Improve Meilisearch and CrowdSec documentation
incus-meilisearch-manual.md: - Add production config file settings (config.toml) - Add Master Key requirements (min 16 bytes, 32 recommended) - Add API key management section (Master/Admin/Search separation) - Add snapshot and dump backup/restore procedures - Add client usage examples (JavaScript, Python) incus-crowdsec-architecture.md: - Add Bouncer auto-registration via environment variables - Add Docker Compose example with BOUNCER_KEY_<name> - Add Docker Secrets approach for secure key management - Add acquisition directory structure (/etc/crowdsec/acquis.d/) - Add service-specific acquisition file examples Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -152,6 +152,40 @@ labels:
|
||||
type: nginx
|
||||
```
|
||||
|
||||
**Acquisition 디렉토리 구조화** (권장):
|
||||
```bash
|
||||
# /etc/crowdsec/acquis.d/ 디렉토리에 서비스별 파일 분리
|
||||
/etc/crowdsec/acquis.d/
|
||||
├── nginx.yaml # Nginx 로그
|
||||
├── apache.yaml # Apache 로그 (필요시)
|
||||
├── sshd.yaml # SSH 로그
|
||||
└── traefik.yaml # Traefik 로그 (필요시)
|
||||
```
|
||||
|
||||
**nginx.yaml 예시**:
|
||||
```yaml
|
||||
filenames:
|
||||
- /var/log/nginx/access.log
|
||||
- /var/log/nginx/error.log
|
||||
labels:
|
||||
type: nginx
|
||||
---
|
||||
# JSON 형식 로그 (별도 처리)
|
||||
filenames:
|
||||
- /var/log/nginx/json_access.log
|
||||
labels:
|
||||
type: nginx
|
||||
format: json
|
||||
```
|
||||
|
||||
**sshd.yaml 예시**:
|
||||
```yaml
|
||||
filenames:
|
||||
- /var/log/auth.log
|
||||
labels:
|
||||
type: syslog
|
||||
```
|
||||
|
||||
### Layer 2: OpenAppSec ML WAF
|
||||
|
||||
**Container**: `openappsec`
|
||||
@@ -206,12 +240,77 @@ nginx-logs: /var/log/nginx
|
||||
|
||||
### Security Configuration
|
||||
|
||||
#### CrowdSec Bouncer
|
||||
#### CrowdSec Bouncer (수동 등록)
|
||||
```yaml
|
||||
API_URL: http://10.90.135.49:8080
|
||||
API_KEY: s0ENc/6Tw+6m6tr0Qkjt/WAYU1QlC5/MzH7SQOCJX50
|
||||
```
|
||||
|
||||
#### Bouncer 자동 등록 (권장)
|
||||
|
||||
> 컨테이너 시작 시 환경변수로 Bouncer 자동 등록. 수동 `cscli bouncers add` 불필요.
|
||||
|
||||
**환경변수 방식**:
|
||||
```bash
|
||||
# CrowdSec 컨테이너 시작 시 Bouncer 자동 등록
|
||||
incus launch docker.io/crowdsecurity/crowdsec crowdsec \
|
||||
--config environment.BOUNCER_KEY_openresty=my-secure-bouncer-key-here \
|
||||
--config environment.BOUNCER_KEY_firewall=another-bouncer-key-here
|
||||
```
|
||||
|
||||
**Docker Compose 예시**:
|
||||
```yaml
|
||||
services:
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:latest
|
||||
environment:
|
||||
# Bouncer 자동 등록 (BOUNCER_KEY_<name>=<key>)
|
||||
- BOUNCER_KEY_openresty=${OPENRESTY_BOUNCER_KEY}
|
||||
- BOUNCER_KEY_firewall=${FIREWALL_BOUNCER_KEY}
|
||||
# 컬렉션 자동 설치
|
||||
- COLLECTIONS=crowdsecurity/nginx crowdsecurity/http-cve
|
||||
volumes:
|
||||
- crowdsec-data:/var/lib/crowdsec/data
|
||||
- crowdsec-config:/etc/crowdsec
|
||||
- /var/log/nginx:/var/log/nginx:ro
|
||||
restart: unless-stopped
|
||||
|
||||
openresty:
|
||||
image: openresty/openresty:latest
|
||||
environment:
|
||||
- CROWDSEC_API_URL=http://crowdsec:8080
|
||||
- CROWDSEC_API_KEY=${OPENRESTY_BOUNCER_KEY}
|
||||
depends_on:
|
||||
- crowdsec
|
||||
```
|
||||
|
||||
**Docker Secret 방식 (더 안전)**:
|
||||
```yaml
|
||||
services:
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:latest
|
||||
secrets:
|
||||
- bouncer_key_openresty
|
||||
- bouncer_key_firewall
|
||||
# Secret 파일은 /run/secrets/bouncer_key_<name> 으로 마운트됨
|
||||
|
||||
secrets:
|
||||
bouncer_key_openresty:
|
||||
file: ./secrets/openresty_bouncer_key
|
||||
bouncer_key_firewall:
|
||||
file: ./secrets/firewall_bouncer_key
|
||||
```
|
||||
|
||||
```bash
|
||||
# Secret 파일 생성
|
||||
mkdir -p secrets
|
||||
openssl rand -base64 32 > secrets/openresty_bouncer_key
|
||||
openssl rand -base64 32 > secrets/firewall_bouncer_key
|
||||
chmod 600 secrets/*
|
||||
```
|
||||
|
||||
> **주의**: 환경변수/Secret 방식은 초기 배포 시에만 동작. 기존 Bouncer 업데이트는 `cscli` 사용.
|
||||
|
||||
#### OpenResty Configuration
|
||||
```nginx
|
||||
upstream openappsec_backend {
|
||||
|
||||
Reference in New Issue
Block a user