services:
  crowdsec:
    image: crowdsecurity/crowdsec:slim
    networks:
      - crowdsec-internal
    environment:
      DOCKER_HOST: tcp://tasks.socket-proxy:2375
      COLLECTIONS: "crowdsecurity/traefik"
      CUSTOM_CS_LAPI_KEY: ${CROWDSEC_LAPI_KEY:?Variable not set}
      # Optional CrowdSec Console enrollment (https://app.crowdsec.net)
      ENROLL_KEY: ${CROWDSEC_ENROLL_KEY:-}
      ENROLL_INSTANCE_NAME: ${CROWDSEC_ENROLL_INSTANCE_NAME:-}
      ENROLL_TAGS: ${CROWDSEC_ENROLL_TAGS:-}
    deploy:
      restart_policy:
        condition: any
    volumes:
      - /var/data/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
      - crowdsec-db:/var/lib/crowdsec/data/
      - crowdsec-config:/etc/crowdsec/

  traefik-bouncer:
    image: fbonalair/traefik-crowdsec-bouncer:latest
    environment:
      CROWDSEC_AGENT_HOST: tasks.crowdsec:8080
      CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_BOUNCER_KEY:?Variable not set}
    expose:
      - "8080"
    networks:
      - crowdsec-internal
      - traefik-public
    deploy:
      restart_policy:
        condition: any

  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    networks:
      - crowdsec-internal
    environment:
      INFO: 1
      PING: 1
      VERSION: 1
      CONTAINERS: 1
      EVENTS: 1
      POST: 0
      BUILD: 0
      COMMIT: 0
      CONFIGS: 0
      DISTRIBUTION: 0
      EXEC: 0
      GRPC: 0
      IMAGES: 0
      NETWORKS: 0
      NODES: 0
      PLUGINS: 0
      SERVICES: 0
      SESSION: 0
      SWARM: 1
      SYSTEM: 0
      TASKS: 0
      VOLUMES: 0
    deploy:
      restart_policy:
        condition: any
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
    tmpfs:
      - /run

volumes:
  crowdsec-db:
  crowdsec-config:

networks:
  crowdsec-internal:
    driver: overlay
    attachable: true
  traefik-public:
    external: true