search

crowdsecurity / crowdsec-docs

CrowdSec Documentation: Comprehensive guides, tutorials, and references for installing, configuring, and using CrowdSec, an open-source cybersecurity platform. Contributions welcome!
https://doc.crowdsec.net/
26 stars 80 forks source link

HAProxy bouncer: what does 'local API' mean? #677

Open WilliamDEdwards opened 1 week ago

WilliamDEdwards commented 1 week ago

The HAProxy bouncer documentation speaks of a 'local API' (being CrowdSec).

However, many pieces of the documentation show that any (remote) API can be used:

You must declare a backend for Crowdsec so we're able to resolve it's address during the refresh task. replace 127.0.0.1:8080 by the listen URI of the crowdsec local API

etc.

So, what does 'local API' mean in this context?

LaurenceJJones commented 1 week ago

The HAProxy bouncer documentation speaks of a 'local API' (being CrowdSec).

However, many pieces of the documentation show that any (remote) API can be used:

You must declare a backend for Crowdsec so we're able to resolve it's address during the refresh task. replace 127.0.0.1:8080 by the listen URI of the crowdsec local API

etc.

So, what does 'local API' mean in this context?

* 'Local' as in: non-SaaS

* 'Local' as in: on the same machine as the bouncer

So this documentation has lacked behind as we do offer integrations which can be used with it, however, it never been tested by us (on the haproxy lua directly).

So "local api" is the term used to define the API that is exposed by the CrowdSec Security Engine as seen by this info graphic https://docs.crowdsec.net/docs/next/intro#architecture

We call it "local" as it typically runs locally, however, this can be incorrect terminology as you can also run "local api" remotely and have systems talk to them. However, it would be hard for us to refactor this, as we used this terminology everywhere. Hence why we currently have an effort in #666 to refactor the structure to help improve the understanding of these core components.