chore: add crowdsec

monitoring/security/docker-compose-security.yml

@@ -18,10 +18,11 @@ services:
         container_name: monitoring_nginx
         restart: unless-stopped
         ports:
-            - "80:80"
-            - "443:443"
-            - "8080:8080"
-            - "8090:8090"
+            - "10.0.0.2:80:80"
+            - "10.0.0.2:443:443"
+            - "10.0.0.2:8080:8080"
+            - "10.0.0.2:8090:8090"
+            - "10.0.0.2:3001:3001"
         volumes:
             - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
             - ./nginx/certs:/etc/nginx/certs:ro
@@ -101,6 +102,9 @@ services:
             - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
             - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
             - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+            - crowdsec_logs:/var/log/crowdsec:ro
+            - /var/run/docker.sock:/var/run/docker.sock
+            - /usr/bin/docker:/usr/local/bin/docker:ro
         networks:
             - monitoring_net
 
@@ -156,6 +160,49 @@ services:
             - wazuh.manager
         networks:
             - monitoring_net
+    uptime-kuma:
+        image: louislam/uptime-kuma:1
+        container_name: uptime-kuma
+        restart: unless-stopped
+        volumes:
+            - uptime_kuma_data:/app/data
+        networks:
+            - monitoring_net
+
+
+    # ─── CrowdSec LAPI ────────────────────────────────────────
+    crowdsec:
+        image: crowdsecurity/crowdsec:latest
+        container_name: crowdsec
+        restart: unless-stopped
+        environment:
+            COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd"
+            GID: "0"
+        volumes:
+            - /var/log:/var/log/host:ro
+            - nginx_logs:/var/log/nginx:ro
+            - crowdsec_data:/var/lib/crowdsec/data
+            - crowdsec_config:/etc/crowdsec
+            - crowdsec_logs:/var/log/crowdsec
+        ports:
+            - "127.0.0.1:7777:8080"
+            - "10.0.0.2:8081:8080"
+        networks:
+            - monitoring_net
+
+    # ─── CrowdSec Firewall Bouncer ────────────────────────────
+    crowdsec-bouncer:
+        image: ghcr.io/crowdsecurity/cs-firewall-bouncer:latest
+        container_name: crowdsec-bouncer
+        restart: unless-stopped
+        network_mode: host
+        cap_add:
+            - NET_ADMIN
+            - NET_RAW
+        volumes:
+            - ./crowdsec/bouncer-monitoring.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml:ro
+        depends_on:
+            - crowdsec
 networks:
     monitoring_net:
         driver: bridge
@@ -177,3 +224,7 @@ volumes:
     beszel_data:
     clamav_data:
     clamav_logs:
+    crowdsec_data:
+    crowdsec_config:
+    crowdsec_logs:
+    uptime_kuma_data: