crowdsec-agent¶
crowdsec-agent is CrowdSec with its local API turned off: a log processor that reads one host's logs and reports to a CrowdSec server elsewhere. CrowdSec looks through logs for the patterns of an attack and blocks the addresses behind them.
No host lists it. CrowdSec was cut from the plan, for the reasons on crowdsec-server. See Not in the plan.
The folder stays in the fleet-stacks repo because the container definition still works. To run it on a host of your own, see Applications (ap01).
What it runs¶
| Service | Does |
|---|---|
crowdsec-agent |
Reads Traefik's access log from /opt/docker/logs/traefik/traefik, mounted read-only, and the logs of containers that carry CrowdSec's labels, and sends what it finds to the server |
socket-proxy |
Gives the agent a filtered, read-only view of the Docker socket, which it reads container logs through |
No container in fleet-stacks carries CrowdSec's labels, so the agent reads no container's log until one does. The acquisition file is the same one the server uses. See The log processor.
The project is crowdsec, and the containers are crowdsec-crowdsec-agent and crowdsec-socket-proxy.
crowdsec-server uses the same project and runs a log processor of its own. The host with the server on it does not take this stack as well.
Values it reads¶
| Key | Reads | Kind | Described under |
|---|---|---|---|
CROWDSEC_LAPI_URL |
GLOBAL_CROWDSEC_LAPI_URL |
Variable | CrowdSec |
It also reads the 19 operational defaults, as every stack does.
GLOBAL_CROWDSEC_LAPI_URL is the one value in the register that no page stages. CrowdSec is not in the plan, so nothing in the fleet reads it, and the register lists it only because this stack's file still references it. See CrowdSec.
A host that runs the agent needs two things that are not there by default:
| Value | Where it goes |
|---|---|
GLOBAL_CROWDSEC_LAPI_URL |
A Komodo Variable, holding the URL of the server's API on port 8080 |
CROWDSEC_AGENT_PASSWORD |
The host's komodo_stack_env, as a reference to a Komodo Secret of your own |
The second key is blank in the stack's file. The password is a secret, so the inventory holds a reference such as "[[CROWDSEC_AGENT_PASSWORD]]" and never the value. See Stack values.
The agent signs in to the server under the name crowdsec., the host, the sub-domain, and the domain, such as crowdsec.ap01.home.myah-mitchell.com. The server has to hold a machine of that name with the same password.
What the host needs¶
The project is crowdsec, so the stack's folders sit under /opt/docker/volumes/crowdsec and /opt/docker/logs/crowdsec. Both are mode 0750, owned by the admin account with group 101000.
| Folder | Owner | Mode |
|---|---|---|
/opt/docker/volumes/crowdsec/crowdsec-data |
100000:100000 |
Default |
/opt/docker/volumes/crowdsec/crowdsec-config |
100000:100000 |
Default |
This stack opens no port on the host's firewall.
The host's NixOS configuration creates the folders when the host is deployed. It reads them from the host's file in the private repo, nixos/hosts/<host>.json, which nixos-sync.yml writes from the stack's setup.yaml. See Host layout.
The stack has no route, so it needs no Traefik on the host. Every connection it makes is outbound, to the server.
Verify¶
On the host, list the Stack's containers. Komodo names the Compose project after the Stack, not after PROJECT_NAME:
Both containers show healthy in the STATUS column. The check only asks CrowdSec for its version, so it says the container is up and nothing about the link to the server.
Ask the agent whether it can reach the server:
The output includes You can successfully interact with Local API (LAPI).
Not yet confirmed¶
- The stack has not been deployed on any host.
- Reading Traefik's access log, and whether the container may open the file. See the same two items on crowdsec-server.