41 lines
1.5 KiB
Docker
41 lines
1.5 KiB
Docker
ARG IPTABLES_MODE=nft
|
|
|
|
#install iptables
|
|
FROM ubuntu:noble AS apt
|
|
RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked --mount=type=cache,target=/var/cache/apt,sharing=locked <<EOF
|
|
apt update
|
|
apt upgrade -y
|
|
apt install iptables jq -y
|
|
EOF
|
|
|
|
#set alternative to use iptables-legacy
|
|
FROM apt AS iptables-legacy
|
|
RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
|
|
RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
|
|
|
|
#set alternative to use iptables-nft
|
|
FROM apt AS iptables-nft
|
|
RUN update-alternatives --set iptables /usr/sbin/iptables-nft
|
|
RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
|
|
|
|
#build crowdsec-custom-bouncer
|
|
FROM golang:1.24 AS build-stage
|
|
WORKDIR /app
|
|
RUN git clone --depth 1 https://github.com/crowdsecurity/cs-custom-bouncer.git
|
|
WORKDIR /app/cs-custom-bouncer
|
|
RUN CGO_ENABLED=0 GOOS=linux make release
|
|
|
|
#build the final image
|
|
FROM iptables-${IPTABLES_MODE} AS crowdsec-custom-bouncer
|
|
ARG IPTABLES_MODE=nft
|
|
RUN mkdir -p /etc/crowdsec/bouncers
|
|
COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
|
|
/usr/bin/crowdsec-custom-bouncer
|
|
COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
|
|
/crowdsec-custom-bouncer.yaml
|
|
RUN sed -i "s/total_retries: .*/total_retries: 1/g" /crowdsec-custom-bouncer.yaml
|
|
ADD --chmod=770 bouncer.sh /bouncer.sh
|
|
ENV BINARY_PATH=/bouncer.sh
|
|
LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"
|
|
CMD ["/usr/bin/crowdsec-custom-bouncer", "-c", "/crowdsec-custom-bouncer.yaml"]
|