mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
33b0d018f9
Confirmed 2026-08-17: home's public IP gets a 403 ForbiddenException from AWS WAF in front of api.crowdsec.net, even on a bare unauthenticated test request - the VPS's IP gets a normal 401 on the identical request. This is an IP-level block unrelated to credentials, which is why LAPI kept hitting 403 on both anonymous auto-registration and console enroll with a fresh, valid enrollment key. Fix: HTTPS_PROXY/HTTP_PROXY pointed at a tinyproxy instance on the VPS (bound to its Netbird interface only, not internet-reachable), reachable from home over the existing Netbird mesh via netbird-cluster-router. cscli/crowdsec's Go HTTP client honors standard proxy env vars. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
140 lines
3.7 KiB
YAML
140 lines
3.7 KiB
YAML
# CrowdSec Helm chart values
|
|
# IP reputation + behavioral detection (Layer 0 of zero-trust stack)
|
|
#
|
|
# Components:
|
|
# LAPI - Central decision engine (PostgreSQL backend via CNPG)
|
|
# Agent - DaemonSet parsing pod logs from /var/log/pods/
|
|
# Firewall Bouncer - Deployed separately (see firewall-bouncer.yaml)
|
|
|
|
container_runtime: containerd
|
|
|
|
lapi:
|
|
env:
|
|
# PostgreSQL password from CNPG auto-generated secret
|
|
- name: DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-crowdsec-app
|
|
key: password
|
|
# CAPI enrollment (optional — user registers at app.crowdsec.net)
|
|
- name: ENROLL_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: crowdsec-capi-key
|
|
key: enrollment-key
|
|
optional: true
|
|
- name: ENROLL_INSTANCE_NAME
|
|
value: "homelabv5"
|
|
- name: ENROLL_TAGS
|
|
value: "k8s homelab talos"
|
|
# Pre-register firewall bouncer API key
|
|
- name: BOUNCER_KEY_firewall
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: crowdsec-bouncer-key
|
|
key: api-key
|
|
optional: true
|
|
# Route CAPI/console-enroll HTTPS calls (api.crowdsec.net) through a
|
|
# tinyproxy on the VPS, reachable over Netbird. Confirmed 2026-08-17:
|
|
# home's public IP gets a 403 from AWS WAF in front of CrowdSec's API
|
|
# (even on a bare unauthenticated request), while the VPS's IP gets a
|
|
# normal 401 - this is an IP-level block unrelated to credentials, so a
|
|
# fresh enrollment key alone doesn't help without changing egress IP.
|
|
# cscli's Go HTTP client honors these standard proxy env vars.
|
|
- name: HTTPS_PROXY
|
|
value: "http://100.108.113.41:8888"
|
|
- name: HTTP_PROXY
|
|
value: "http://100.108.113.41:8888"
|
|
- name: NO_PROXY
|
|
value: "localhost,127.0.0.1,.svc,.svc.cluster.local,10.244.0.0/16,10.96.0.0/16"
|
|
persistentVolume:
|
|
data:
|
|
enabled: false
|
|
config:
|
|
enabled: false
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
dashboard:
|
|
enabled: false
|
|
strategy:
|
|
type: Recreate
|
|
|
|
agent:
|
|
# Log acquisition sources
|
|
acquisition:
|
|
# Istio ingress gateway logs (all external traffic)
|
|
- namespace: istio-system
|
|
podName: istio-ingressgateway-*
|
|
program: nginx
|
|
poll_without_inotify: true
|
|
# Netbird management logs
|
|
- namespace: netbird
|
|
podName: netbird-management-*
|
|
program: netbird
|
|
poll_without_inotify: true
|
|
# Authentik server logs
|
|
- namespace: authentik
|
|
podName: authentik-server-*
|
|
program: authentik
|
|
poll_without_inotify: true
|
|
|
|
env:
|
|
# Install community collections for log parsing
|
|
- name: COLLECTIONS
|
|
value: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/http-cve"
|
|
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
# Wait for LAPI to be ready (must be a map, not scalar)
|
|
wait_for_lapi:
|
|
image:
|
|
repository: busybox
|
|
tag: "1.28"
|
|
|
|
# PostgreSQL database backend (CNPG) + auto-registration for agents
|
|
config:
|
|
config.yaml.local: |
|
|
db_config:
|
|
type: postgresql
|
|
user: app
|
|
password: ${DB_PASSWORD}
|
|
db_name: crowdsec
|
|
host: pg-crowdsec-rw.crowdsec.svc
|
|
port: 5432
|
|
sslmode: prefer
|
|
api:
|
|
server:
|
|
auto_registration:
|
|
enabled: true
|
|
token: ${REGISTRATION_TOKEN}
|
|
allowed_ranges:
|
|
- "10.244.0.0/16"
|
|
- "127.0.0.1/32"
|