crowdsecurity / cs-openresty-bouncer

CrowdSec bouncer for OpenResty
MIT License
11 stars 5 forks source link

Using nginx-proxy-manager, no 'check-in' when NPM starts while in 'live' mode. #32

Closed baudneo closed 2 years ago

baudneo commented 2 years ago

To be clear everything is working as it should be, bans and captchas work, etc. The only thing I am noticing is when I cscli bouncers list the openresty bouncer is not 'checking in' (The startup=true/false query is not attached in 'live' mode). Only reason I mention it is it may cause confusion with some users.

Stream mode sends the startup=true/false queries where live does not. 'live' only sends ip=. I am testing a fork where live mode sends startup= queries alongside the ip=. This updates the 'LAST API PULL' time for openresty bouncer when it is in live mode.

crowdsec-openresty-bouncer.conf

lua_package_path '$prefix/../lualib/plugins/crowdsec/?.lua;;';
lua_shared_dict crowdsec_cache 50m;
lua_ssl_trusted_certificate ${SSL_CERTS_PATH};

init_by_lua_block {
    cs = require "crowdsec"
    local ok, err = cs.init("/etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf", "crowdsec-openresty-bouncer/v0.1.11")
    if ok == nil then
        ngx.log(ngx.ERR, "[Crowdsec] " .. err)
        error()
    end
    if ok == "Disabled" then
        ngx.log(ngx.ALERT, "[Crowdsec] Bouncer Disabled")
    else
        ngx.log(ngx.ALERT, "[Crowdsec] Initialisation done")
    end
}

access_by_lua_block {
    local cs = require "crowdsec"
    cs.Allow(ngx.var.remote_addr)
}
blotus commented 2 years ago

Hello,

This will be fixed in the next crowdsec release, see https://github.com/crowdsecurity/crowdsec/pull/1445.