services:
  crowdsec:
    container_name: crowdsec
    image: crowdsecurity/crowdsec:latest
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
      GID: "${GID-1000}"
#      COLLECTIONS: "crowdsecurity/traefik LePresidente/authelia"
    volumes:
      - ./config/acquis.yml:/etc/crowdsec/acquis.yaml
      - ./crowdsec-db:/var/lib/crowdsec/data/
      - ./crowdsec-config:/etc/crowdsec/
    networks:
      - back_network_crowdsec
      - back_network_diun
      - back_network_homepage
      - back_network_socket_proxy
    depends_on:
      - socket-proxy
    labels:
      - "diun.enable=true"
      - "homepage.group=Security"
      - "homepage.name=CrowdSec"
      - "homepage.icon=crowdsec.png"
      - "homepage.href=https://www.crowdsec.net/"
      - "homepage.description=Traffic monitoring"
      - "homepage.widget.type=crowdsec"
      - "homepage.widget.url=http://crowdsec:8080"
      - "homepage.widget.username=${CROWDSEC_API_USERNAME}"
      - "homepage.widget.password=${CROWDSEC_API_PASSWORD}"
    healthcheck:
      test: ["CMD", "cscli", "version"]
    security_opt:
      - no-new-privileges:true

  bouncer-traefik:
    container_name: bouncer-traefik
    image: docker.io/fbonalair/traefik-crowdsec-bouncer:latest
    restart: unless-stopped
    environment:
      CROWDSEC_BOUNCER_API_KEY: "${CROWDSEC_BOUNCER_API_KEY}"
      CROWDSEC_AGENT_HOST: crowdsec:8080
    networks:
      - back_network_crowdsec
      - back_network_diun
      - back_network_traefik
    depends_on:
      - crowdsec
    labels:
      - "diun.enable=true"
    security_opt:
      - no-new-privileges:true