From 42aabe048fc849b09b06701a658ba71d1ff596ec Mon Sep 17 00:00:00 2001
From: Joseph Hanson <joe@veri.dev>
Date: Tue, 10 Oct 2023 16:15:00 -0500
Subject: [PATCH] Adding crowdsec nginx bouncer plugin.

---
 .../ingress-nginx/app/helmrelease.yaml        | 38 ++++++++++++++-----
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/kubernetes/apps/network/ingress-nginx/app/helmrelease.yaml b/kubernetes/apps/network/ingress-nginx/app/helmrelease.yaml
index d2d8d51..cc0e98c 100644
--- a/kubernetes/apps/network/ingress-nginx/app/helmrelease.yaml
+++ b/kubernetes/apps/network/ingress-nginx/app/helmrelease.yaml
@@ -17,16 +17,8 @@ spec:
   values:
     controller:
       replicaCount: 3
-
-      # hostPort:
-      #   enabled: true
-      #   ports:
-      #     http: 81
-      #     https: 444
-
       updateStrategy:
         type: RollingUpdate
-
       service:
         enabled: true
         type: LoadBalancer
@@ -67,8 +59,10 @@ spec:
         proxy-buffer-size: "16k"
         ssl-protocols: "TLSv1.3 TLSv1.2"
         use-forwarded-headers: "true"
-        # plugins: "crowdsec"
-        # lua-shared-dicts: "crowdsec_cache: 50m"
+        plugins: "crowdsec"
+        lua-shared-dicts: "crowdsec_cache: 50m"
+        server-snippet: |
+          resolver local=on ipv6=off;
 
       extraArgs:
         default-ssl-certificate: "network/valinor-social-tls"
@@ -100,6 +94,30 @@ spec:
         requests:
           cpu: 23m
           memory: 381M
+      extraVolumes:
+        - name: crowdsec-bouncer-plugin
+          emptyDir: {}
+      extraInitContainers:
+        - name: init-clone-crowdsec-bouncer
+          image: crowdsecurity/lua-bouncer-plugin
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: API_URL
+              value: "http://crowdsec-service.security.svc.cluster.local:8080" # crowdsec lapi service-name
+            - name: API_KEY
+              value: "<API KEY>" # generated with `cscli bouncers add -n <bouncer_name>
+            - name: BOUNCER_CONFIG
+              value: "/crowdsec/crowdsec-bouncer.conf"
+            - name: BAN_TEMPLATE_PATH
+              value: /etc/nginx/lua/plugins/crowdsec/templates/ban.html
+          command: ['sh', '-c', "sh /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/"]
+          volumeMounts:
+            - name: crowdsec-bouncer-plugin
+              mountPath: /lua_plugins
+      extraVolumeMounts:
+        - name: crowdsec-bouncer-plugin
+          mountPath: /etc/nginx/lua/plugins/crowdsec
+          subPath: crowdsec
 
     defaultBackend:
       enabled: false