WIP

defaults/main.yml

@@ -0,0 +1,19 @@
+---
+crowdsec_server:
+  enabled: true
+  listen_uri: 127.0.0.1:8080
+crowdsec_prometheus:
+  enabled: true
+crowdsec_lapi_url: http://127.0.0.1:8080/
+crowdsec_bouncer:
+  enabled: true
+crowdsec_whitelist:
+  enabled: false
+  ip:
+    - "1.1.1.1"
+    - "1.1.1.2"
+  cidr:
+    - "2.2.2.2/24"
+
+# Distributed environment
+crowdsec_delegate_server_hostname: "{{ inventory_hostname }}"

handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: restart crowdsec
+  systemd:
+    name: crowdsec
+    state: restarted
+
+- name: restart crowdsec-firewall-bouncer
+  systemd:
+    name: crowdsec-firewall-bouncer
+    state: restarted

tasks/add_bouncer.yml

@@ -0,0 +1,37 @@
+---
+- name: Install bouncer (currently only firewall)
+  ansible.builtin.apt:
+    name:
+      - crowdsec-firewall-bouncer
+      - crowdsec-firewall-bouncer-iptables
+  when:
+    - ansible_os_family == "Debian"
+
+- name: Install crowdsec
+  ansible.builtin.dnf:
+    name:
+      - crowdsec-firewall-bouncer-nftables
+    state: present
+  when:
+    - ansible_os_family == "RedHat"
+
+#- name: Register new bouncer
+#  command: cscli bouncers add {{ inventory_hostname }} -o raw
+#  register: _csbouncer
+#  delegate_to: "{{ crowdsec_delegate_server_hostname }}"
+#  changed_when: _csbouncer.stderr is not search("already exists")
+#
+#- name: Deploy bouncer config
+#  lineinfile:
+#    regex: "{{ item.regex }}"
+#    line: "{{ item.line }}"
+#    dest: /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
+#  with_items:
+#    - regex: "^api_url"
+#      line: "api_url: {{ crowdsec_lapi_url }}"
+#    - regex: "^api_key"
+#      line: "api_key: {{ _csbouncer.stdout }}"
+#  when: _csbouncer.changed
+#  notify: restart crowdsec-firewall-bouncer
+#  loop_control:
+#    label: "{{ item.regex }}"

tasks/main.yml

@@ -20,7 +20,7 @@
         state: present
 
     - name: add crowdsec repository
-      aansible.builtin.pt_repository:
+      ansible.builtin.apt_repository:
         repo: 'deb https://packagecloud.io/crowdsec/crowdsec/{{ ansible_distribution|lower }}/ {{ ansible_distribution_release|lower }} main'
         state: present
         update_cache: yes
@@ -63,5 +63,37 @@
       state: present
       update_cache: yes
 
+  - name: Deploy main config
+    template:
+      src: etc/crowdsec/config.yaml.j2
+      dest: /etc/crowdsec/config.yaml
+      owner: root
+      group: root
+      mode: 0644
+    notify: restart crowdsec
+
+  - name: Deploy whitelist
+    template:
+      src: etc/crowdsec/parsers/s02-enrich/mywhitelist.yaml.j2
+      dest: /etc/crowdsec/parsers/s02-enrich/mywhitelist.yaml
+      owner: root
+      group: root
+      mode: 0644
+    when: crowdsec_whitelist.enabled
+    notify: restart crowdsec
+
+  - name: Flush handlers to apply config
+    meta: flush_handlers
+
+#  - name: Register agent(s)
+#    include_tasks: register_agent.yml
+#    when:
+#      - crowdsec_delegate_server_hostname != inventory_hostname
+#
+  - name: Register distributed bouncers(s)
+    include_tasks: add_bouncer.yml
+    when:
+      - crowdsec_bouncer.enabled
+
   tags:
     - crowdsec

tasks/register_agent.yml

@@ -0,0 +1,18 @@
+---
+- name: Check if agent is already registered
+  shell: cscli machines list -o raw | grep {{ inventory_hostname }} | grep true || echo "Not found"
+  register: _csmachines
+  delegate_to: "{{ crowdsec_delegate_server_hostname }}"
+  changed_when: false
+
+- block:
+    - name: Register agent to server
+      command: cscli lapi register -u {{ crowdsec_lapi_url }} --machine {{ inventory_hostname }}
+      notify: restart crowdsec
+
+    - name: Validate agent on server
+      command: cscli machines validate {{ inventory_hostname }}
+      delegate_to: "{{ crowdsec_delegate_server_hostname }}"
+  when:
+    - _csmachines.rc == 0
+    - _csmachines.stdout is search("Not found")

templates/etc/crowdsec/config.yaml.j2

@@ -0,0 +1,56 @@
+common:
+  daemonize: true
+  pid_dir: /var/run/
+  log_media: file
+  log_level: info
+  log_dir: /var/log/
+  working_dir: .
+config_paths:
+  config_dir: /etc/crowdsec/
+  data_dir: /var/lib/crowdsec/data/
+  simulation_path: /etc/crowdsec/simulation.yaml
+  hub_dir: /etc/crowdsec/hub/
+  index_path: /etc/crowdsec/hub/.index.json
+  notification_dir: /etc/crowdsec/notifications/
+  plugin_dir: /usr/lib64/crowdsec/plugins/
+crowdsec_service:
+  acquisition_path: /etc/crowdsec/acquis.yaml
+  parser_routines: 1
+cscli:
+  output: human
+db_config:
+  log_level: info
+  type: sqlite
+  db_path: /var/lib/crowdsec/data/crowdsec.db
+  #user: 
+  #password:
+  #db_name:
+  #host:
+  #port:
+  flush:
+    max_items: 5000
+    max_age: 7d
+plugin_config:
+  user: nobody # plugin process would be ran on behalf of this user
+  group: nobody # plugin process would be ran on behalf of this group
+api:
+  client:
+    insecure_skip_verify: false
+    credentials_path: /etc/crowdsec/local_api_credentials.yaml
+{% if crowdsec_server.enabled %}
+  server:
+    log_level: info
+    listen_uri: {{ crowdsec_server.listen_uri }}
+    profiles_path: /etc/crowdsec/profiles.yaml
+    console_path: /etc/crowdsec/console.yaml
+    online_client: # Central API credentials (to push signals and receive bad IPs)
+      credentials_path: /etc/crowdsec/online_api_credentials.yaml
+#    tls:
+#      cert_file: /etc/crowdsec/ssl/cert.pem
+#      key_file: /etc/crowdsec/ssl/key.pem
+{% endif %}
+prometheus:
+  enabled: {{ crowdsec_prometheus.enabled }}
+  level: full
+  listen_addr: 127.0.0.1
+  listen_port: 6060

templates/etc/crowdsec/parsers/s02-enrich/mywhitelist.yaml.j2

@@ -0,0 +1,7 @@
+---
+name: crowdsecurity/mywhitelists
+description: "Whitelist events from my ip addresses"
+whitelist:
+  reason: "my ip ranges"
+  ip: {{ crowdsec_whitelist.ip|to_yaml }}
+  cidr: {{ crowdsec_whitelist.cidr|to_yaml }}