Ubuntu

Total Time Required

10 minutes

Difficulty

Easy

Required Knowledge

Crowdsec, Docker Compose

Prerequisites

• Crowdsec account

• You have subscribed to atleast 1 block list

• Your Crowdsec enrollment key

This stack monitors...

• SSH logs

• Sudo logs

• Crowdsec blocklists

• Crowdsec whitelists

... And changes

• Host firewall

Docker Compose

# --- CrowdSec Engine Settings ---
CROWDSEC_ENROLL_KEY=
BOUNCER_KEY=
CROWDSEC_NAME=
CROWDSEC_PORT=8080

https://github.com/trentnbauer/HomelabPublic/blob/main/docker-compose/crowdsec-firewall.yml

services:
  engine:
    image: crowdsecurity/crowdsec:v1.7.8@sha256:2f527c9bb8b367120eb08b82890aa912ce96bfa1ada93dda0721700e4b4e0dde
    labels:
      - AH.CS.Firewall=true
    deploy:
      restart_policy:
        condition: on-failure
        delay: 60s
        max_attempts: 6
        window: 60s
    restart: unless-stopped
    ports:
      - ${CROWDSEC_PORT:-8080}:8080
    depends_on:
      init:
        condition: service_completed_successfully
    environment:
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/sshd crowdsecurity/http-cve crowdsecurity/linux-lpe crowdsecurity/iptables
      - ENROLL_INSTANCE_NAME=${CROWDSEC_NAME}
      - BOUNCER_KEY_FIREWALL=${BOUNCER_KEY}
      - DISABLE_LOCAL_API=false
      - DISABLE_ONLINE_API=false
      - ENROLL_KEY=${CROWDSEC_ENROLL_KEY}
    volumes:
      - data:/var/lib/crowdsec/data
      - config:/etc/crowdsec
      - bouncer:/etc/bouncer-shared
      - /var/log:/var/log:ro
    healthcheck:  
      test: ["CMD", "cscli", "version"]
      interval: 15s
      timeout: 10s
      retries: 5
    networks:
      crowdsec:
        aliases:
          - crowdsec

  bouncer:
    image: ghcr.io/shgew/cs-firewall-bouncer-docker:v0.0.36@sha256:4a7bd2e3eda81f9382f6e8571cebff7192e9b300e99d1cd5993b3b03580a0cb8
    labels:
      - AH.CS.Firewall=true
    deploy:
      restart_policy:
        condition: on-failure
        delay: 60s
        max_attempts: 6
        window: 60s
    restart: unless-stopped
    network_mode: host
    depends_on:
      engine:
        condition: service_healthy
    cap_add:
      - NET_ADMIN
      - NET_RAW
    security_opt:
      - no-new-privileges:true
    environment:
      - API_URL=http://localhost:${CROWDSEC_PORT:-8080}/
      - API_KEY=${BOUNCER_KEY}
    volumes:
      - bouncer:/config:rw
      - /etc/localtime:/etc/localtime:ro

  init:
    image: alpine:3.24.1
    volumes:
      - config:/etc/crowdsec
      - bouncer:/etc/crowdsec/bouncers
    command: >
      sh -c "apk add --no-cache wget ca-certificates &&
             mkdir -p /etc/crowdsec/acquisitions.d /etc/crowdsec/bouncers &&
             wget -qO /etc/crowdsec/acquisitions.d/ubuntu.yaml https://raw.githubusercontent.com/trentnbauer/HomelabPublic/main/crowdsec/ubuntu.yaml &&
             wget -qO /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml https://raw.githubusercontent.com/trentnbauer/HomelabPublic/main/crowdsec/crowdsec-firewall-bouncer.yaml"

  autoheal:
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 30s
        max_attempts: 5
        window: 120s
    environment:
      AUTOHEAL_CONTAINER_LABEL: AH.CS.Firewall
      AUTOHEAL_INTERVAL: 60
      AUTOHEAL_START_PERIOD: 240
      AUTOHEAL_DEFAULT_STOP_TIMEOUT: 60
      WEBHOOK_URL: ${AUTOHEAL_WEBHOOK:-}
    image: willfarrell/autoheal@sha256:2ae2ff2c4047be936db416005262978b0d20d98d8f8dbfd2bc8bb97bbfc1a7b5
    restart: always
    network_mode: none
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock

networks:
  crowdsec:

volumes:
  config:
  data:
  bouncer: