test: flux local cluster setup with infra-devops post
这个提交包含在：
@@ -0,0 +1,15 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: dev-cm-crt
|
||||
namespace: infra-net
|
||||
spec:
|
||||
secretName: dev-cm-crt
|
||||
issuerRef:
|
||||
name: dnspod
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
dnsNames:
|
||||
- "dev.cm"
|
||||
- "*.dev.cm"
|
||||
- "*.node.dev.cm"
|
||||
@@ -0,0 +1,461 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: static
|
||||
namespace: infra-net
|
||||
data:
|
||||
captcha.html: |
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta content="width=device-width,initial-scale=1,user-scalable=no,viewport-fit=cover" name="viewport">
|
||||
<title>出于安全原因 请完成验证</title>
|
||||
<script src="{{captcha_frontend_js}}" async defer></script>
|
||||
<style>
|
||||
* {
|
||||
-webkit-box-sizing: border-box;
|
||||
box-sizing: border-box
|
||||
}
|
||||
|
||||
body {
|
||||
padding: 0;
|
||||
margin: 0
|
||||
}
|
||||
|
||||
#error {
|
||||
position: relative;
|
||||
height: 100vh
|
||||
}
|
||||
|
||||
#error .error {
|
||||
position: absolute;
|
||||
left: 50%;
|
||||
top: 50%;
|
||||
-webkit-transform: translate(-50%, -50%);
|
||||
-ms-transform: translate(-50%, -50%);
|
||||
transform: translate(-50%, -50%)
|
||||
}
|
||||
|
||||
#error .error-bg {
|
||||
position: absolute;
|
||||
left: 0;
|
||||
right: 0;
|
||||
top: 0;
|
||||
bottom: 0;
|
||||
overflow: hidden
|
||||
}
|
||||
|
||||
#error .error-bg > div {
|
||||
position: absolute;
|
||||
top: 0;
|
||||
bottom: 0;
|
||||
width: 1px;
|
||||
background-color: #eee
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(1) {
|
||||
left: 20%
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(2) {
|
||||
left: 40%
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(3) {
|
||||
left: 60%
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(4) {
|
||||
left: 80%
|
||||
}
|
||||
|
||||
#error .error-bg > div:after {
|
||||
content: '';
|
||||
position: absolute;
|
||||
top: 0;
|
||||
left: -.5px;
|
||||
-webkit-transform: translateY(-160px);
|
||||
-ms-transform: translateY(-160px);
|
||||
transform: translateY(-160px);
|
||||
height: 160px;
|
||||
width: 2px;
|
||||
background-color: #1cfafe
|
||||
}
|
||||
|
||||
@-webkit-keyframes drop {
|
||||
90% {
|
||||
height: 20px
|
||||
}
|
||||
|
||||
100% {
|
||||
height: 160px;
|
||||
-webkit-transform: translateY(calc(100vh + 160px));
|
||||
transform: translateY(calc(100vh + 160px))
|
||||
}
|
||||
}
|
||||
|
||||
@keyframes drop {
|
||||
90% {
|
||||
height: 20px
|
||||
}
|
||||
|
||||
100% {
|
||||
height: 160px;
|
||||
-webkit-transform: translateY(calc(100vh + 160px));
|
||||
transform: translateY(calc(100vh + 160px))
|
||||
}
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(1):after {
|
||||
-webkit-animation: drop 3s infinite linear;
|
||||
animation: drop 3s infinite linear;
|
||||
-webkit-animation-delay: .2s;
|
||||
animation-delay: .2s
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(2):after {
|
||||
-webkit-animation: drop 2s infinite linear;
|
||||
animation: drop 2s infinite linear;
|
||||
-webkit-animation-delay: .7s;
|
||||
animation-delay: .7s
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(3):after {
|
||||
-webkit-animation: drop 3s infinite linear;
|
||||
animation: drop 3s infinite linear;
|
||||
-webkit-animation-delay: .9s;
|
||||
animation-delay: .9s
|
||||
}
|
||||
|
||||
#error .error-bg > div:nth-child(4):after {
|
||||
-webkit-animation: drop 2s infinite linear;
|
||||
animation: drop 2s infinite linear;
|
||||
-webkit-animation-delay: 1.2s;
|
||||
animation-delay: 1.2s
|
||||
}
|
||||
|
||||
.error {
|
||||
max-width: 520px;
|
||||
width: 100%;
|
||||
padding: 20px;
|
||||
text-align: center
|
||||
}
|
||||
|
||||
.error .error-code {
|
||||
height: 210px;
|
||||
line-height: 210px
|
||||
}
|
||||
|
||||
.error .error-code h1 {
|
||||
font-family: oswald, sans-serif;
|
||||
font-size: 80px;
|
||||
font-weight: 700;
|
||||
margin: 0;
|
||||
text-shadow: 4px 4px 0 #1cfafe
|
||||
}
|
||||
|
||||
.error h2 {
|
||||
font-family: oswald, sans-serif;
|
||||
font-size: 42px;
|
||||
font-weight: 700;
|
||||
margin: 0;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 1.6px
|
||||
}
|
||||
|
||||
.error p {
|
||||
font-family: lato, sans-serif;
|
||||
color: #000;
|
||||
font-weight: 400;
|
||||
margin-top: 20px;
|
||||
margin-bottom: 25px
|
||||
}
|
||||
|
||||
.error a {
|
||||
font-family: lato, sans-serif;
|
||||
padding: 10px 30px;
|
||||
display: inline-block;
|
||||
color: #000;
|
||||
font-weight: 400;
|
||||
text-transform: uppercase;
|
||||
-webkit-box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
|
||||
box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
|
||||
text-decoration: none;
|
||||
-webkit-transition: .2s all;
|
||||
transition: .2s all
|
||||
}
|
||||
|
||||
.error a:not(:first-of-type) {
|
||||
margin-left: 20px
|
||||
}
|
||||
|
||||
.error a:hover {
|
||||
background-color: #1cfafe;
|
||||
-webkit-box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe;
|
||||
box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe
|
||||
}
|
||||
|
||||
.error-social > a {
|
||||
width: 40px;
|
||||
height: 40px;
|
||||
line-height: 40px;
|
||||
padding: 0;
|
||||
margin: 0 5px
|
||||
}
|
||||
|
||||
.error-social > a:hover {
|
||||
background-color: #1cfafe;
|
||||
-webkit-box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe;
|
||||
box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe
|
||||
}
|
||||
|
||||
#captcha-form {
|
||||
position: relative;
|
||||
width: 300px;
|
||||
height: 65px;
|
||||
overflow: hidden;
|
||||
margin: 0 auto 30px;
|
||||
background-color: #fff;
|
||||
-webkit-box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
|
||||
box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
|
||||
}
|
||||
|
||||
.loading {
|
||||
position: absolute;
|
||||
top: 0;
|
||||
left: 0;
|
||||
z-index: 1;
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
width: 100%;
|
||||
height: 65px;
|
||||
gap: 10px;
|
||||
}
|
||||
|
||||
.loading:has(+ *) {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.loading::before {
|
||||
content: "";
|
||||
width: 20px;
|
||||
height: 20px;
|
||||
border: 2px solid #000;
|
||||
border-right-color: #1cfafe;
|
||||
border-radius: 50%;
|
||||
animation: spin 1s linear infinite;
|
||||
}
|
||||
|
||||
#captcha {
|
||||
position: relative;
|
||||
z-index: 2;
|
||||
}
|
||||
|
||||
@keyframes spin {
|
||||
from {
|
||||
transform: rotate(0deg);
|
||||
}
|
||||
to {
|
||||
transform: rotate(360deg);
|
||||
}
|
||||
}
|
||||
|
||||
@media only screen and (max-width: 480px) {
|
||||
.error .error-code {
|
||||
height: 122px;
|
||||
line-height: 122px
|
||||
}
|
||||
|
||||
.error .error-code h1 {
|
||||
font-size: 60px
|
||||
}
|
||||
|
||||
.error h2 {
|
||||
font-size: 26px
|
||||
}
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div id="error">
|
||||
<div class="error-bg">
|
||||
<div></div>
|
||||
<div></div>
|
||||
<div></div>
|
||||
<div></div>
|
||||
</div>
|
||||
<div class="error">
|
||||
<div class="error-code">
|
||||
<h1>FillCode</h1>
|
||||
</div>
|
||||
<h2>请完成验证</h2>
|
||||
<p>请完成下面验证, 页面将会自动跳转到访问页面。</p>
|
||||
<form id="captcha-form" method="POST">
|
||||
<div id="captcha" class="{{captcha_frontend_key}}" data-sitekey="{{captcha_site_key}}"
|
||||
data-callback="captchaCallback" data-size="flexible"></div>
|
||||
<div class="loading">验证码加载中, 请稍等...</div>
|
||||
</form>
|
||||
<a href="mailto:[email protected]">联系我们</a>
|
||||
</div>
|
||||
</div>
|
||||
<script>
|
||||
function captchaCallback() {
|
||||
setTimeout(() => document.querySelector('#captcha-form').submit(), 500)
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
pwa-cdn.js: |
|
||||
'use strict'
|
||||
|
||||
// 配置
|
||||
const pwaCdnConfig = {
|
||||
cdnUrl: 'https://cdn.fillcode.com/',
|
||||
serviceWorkerUrl: '/__static/sw-cdn.js',
|
||||
staticRegex: /\.(js|css|png|jpg|jpeg|gif|svg|webp|woff|woff2|ttf|ico)$/,
|
||||
debug: false,
|
||||
}
|
||||
|
||||
/**
|
||||
* PWA 初始化函数
|
||||
*/
|
||||
async function initializePWA() {
|
||||
// 检查支持
|
||||
if (!('serviceWorker' in navigator)) return console.log('PWA-CDN: Service Worker not supported')
|
||||
|
||||
let registration;
|
||||
|
||||
try {
|
||||
// 注册Service Worker - 使用相对路径
|
||||
registration = await navigator.serviceWorker.register(pwaCdnConfig.serviceWorkerUrl, {scope: '/'})
|
||||
|
||||
console.log('PWA-CDN: Service Worker registered')
|
||||
} catch (error) {
|
||||
console.error('PWA-CDN: Failed to register Service Worker:', error)
|
||||
}
|
||||
|
||||
// 发送初始配置
|
||||
const sendConfig = () => {
|
||||
registration.active.postMessage({type: 'CONFIG', config: pwaCdnConfig})
|
||||
}
|
||||
|
||||
// 如果注册失败，直接返回错误
|
||||
if(!registration) return console.error('PWA-CDN: Service Worker registration failed, cannot send config')
|
||||
|
||||
// 更新配置函数
|
||||
window.updatePWACDNConfig = (newConfig) => {
|
||||
Object.assign(pwaCdnConfig, newConfig)
|
||||
sendConfig()
|
||||
}
|
||||
|
||||
// 等待Service Worker激活后发送配置
|
||||
if (registration.active) sendConfig()
|
||||
|
||||
// 监听Service Worker更新事件
|
||||
registration.addEventListener('updatefound', () => {
|
||||
const newWorker = registration.installing
|
||||
|
||||
newWorker.addEventListener('statechange', () => {
|
||||
if (newWorker.state === 'activated') sendConfig()
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* 启动 PWA-CDN
|
||||
* */
|
||||
initializePWA().catch(console.error)
|
||||
|
||||
sw-cdn.js: |
|
||||
'use strict'
|
||||
|
||||
// Service Worker 配置 - 默认值
|
||||
let config = {
|
||||
cdnUrl: 'https://cdn.fillcode.com/',
|
||||
serviceWorkerUrl: '/__static/sw-cdn.js',
|
||||
staticRegex: /(.*\.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)|avatars[^/]+)$/,
|
||||
debug: false,
|
||||
}
|
||||
|
||||
// 监听配置更新消息
|
||||
self.addEventListener('message', e => {
|
||||
if (e.data.type !== 'CONFIG') return
|
||||
|
||||
config = e.data.config
|
||||
|
||||
if (config.debug) console.log('PWA-CDN: Config updated', config)
|
||||
})
|
||||
|
||||
// 拦截网络请求
|
||||
self.addEventListener('fetch', e => {
|
||||
const url = new URL(e.request.url)
|
||||
|
||||
// 如果请求不是GET方法，直接返回
|
||||
if (e.request.method !== 'GET') return
|
||||
|
||||
// 如果请求的域名不是当前页面的域名
|
||||
if (url.origin !== self.location.origin) return
|
||||
|
||||
// 过滤__static路径下的请求
|
||||
if (url.pathname.startsWith('/__static/')) return
|
||||
|
||||
// 如果请求的路径不匹配静态资源正则表达式，直接返回
|
||||
if (!config.staticRegex.test(url.pathname)) return
|
||||
|
||||
// 判断是否是强制需要同源请求
|
||||
const requiresSameOrigin = ['worker', 'sharedworker', 'serviceworker'].includes(e.request.destination)
|
||||
|
||||
// 如果是强制需要同源请求的资源类型，直接返回
|
||||
if (requiresSameOrigin) return
|
||||
|
||||
// 开始处理静态资源请求
|
||||
e.respondWith(handleStaticResource(e.request, url))
|
||||
})
|
||||
|
||||
// 处理静态资源请求
|
||||
async function handleStaticResource(request, url) {
|
||||
// 生成CDN子路径
|
||||
const hostname = self.location.hostname
|
||||
const cdnPath = hostname.replace(/\./g, '-')
|
||||
|
||||
const targetUrl = config.cdnUrl + cdnPath + url.pathname + url.search
|
||||
|
||||
if (config.debug) console.log('PWA-CDN:', url.href, '->', targetUrl)
|
||||
|
||||
try {
|
||||
// 创建新请求
|
||||
const newRequest = new Request(targetUrl, {
|
||||
...request,
|
||||
mode: 'cors',
|
||||
redirect: 'error',
|
||||
})
|
||||
|
||||
// 请求目标域名，浏览器会自动处理缓存
|
||||
const response = await fetch(newRequest)
|
||||
|
||||
// 检查响应状态
|
||||
if (!response.ok) throw new Error('PWA-CDN: Non-2xx response detected')
|
||||
|
||||
return response
|
||||
} catch (error) {
|
||||
if (config.debug) console.warn('PWA-CDN: Fallback to original request for', url.href, error)
|
||||
|
||||
// 失败时回退到原始请求
|
||||
return fetch(request)
|
||||
}
|
||||
}
|
||||
|
||||
// Service Worker 生命周期
|
||||
self.addEventListener('install', () => {
|
||||
if (config.debug) console.log('PWA-CDN: Service Worker installing')
|
||||
self.skipWaiting().catch(console.error)
|
||||
})
|
||||
|
||||
self.addEventListener('activate', () => {
|
||||
if (config.debug) console.log('PWA-CDN: Service Worker activated')
|
||||
self.clients.claim().catch(console.error)
|
||||
})
|
||||
|
||||
@@ -0,0 +1,217 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: crowdsec
|
||||
namespace: infra-net
|
||||
spec:
|
||||
interval: 30m
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
- name: loki
|
||||
namespace: infra-monitor
|
||||
chart:
|
||||
spec:
|
||||
chart: crowdsec
|
||||
version: 0.22.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: crowdsec
|
||||
namespace: infra-gitops
|
||||
interval: 12h
|
||||
values:
|
||||
container_runtime: containerd
|
||||
image:
|
||||
tag: v1.7.6
|
||||
agent:
|
||||
isDeployment: true
|
||||
additionalAcquisition:
|
||||
- source: loki
|
||||
log_level: info
|
||||
url: http://loki.infra-monitor:3100/
|
||||
limit: 1000
|
||||
query: |
|
||||
{job="infra-net/ingress-nginx"}
|
||||
labels:
|
||||
type: nginx
|
||||
env:
|
||||
- name: COLLECTIONS
|
||||
value: "crowdsecurity/base-http-scenarios crowdsecurity/http-dos"
|
||||
- name: SCENARIOS
|
||||
value: "crowdsecurity/nginx-req-limit-exceeded"
|
||||
persistentVolume:
|
||||
config:
|
||||
enabled: false
|
||||
appsec:
|
||||
enabled: false
|
||||
acquisitions:
|
||||
- source: appsec
|
||||
listen_addr: "0.0.0.0:7422"
|
||||
path: /
|
||||
appsec_config: crowdsecurity/crs-vpatch
|
||||
labels:
|
||||
type: appsec
|
||||
configs:
|
||||
mycustom-appsec-config.yaml: |
|
||||
name: crowdsecurity/crs-vpatch
|
||||
default_remediation: ban
|
||||
#log_level: debug
|
||||
outofband_rules:
|
||||
- crowdsecurity/crs
|
||||
inband_rules:
|
||||
- crowdsecurity/base-config
|
||||
- crowdsecurity/vpatch-*
|
||||
env:
|
||||
- name: COLLECTIONS
|
||||
value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs"
|
||||
lapi:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 150m
|
||||
memory: 100Mi
|
||||
persistentVolume:
|
||||
config:
|
||||
enabled: false
|
||||
data:
|
||||
enabled: false
|
||||
env:
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: cnpg17-cluster-hk-app
|
||||
key: password
|
||||
config:
|
||||
# api config.yaml配置
|
||||
config.yaml.local: |
|
||||
db_config:
|
||||
type: postgresql
|
||||
host: cnpg17-cluster-hk-rw.infra-data
|
||||
port: 5432
|
||||
db_name: crowdsec
|
||||
user: app
|
||||
password: ${DB_PASSWORD}
|
||||
sslmode: require
|
||||
api:
|
||||
server:
|
||||
auto_registration:
|
||||
enabled: true
|
||||
token: "${REGISTRATION_TOKEN}"
|
||||
allowed_ranges:
|
||||
- "127.0.0.1/32"
|
||||
- "192.168.0.0/16"
|
||||
- "172.16.0.0/12"
|
||||
- "10.0.0.0/8"
|
||||
# api profiles.yaml配置
|
||||
profiles.yaml: |
|
||||
name: captcha_remediation
|
||||
filters:
|
||||
# 规则过滤条件 1.范围为Ip 2.触发场景为http或nginx 3.24小时内决策次数小于等于3
|
||||
- Alert.Remediation == true && Alert.GetScope() == "Ip" &&
|
||||
(Alert.GetScenario() contains "http" || Alert.GetScenario() contains "nginx") &&
|
||||
GetDecisionsSinceCount(Alert.GetValue(), "24h") <= 3
|
||||
decisions:
|
||||
- type: captcha
|
||||
duration: 4h
|
||||
on_success: break
|
||||
---
|
||||
name: default_ip_remediation
|
||||
filters:
|
||||
- Alert.Remediation == true && Alert.GetScope() == "Ip"
|
||||
decisions:
|
||||
- type: ban
|
||||
duration: 4h
|
||||
on_success: break
|
||||
---
|
||||
name: default_range_remediation
|
||||
filters:
|
||||
- Alert.Remediation == true && Alert.GetScope() == "Range"
|
||||
decisions:
|
||||
- type: ban
|
||||
duration: 4h
|
||||
on_success: break
|
||||
# agent parsers 配置
|
||||
parsers:
|
||||
s01-parse:
|
||||
# 新增nginx json日志解析
|
||||
nginx-logs.yaml: |
|
||||
filter: "evt.Parsed.program startsWith 'nginx'"
|
||||
onsuccess: next_stage
|
||||
name: crowdsecurity/nginx-logs
|
||||
description: "Parse nginx access and error logs"
|
||||
pattern_syntax:
|
||||
NGCUSTOMURIPATH: "(?:/[A-Za-z0-9$.+!*'\\(\\)\\{\\},~:;=@\\#%&_\\-]*)+"
|
||||
NGCUSTOMURIPATHPARAM: '%{NGCUSTOMURIPATH}(?:%{URIPARAM})?'
|
||||
nodes:
|
||||
# nginx access logs
|
||||
- filter: TrimSpace(evt.Parsed.message) startsWith "{" && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "nginx") in ["", nil]
|
||||
statics:
|
||||
- meta: service
|
||||
value: http
|
||||
- meta: log_type
|
||||
value: http_access-log
|
||||
- target: evt.StrTime
|
||||
expression: evt.Unmarshaled.nginx.time_local
|
||||
- meta: source_ip
|
||||
expression: evt.Unmarshaled.nginx.remote_addr
|
||||
- meta: http_status
|
||||
expression: evt.Unmarshaled.nginx.status
|
||||
- meta: http_path
|
||||
expression: evt.Unmarshaled.nginx.request_uri
|
||||
- meta: http_verb
|
||||
expression: evt.Unmarshaled.nginx.request_method
|
||||
- meta: http_user_agent
|
||||
expression: evt.Unmarshaled.nginx.http_user_agent
|
||||
- meta: target_fqdn
|
||||
expression: evt.Unmarshaled.nginx.server_name
|
||||
# nginx error logs
|
||||
- grok:
|
||||
pattern: '(%{IPORHOST:target_fqdn} )?%{NGINXERRTIME:time} \[%{LOGLEVEL:loglevel}\] %{NONNEGINT:pid}#%{NONNEGINT:tid}: (\*%{NONNEGINT:cid} )?%{GREEDYDATA:message}, client: %{IPORHOST:remote_addr}, server: %{DATA:target_fqdn}, request: "%{WORD:verb} ([^/]+)?%{NGCUSTOMURIPATHPARAM:request}( HTTP/%{NUMBER:http_version})?", host: "%{IPORHOST}(:%{NONNEGINT})?"'
|
||||
apply_on: message
|
||||
statics:
|
||||
- meta: service
|
||||
value: http
|
||||
- meta: log_type
|
||||
value: http_error-log
|
||||
- target: evt.StrTime
|
||||
expression: evt.Parsed.time
|
||||
- meta: source_ip
|
||||
expression: evt.Parsed.remote_addr
|
||||
- meta: http_status
|
||||
expression: evt.Parsed.status
|
||||
- meta: http_path
|
||||
expression: evt.Parsed.request
|
||||
- meta: http_verb
|
||||
expression: evt.Parsed.verb
|
||||
- meta: http_user_agent
|
||||
expression: evt.Parsed.http_user_agent
|
||||
- meta: target_fqdn
|
||||
expression: evt.Parsed.target_fqdn
|
||||
pattern_syntax:
|
||||
NO_DOUBLE_QUOTE: '[^"]+'
|
||||
onsuccess: next_stage
|
||||
nodes:
|
||||
- filter: "evt.Parsed.message contains 'was not found in'"
|
||||
pattern_syntax:
|
||||
USER_NOT_FOUND: 'user "%{NO_DOUBLE_QUOTE:username}" was not found in "%{NO_DOUBLE_QUOTE}"'
|
||||
grok:
|
||||
pattern: '%{USER_NOT_FOUND}'
|
||||
apply_on: message
|
||||
statics:
|
||||
- meta: sub_type
|
||||
value: "auth_fail"
|
||||
- meta: username
|
||||
expression: evt.Parsed.username
|
||||
- filter: "evt.Parsed.message contains 'password mismatch'"
|
||||
pattern_syntax:
|
||||
PASSWORD_MISMATCH: 'user "%{NO_DOUBLE_QUOTE:username}": password mismatch'
|
||||
grok:
|
||||
pattern: '%{PASSWORD_MISMATCH}'
|
||||
apply_on: message
|
||||
statics:
|
||||
- meta: sub_type
|
||||
value: "auth_fail"
|
||||
- meta: username
|
||||
expression: evt.Parsed.username
|
||||
- filter: "evt.Parsed.message contains 'limiting requests, excess'"
|
||||
statics:
|
||||
- meta: sub_type
|
||||
value: "req_limit_exceeded"
|
||||
@@ -0,0 +1,195 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: infra-net
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: ingress-nginx
|
||||
version: 4.13.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: ingress-nginx
|
||||
namespace: infra-gitops
|
||||
interval: 12h
|
||||
values:
|
||||
fullnameOverride: ingress-nginx
|
||||
controller:
|
||||
image:
|
||||
registry: docker.io
|
||||
image: crowdsecurity/controller
|
||||
tag: v1.13.2
|
||||
digest: sha256:4575be24781cad35f8e58437db6a3f492df2a3167fed2b6759a6ff0dc3488d56
|
||||
labels:
|
||||
devcm-log-collecting/enabled: "true"
|
||||
kind: DaemonSet
|
||||
hostNetwork: true
|
||||
hostPort:
|
||||
enabled: true
|
||||
service:
|
||||
enabled: false
|
||||
publishService:
|
||||
enabled: false
|
||||
# 禁用默认的注解验证以防止冲突
|
||||
enableAnnotationValidations: false
|
||||
config:
|
||||
use-forwarded-headers: "true"
|
||||
enable-real-ip: "true"
|
||||
forwarded-for-header: "X-Dev-Cm-Real-IP"
|
||||
proxy-real-ip-cidr: "0.0.0.0/0"
|
||||
allow-snippet-annotations: "true"
|
||||
annotations-risk-level: Critical
|
||||
# 启用http2
|
||||
use-http2: "true"
|
||||
# http to https重定向
|
||||
ssl-redirect: "true"
|
||||
# 自定义错误页面
|
||||
custom-http-errors: "403,404,502,503"
|
||||
# 全局限速配置
|
||||
limit-req-status-code: "429"
|
||||
limit-conn-status-code: "429"
|
||||
http-snippet: |
|
||||
# lua插件配置
|
||||
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
||||
# 缓存配置
|
||||
proxy_cache_path /tmp/nginx-cache levels=1:2 keys_zone=cache:2m max_size=100m inactive=7d use_temp_path=off;
|
||||
proxy_cache_key $uri$is_args$args;
|
||||
proxy_cache_lock on;
|
||||
proxy_cache_use_stale updating;
|
||||
# 全局限速配置
|
||||
limit_req_zone $binary_remote_addr zone=global_limit:20m rate=20r/s;
|
||||
limit_req zone=global_limit burst=50 nodelay;
|
||||
server-snippet: |
|
||||
# dns配置 配置在http块下会出现重复配置 所以配置在server块下
|
||||
resolver 169.254.20.10 10.43.0.10 ipv6=off;
|
||||
# 代理全局静态资源 可提供serviceWorker的支持
|
||||
location ^~ /__static/ {
|
||||
proxy_pass http://ingress-nginx-defaultbackend.infra-net.svc.cluster.local/static/;
|
||||
proxy_set_header Host $host;
|
||||
add_header Service-Worker-Allowed "/";
|
||||
}
|
||||
# 启用geoip2模块
|
||||
use-geoip: "false"
|
||||
use-geoip2: "true"
|
||||
# 日志配置
|
||||
log-format-escape-json: "true"
|
||||
log-format-upstream: '{
|
||||
"msec": "$msec",
|
||||
"connection": "$connection",
|
||||
"connection_requests": "$connection_requests",
|
||||
"pid": "$pid",
|
||||
"request_id": "$request_id",
|
||||
"request_length": "$request_length",
|
||||
"remote_addr": "$remote_addr",
|
||||
"remote_user": "$remote_user",
|
||||
"remote_port": "$remote_port",
|
||||
"time_local": "$time_local",
|
||||
"time_iso8601": "$time_iso8601",
|
||||
"request": "$request",
|
||||
"request_uri": "$request_uri",
|
||||
"args": "$args",
|
||||
"status": "$status",
|
||||
"body_bytes_sent": "$body_bytes_sent",
|
||||
"bytes_sent": "$bytes_sent",
|
||||
"http_referer": "$http_referer",
|
||||
"http_user_agent": "$http_user_agent",
|
||||
"http_x_forwarded_for": "$http_x_forwarded_for",
|
||||
"http_host": "$http_host",
|
||||
"http_upgrade": "$http_upgrade",
|
||||
"server_name": "$server_name",
|
||||
"request_time": "$request_time",
|
||||
"upstream": "$upstream_addr",
|
||||
"upstream_connect_time": "$upstream_connect_time",
|
||||
"upstream_header_time": "$upstream_header_time",
|
||||
"upstream_response_time": "$upstream_response_time",
|
||||
"upstream_response_length": "$upstream_response_length",
|
||||
"upstream_cache_status": "$upstream_cache_status",
|
||||
"ssl_protocol": "$ssl_protocol",
|
||||
"ssl_cipher": "$ssl_cipher",
|
||||
"scheme": "$scheme",
|
||||
"request_method": "$request_method",
|
||||
"server_protocol": "$server_protocol",
|
||||
"pipe": "$pipe",
|
||||
"gzip_ratio": "$gzip_ratio",
|
||||
"http_cf_ray": "$http_cf_ray",
|
||||
"geoip_country_code": "$geoip2_city_country_code",
|
||||
"geoip_city": "$geoip2_city",
|
||||
"geoip_org": "$geoip2_org",
|
||||
"geoip_longitude": "$geoip2_longitude",
|
||||
"geoip_latitude": "$geoip2_latitude",
|
||||
"level": "info"
|
||||
}'
|
||||
# crowdsec插件配置
|
||||
plugins: "crowdsec"
|
||||
lua-shared-dicts: "crowdsec_cache: 50m"
|
||||
# 启用geoip2模块
|
||||
maxmindLicenseKey: ""
|
||||
extraArgs:
|
||||
default-ssl-certificate: "infra-net/dev-cm-crt"
|
||||
# crowdsec插件配置
|
||||
extraInitContainers:
|
||||
- name: init-clone-crowdsec-bouncer
|
||||
image: crowdsecurity/lua-bouncer-plugin:v1.1.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: SHELL
|
||||
value: "/bin/sh"
|
||||
- name: API_URL
|
||||
value: "http://crowdsec-service.infra-net.svc.cluster.local:8080"
|
||||
- name: API_KEY
|
||||
value: "ImxBThnyiNm224V5DHYPY63KPAcyJ+WF0rm18Gr4M80"
|
||||
- name: BOUNCER_CONFIG
|
||||
value: "/crowdsec/crowdsec-bouncer.conf"
|
||||
- name: MODE
|
||||
value: "live"
|
||||
- name: CACHE_EXPIRATION
|
||||
value: "3"
|
||||
- name: UPDATE_FREQUENCY
|
||||
value: "10"
|
||||
- name: REQUEST_TIMEOUT
|
||||
value: "1000"
|
||||
- name: CAPTCHA_PROVIDER
|
||||
value: "turnstile"
|
||||
- name: SITE_KEY
|
||||
value: "0x4AAAAAAAxJ2RPNWzn2LCc-"
|
||||
- name: SECRET_KEY
|
||||
value: "0x4AAAAAAAxJ2dwFOaNg5ae3c6wYTmWH0bU"
|
||||
- name: CAPTCHA_TEMPLATE_PATH
|
||||
value: /etc/nginx/static/captcha.html
|
||||
command: ['/bin/sh', '-c']
|
||||
args: ['sh /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/']
|
||||
volumeMounts:
|
||||
- name: crowdsec-bouncer-plugin
|
||||
mountPath: /lua_plugins
|
||||
extraVolumes:
|
||||
- name: crowdsec-bouncer-plugin
|
||||
emptyDir: {}
|
||||
- name: static
|
||||
configMap:
|
||||
name: static
|
||||
extraVolumeMounts:
|
||||
- name: crowdsec-bouncer-plugin
|
||||
mountPath: /etc/nginx/lua/plugins/crowdsec
|
||||
subPath: crowdsec
|
||||
- name: static
|
||||
mountPath: /etc/nginx/static
|
||||
defaultBackend:
|
||||
enabled: true
|
||||
image:
|
||||
registry: docker.io
|
||||
image: devcm/default-backend
|
||||
tag: v0.2.0
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
extraVolumes:
|
||||
- name: static
|
||||
configMap:
|
||||
name: static
|
||||
extraVolumeMounts:
|
||||
- name: static
|
||||
mountPath: /app/static
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: tailscale-derp-hk
|
||||
namespace: infra-net
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: tailscale-derp
|
||||
version: 0.0.9
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: devcm-repo
|
||||
namespace: infra-gitops
|
||||
interval: 12h
|
||||
values:
|
||||
image:
|
||||
tag: v1.94.1
|
||||
hostNetwork: true
|
||||
extraVolumes:
|
||||
- name: cert-volume
|
||||
secret:
|
||||
secretName: dev-cm-crt
|
||||
items:
|
||||
- key: tls.key
|
||||
path: tchk.node.dev.cm.key
|
||||
- key: tls.crt
|
||||
path: tchk.node.dev.cm.crt
|
||||
extraVolumeMounts:
|
||||
- name: cert-volume
|
||||
mountPath: /certs
|
||||
derp:
|
||||
hostname: "tchk.node.dev.cm"
|
||||
verify_clients: true
|
||||
http_port: -1
|
||||
https_port: 30443
|
||||
stun_port: 33478
|
||||
certdir: /certs
|
||||
@@ -0,0 +1,78 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: cdn
|
||||
namespace: infra-net
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/use-regex: "true"
|
||||
nginx.ingress.kubernetes.io/rewrite-target: "/$3"
|
||||
# 重定向配置
|
||||
nginx.ingress.kubernetes.io/proxy-redirect-from: "/"
|
||||
nginx.ingress.kubernetes.io/proxy-redirect-to: "/$1/"
|
||||
# 添加允许跨域请求
|
||||
nginx.ingress.kubernetes.io/enable-cors: "true"
|
||||
nginx.ingress.kubernetes.io/cors-allow-origin: "https://dev.cm, https://*.dev.cm, https://fillcode.cm, https://*.fillcode.cm"
|
||||
nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
|
||||
# cookie配置
|
||||
nginx.ingress.kubernetes.io/proxy-cookie-domain: "~^(.+)$ cdn.fillcode.com"
|
||||
nginx.ingress.kubernetes.io/proxy-cookie-path: "/ /$1"
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: |
|
||||
proxy_cookie_flags ~ SameSite=None Secure;
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: cdn.fillcode.com
|
||||
http:
|
||||
paths:
|
||||
- path: /(dev-cm)(/|$)(.*)
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: cdn-halo
|
||||
port:
|
||||
number: 80
|
||||
- path: /(git-dev-cm)(/|$)(.*)
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: cdn-gitea-http
|
||||
port:
|
||||
number: 3000
|
||||
- path: /(monitor-dev-cm)(/|$)(.*)
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: cdn-prometheus-grafana
|
||||
port:
|
||||
number: 80
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cdn-halo
|
||||
namespace: infra-net
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: halo.apps.svc.cluster.local
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cdn-gitea-http
|
||||
namespace: infra-net
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: gitea-http.infra-gitops.svc.cluster.local
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cdn-prometheus-grafana
|
||||
namespace: infra-net
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: prometheus-grafana.infra-monitor.svc.cluster.local
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- helmrelease-ingress-nginx.yaml
|
||||
- configmap-static.yaml
|
||||
- certificate-dev-cm.yaml
|
||||
- ingress-cdn.yaml
|
||||
- helmrelease-crowdsec.yaml
|
||||
- helmrelease-tailscale-derp.yaml
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: infra-net
|
||||
在新议题中引用
屏蔽一个用户