updated crowdsec config

core/crowdsec/Dockerfile

@@ -1,6 +1,6 @@
 FROM crowdsecurity/crowdsec:latest
 
-COPY config/ /etc/crowdsec
+#COPY config/ /etc/crowdsec
 # Install required components at build time
-RUN cscli hub update && \
+#RUN cscli hub update && \
-    cscli collections install crowdsecurity/traefik --force 
+#    cscli collections install crowdsecurity/traefik --force 

core/crowdsec/docker-compose.yml

@@ -1,8 +1,8 @@
 services:
   crowdsec:
     profiles: ["core","all","crowdsec", "traefik"]
-#    image: crowdsecurity/crowdsec:latest
+    image: crowdsecurity/crowdsec:latest
-    build: ${PROJECT_ROOT}/core/crowdsec
+#    build: ${PROJECT_ROOT}/core/crowdsec
     container_name: crowdsec
     restart: always
     environment:
@@ -14,7 +14,10 @@ services:
 #      - ${PROJECT_ROOT}/core/crowdsec/config:/etc/crowdsec
       - ${DOCKER_VOLUMES}/crowdsec/logs:/logs:ro
       - ${DOCKER_VOLUMES}/crowdsec/data:/var/lib/crowdsec/data
-      - ${DOCKER_VOLUMES}/crowdsec/config:/etc/crowdsec
+#      - ${DOCKER_VOLUMES}/crowdsec/config.yaml:/etc/crowdsec/config.yaml
+#      - ${DOCKER_VOLUMES}/crowdsec/config:/etc/crowdsec
+      - ${PROJECT_ROOT}/core/crowdsec/acquis.d:/etc/crowdsec/acquis.d
+      - ${PROJECT_ROOT}/core/crowdsec/profiles.yaml:/etc/crowdsec/profiles.yaml
     networks:
 #      - reverse_proxy
       - traefik

core/crowdsec/profiles.yaml

@@ -0,0 +1,29 @@
+name: default_ip_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Ip"
+decisions:
+ - type: ban
+   duration: 4h
+#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break
+---
+name: default_range_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Range"
+decisions:
+ - type: ban
+   duration: 4h
+#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break