readme

.gitignore

@@ -0,0 +1 @@
+.vscode/

Dockerfile

@@ -27,6 +27,7 @@ COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
 COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
     /crowdsec-custom-bouncer.yaml
 ADD --chmod=770 bouncer.sh /bouncer.sh
+RUN echo "bin_path: /bouncer.sh" >> /crowdsec-custom-bouncer.yaml
 #prometheus port
 LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"
 CMD ["/usr/bin/crowdsec-custom-bouncer", "-c", "/crowdsec-custom-bouncer.yaml"]

README.md

@@ -0,0 +1,42 @@
+# crowdsec-legacy-firrewall-bouncer
+A Crowdsec firewall bouncer based on [crowdsec-custom-bouncer](https://github.com/crowdsecurity/cs-custom-bouncer) aimed at systems without support for `ipset`.
+
+## Tags :
+- [gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest](https://gitea.ar2000.me/AR2000/-/packages/container/crowdsec-legacy-firewall-bouncer/latest) : `iptables-legacy`
+- [gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy](https://gitea.ar2000.me/AR2000/-/packages/container/crowdsec-legacy-firewall-bouncer/legacy) : `iptables-legacy`
+- [gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft](https://gitea.ar2000.me/AR2000/-/packages/container/crowdsec-legacy-firewall-bouncer/nft) : `iptables-nft`
+
+## Environment variables :
+- `IPTABLES_COMMENT` : if set, iptables will load the `comment` module and use the reason argument passed by [crowdsec-custom-bouncer](https://github.com/crowdsecurity/cs-custom-bouncer) as the comment
+- `IPTABLES_INSERT` : insert new firewall rules at a fixed position
+- `API_KEY` : crowdsec api key
+
+## Configuration :
+Set your custom configuration in the `crowdsec-custom-bouncer.yaml.local` file and mount it as a volume at the root of the container. See [Overriding values](https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration/#overriding-values) or [bouncers/custom](https://docs.crowdsec.net/u/bouncers/custom) for information about the configuration.
+
+### Example configuration :
+```yaml
+log_mode: stdout
+scenarios_containing: ["ssh"]
+origins: ["cscli", "crowdsec"]
+supported_decisions_types:
+  - ban
+```
+
+## Docker compose :
+```yaml
+services:
+    cs-firewall-bouncer:
+        image: gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy
+        restart: unless-stopped
+        environment:
+            - IPTABLES_INSERT=3
+            - IPTABLES_COMMENT=true
+        cap_add:
+            # allow modification of host's iptable
+            - NET_ADMIN
+            - NET_RAW
+        network_mode: "host"
+        volumes:
+            - ./crowdsec-custom-bouncer.yaml.local:/crowdsec-custom-bouncer.yaml.local #load custom config values
+```

bouncer.sh

@@ -2,7 +2,7 @@
 #
 # Script to add /remove IPs to iptables
 
-[[ -z "${IPTABLES_COMMENT}" ]] && commment="-m comment --comment $4" || comment=""
+[[ -z "${IPTABLES_COMMENT}" ]] && commment="-m comment --comment \"$4\"" || comment=""
 
 function iptableAdd () {
     if [[ -z "${IPTABLES_INSERT}" ]]; then

build.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+docker build --build-arg IPTABLES_MODE=nft -t gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft .
+docker build --build-arg IPTABLES_MODE=legacy -t gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy .
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest

publish.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest