Support remote Authelia and remote/central CrowdSec LAPI
Both let the DO droplet lean on services already running on a homelab instead of duplicating them locally, per the RAM-budget discussion (Authelia+Redis and a second CrowdSec LAPI+DB add up). crowdsec.sh: new step lets this agent register against a remote LAPI (cscli lapi register -u <url>) and disables its own local API server by removing the api.server block from config.yaml (backed up first; verified the exact block boundaries against CrowdSec's actual default config.yaml from upstream before writing the awk removal). Parsers, scenarios, and the firewall bouncer still run locally regardless — only banning decisions centralize, and only after the registration is approved with `cscli machines validate` on the central machine, which this script can't do since that's a different box. The final restart step is skipped with an explanation when registration is pending, instead of showing a misleading "failed to restart" for an expected state. asterisk-do.sh: when no local Authelia is installed, the web-admin Caddy step now offers a remote Authelia option instead, building the same forward_auth block inline (authelia.sh's shared Caddy snippet only exists for local installs) targeting either a bare host:port (e.g. a NetBird mesh IP) or a full https:// URL. Documents that this couples web-admin availability to the remote instance's reachability, while SIP/calling on the droplet stays unaffected either way. Both changes verified: the config.yaml block-removal awk logic tested against CrowdSec's real upstream default file structure, the remote Authelia forward_auth block construction tested in isolation, and full regression runs confirm the default (declined) path through both new prompts is unchanged.
This commit is contained in:
Claude
+36
-3
@@ -214,6 +214,7 @@ install_asterisk-do() {
|
||||
echo "[DRY-RUN] Would open 51820/udp (not 51821) if wg-easy was selected"
|
||||
echo "[DRY-RUN] Would offer to create a DigitalOcean Cloud Firewall via doctl"
|
||||
echo "[DRY-RUN] Would reverse-proxy the web admin on the SAME FQDN used for SIP (needed for cert sync)"
|
||||
echo "[DRY-RUN] Would offer local OR remote Authelia to protect the web admin"
|
||||
echo "[DRY-RUN] Would offer to install CrowdSec if not already present (full repo only)"
|
||||
return 0
|
||||
fi
|
||||
@@ -580,6 +581,31 @@ ENV
|
||||
# Disable built-in auth since Authelia handles it
|
||||
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
|
||||
fi
|
||||
else
|
||||
# No local Authelia — offer one running elsewhere (e.g. a homelab).
|
||||
# There's no shared "(authelia)" Caddy snippet to import in that
|
||||
# case (authelia.sh only writes one when installing locally), so
|
||||
# this builds the same forward_auth block inline, targeting the
|
||||
# remote instance directly instead of the local "authelia:9091"
|
||||
# container reference.
|
||||
local _use_remote_auth=""
|
||||
prompt_yn "Protect the web admin with a remote Authelia instance (e.g. on a homelab)? (y/n):" "n" _use_remote_auth
|
||||
if [[ "$_use_remote_auth" =~ ^[Yy]$ ]]; then
|
||||
local _remote_authelia=""
|
||||
prompt_text " Remote Authelia address — a bare host:port over a private network (e.g. a NetBird mesh IP:9091), or a full https:// URL if it's on its own public domain+TLS:" "" _remote_authelia
|
||||
if [[ -n "$_remote_authelia" ]]; then
|
||||
EXTRA_BLOCK=" forward_auth ${_remote_authelia} {
|
||||
uri /api/authz/forward-auth
|
||||
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
|
||||
}"
|
||||
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
|
||||
log_info "Using remote Authelia at ${_remote_authelia}."
|
||||
log_info "Verify it's reachable from this droplet before relying on it — e.g.:"
|
||||
log_info " curl -I ${_remote_authelia}"
|
||||
else
|
||||
log_info "No address entered — skipping Authelia protection."
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Reconstruct the subdomain-only fragment so configure_caddy_for_service's
|
||||
@@ -740,9 +766,16 @@ plan for the admin panel.
|
||||
Offered during install (space-separated at the "Install:" prompt); can also
|
||||
be added later by running \`sudo ./setup.sh <name>\` from the repo.
|
||||
|
||||
- **authelia** — SSO/2FA in front of the web admin. Needs Caddy. Once
|
||||
installed, re-running \`asterisk-do\` will offer to protect the web admin
|
||||
with it.
|
||||
- **authelia** — SSO/2FA in front of the web admin. Needs Caddy locally to
|
||||
install here. If it's already installed (locally or picked up by
|
||||
re-running \`asterisk-do\`), that instance protects the web admin
|
||||
automatically. **No local Authelia?** The web-admin step separately offers
|
||||
a **remote Authelia** option instead — point it at an instance already
|
||||
running elsewhere (e.g. a homelab) via a bare \`host:port\` over a private
|
||||
network (a NetBird mesh IP works well here) or a full \`https://\` URL if
|
||||
it has its own public domain+TLS. Every web-admin page load then does a
|
||||
round trip to that address, so if it's unreachable, the panel fails closed
|
||||
— SIP/calling on this droplet is unaffected either way, only the admin UI.
|
||||
- **ntfy** — self-hosted push notifications. Useful as a destination for
|
||||
CrowdSec ban alerts (\`services/crowdsec.sh\` prompts for an ntfy URL —
|
||||
point it at this instance instead of the public ntfy.sh if you'd rather
|
||||
|
||||
+88
-13
@@ -104,6 +104,7 @@ install_crowdsec() {
|
||||
echo "[DRY-RUN] Would write Caddy acquisition /etc/crowdsec/acquis.d/caddy.yaml"
|
||||
echo "[DRY-RUN] Would install crowdsecurity/asterisk + write an acquisition if asterisk-do is installed"
|
||||
echo "[DRY-RUN] Would optionally wire ntfy ban alerts into the default profile"
|
||||
echo "[DRY-RUN] Would optionally register with a remote/central LAPI and disable the local one"
|
||||
echo "[DRY-RUN] Would enable + restart crowdsec and crowdsec-firewall-bouncer"
|
||||
echo "[DRY-RUN] Would write $DOCS_DIR/README.md (docs-only folder)"
|
||||
return 0
|
||||
@@ -235,20 +236,79 @@ headers:
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── 8. Restart services to apply ─────────────────────────────────────────
|
||||
local RESTART_CS=""
|
||||
prompt_yn "Restart CrowdSec to apply changes? (y/n):" "y" RESTART_CS
|
||||
if [ "$RESTART_CS" = "y" ] || [ "$RESTART_CS" = "Y" ]; then
|
||||
sudo systemctl enable crowdsec 2>/dev/null || true
|
||||
if sudo systemctl restart crowdsec; then
|
||||
echo " ✓ CrowdSec restarted successfully"
|
||||
sudo systemctl enable crowdsec-firewall-bouncer 2>/dev/null || true
|
||||
sudo systemctl restart crowdsec-firewall-bouncer 2>/dev/null || true
|
||||
sleep 2
|
||||
sudo cscli metrics 2>/dev/null | head -20 || true
|
||||
# ── 7b. Optional: point this agent at a remote/central LAPI ──────────────
|
||||
# CrowdSec's real multi-server support: parsers/scenarios/bouncer still
|
||||
# run locally (banning only works where traffic actually arrives), but
|
||||
# the decision database (LAPI) can live on one central machine instead
|
||||
# of every box running its own. Useful if you already have CrowdSec on
|
||||
# a homelab and don't want a second LAPI+SQLite DB on this droplet.
|
||||
echo ""
|
||||
local USE_REMOTE_LAPI="" _REMOTE_LAPI_PENDING=""
|
||||
prompt_yn "Point this agent at a remote/central LAPI instead of running its own (e.g. one already on a homelab)? (y/n):" "n" USE_REMOTE_LAPI
|
||||
if [ "$USE_REMOTE_LAPI" = "y" ] || [ "$USE_REMOTE_LAPI" = "Y" ]; then
|
||||
echo ""
|
||||
echo " This registers this machine and disables its local API server."
|
||||
echo " The registration is PENDING until approved on the central LAPI"
|
||||
echo " machine — that approval step can't be automated from here."
|
||||
echo ""
|
||||
local LAPI_URL="" LAPI_MACHINE=""
|
||||
prompt_text " Central LAPI URL (e.g. http://homelab-ip:8080):" "" LAPI_URL
|
||||
prompt_text " Machine name to register as:" "$(hostname)" LAPI_MACHINE
|
||||
if [ -n "$LAPI_URL" ]; then
|
||||
if sudo cscli lapi register -u "$LAPI_URL" --machine "$LAPI_MACHINE"; then
|
||||
echo " ✓ Registered with $LAPI_URL as '$LAPI_MACHINE'"
|
||||
|
||||
# Disable the local API server (remove the 'api.server:' block
|
||||
# from config.yaml) now that this agent forwards to the
|
||||
# central one instead. Backed up first — this is a direct
|
||||
# edit to CrowdSec's core config.
|
||||
local CS_CONFIG="/etc/crowdsec/config.yaml"
|
||||
local CS_BACKUP="$CS_CONFIG.backup.$(date +%Y%m%d-%H%M%S)"
|
||||
sudo cp "$CS_CONFIG" "$CS_BACKUP"
|
||||
sudo awk '
|
||||
/^ server:/ { skip=1; next }
|
||||
skip && /^([a-zA-Z]| [a-zA-Z])/ { skip=0 }
|
||||
!skip { print }
|
||||
' "$CS_CONFIG" | sudo tee "$CS_CONFIG.new" > /dev/null \
|
||||
&& sudo mv "$CS_CONFIG.new" "$CS_CONFIG"
|
||||
echo " ✓ Local API server disabled in config.yaml (backup: $(basename "$CS_BACKUP"))"
|
||||
echo ""
|
||||
echo " ⚠ Not usable yet — on the CENTRAL LAPI machine, run:"
|
||||
echo " sudo cscli machines validate $LAPI_MACHINE"
|
||||
echo " Then restart this agent: sudo systemctl restart crowdsec"
|
||||
echo " If it fails to start afterward, restore the backup and check logs:"
|
||||
echo " sudo cp $CS_BACKUP $CS_CONFIG && sudo systemctl restart crowdsec"
|
||||
_REMOTE_LAPI_PENDING="y"
|
||||
else
|
||||
echo " ⚠ cscli lapi register failed — keeping the local LAPI. See:"
|
||||
echo " sudo cscli lapi register -u $LAPI_URL --machine $LAPI_MACHINE"
|
||||
fi
|
||||
else
|
||||
echo " ⚠ Failed to restart CrowdSec"
|
||||
echo " Check logs: sudo journalctl -u crowdsec -n 50"
|
||||
echo " No URL entered — keeping the local LAPI."
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── 8. Restart services to apply ─────────────────────────────────────────
|
||||
if [ "$_REMOTE_LAPI_PENDING" = "y" ]; then
|
||||
echo ""
|
||||
echo " Skipping the restart below — it would fail until the machine is"
|
||||
echo " validated on the central LAPI (see above). Restart manually after:"
|
||||
echo " sudo systemctl restart crowdsec"
|
||||
else
|
||||
local RESTART_CS=""
|
||||
prompt_yn "Restart CrowdSec to apply changes? (y/n):" "y" RESTART_CS
|
||||
if [ "$RESTART_CS" = "y" ] || [ "$RESTART_CS" = "Y" ]; then
|
||||
sudo systemctl enable crowdsec 2>/dev/null || true
|
||||
if sudo systemctl restart crowdsec; then
|
||||
echo " ✓ CrowdSec restarted successfully"
|
||||
sudo systemctl enable crowdsec-firewall-bouncer 2>/dev/null || true
|
||||
sudo systemctl restart crowdsec-firewall-bouncer 2>/dev/null || true
|
||||
sleep 2
|
||||
sudo cscli metrics 2>/dev/null | head -20 || true
|
||||
else
|
||||
echo " ⚠ Failed to restart CrowdSec"
|
||||
echo " Check logs: sudo journalctl -u crowdsec -n 50"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
@@ -292,6 +352,21 @@ sudo cscli collections list # installed detection collections
|
||||
- ntfy ban alerts (if enabled): `/etc/crowdsec/notifications/ntfy.yaml`,
|
||||
wired into `/etc/crowdsec/profiles.yaml`
|
||||
- Bouncer config: `/etc/crowdsec/bouncers/`
|
||||
- Remote/central LAPI (if enabled): `/etc/crowdsec/local_api_credentials.yaml`
|
||||
points at the remote URL; the local API server block is removed from
|
||||
`/etc/crowdsec/config.yaml` (backed up as `config.yaml.backup.<timestamp>`
|
||||
next to it before editing). Parsers, scenarios, and the firewall bouncer
|
||||
still run locally regardless — only the decision database is centralized.
|
||||
|
||||
## Multi-server (remote LAPI) notes
|
||||
|
||||
- On THIS machine: `sudo cscli lapi register -u <url> --machine <name>`
|
||||
registers and disables the local API server.
|
||||
- On the CENTRAL machine: `sudo cscli machines validate <name>` approves it —
|
||||
not automated, since that's a different box.
|
||||
- Check registration status here: `sudo cscli lapi status`
|
||||
- Revert: restore the `config.yaml` backup and
|
||||
`sudo systemctl restart crowdsec`.
|
||||
|
||||
## Geo + reputation notes
|
||||
|
||||
|
||||
Reference in New Issue
Block a user