type: postgresql
+      user: app
+      password: ${DB_PASSWORD}
+      db_name: crowdsec
+      host: pg-crowdsec-rw.crowdsec.svc
+      port: 5432
+      sslmode: prefer
+    api:
+      server:
+        auto_registration:
+          enabled: true
+          token: ${REGISTRATION_TOKEN}
+          allowed_ranges:
+            - "10.244.0.0/16"
+            - "127.0.0.1/32"