install crowdsec on unraid

[psychedelicu]

Hi,

How can i install crowdsec on unraid? I have tried to use these volumes, but it's not working.
i use docker compose plugin for unraid. In step 4 in the guide say "make sure to use network_mode: host". What container should be on host mode exactly?

services:
crowdsec:
container_name: crowdsec
image: crowdsecurity/crowdsec
restart: always
network_mode: host
ports:
- "127.0.0.1:7422:7422"
- "127.0.0.1:8090:8090"
environment:
- "TZ=Europe/Bucharest"
- "COLLECTIONS=ZoeyVid/npmplus crowdsecurity/appsec-virtual-patching"
volumes:
- "/mnt/cache/appdata/crowdsec/config:/etc/crowdsec" # Configuration files
- "/mnt/cache/appdata/crowdsec/data:/var/lib/crowdsec/data" # Data files
- "/mnt/cache/appdata/npmplus/data/nginx:/opt/npm/nginx:ro" # Nginx logs for analysis
- "/var/run/docker.sock:/var/run/docker.sock:ro"

I get these erros:
time="2024-03-02T19:10:44+02:00" level=info msg="loading acquisition file : /etc/crowdsec/acquis.yaml"
time="2024-03-02T19:10:44+02:00" level=warning msg="No matching files for pattern /var/log/nginx/.log" type=file
time="2024-03-02T19:10:44+02:00" level=warning msg="No matching files for pattern ./tests/nginx/nginx.log" type=file
time="2024-03-02T19:10:44+02:00" level=warning msg="No matching files for pattern /var/log/auth.log" type=file
time="2024-03-02T19:10:44+02:00" level=warning msg="No matching files for pattern /var/log/syslog" type=file
time="2024-03-02T19:10:44+02:00" level=warning msg="No matching files for pattern /var/log/apache2/.log" type=file
time="2024-03-02T19:10:44+02:00" level=info msg="loading acquisition file : /etc/crowdsec/acquis.d/appsec.yaml"

[Zoey2936]

What container should be on host mode exactly?

NPMplus

I get these erros:

you can ignore them or you can empty the file at /mnt/cache/appdata/crowdsec/config/acquis.yaml

[psychedelicu]

I just can't get it working.

NPM PLUS default unraid paths are:
Container Path: /data
Host Path: /mnt/cache/appdata/npmplus/data/

Container Path: /var/www
Host Path: /mnt/cache/appdata/npmplus/www

I'm new to unraid and docker, maybe that's why. What volume paths should i use for docker compose?

As i said above, i used these, but i'm not sure if the paths are good.
volumes:

• "/mnt/cache/appdata/crowdsec/config:/etc/crowdsec" # Configuration files
• "/mnt/cache/appdata/crowdsec/data:/var/lib/crowdsec/data" # Data files
• "/mnt/cache/appdata/npmplus/data/nginx:/opt/npm/nginx:ro" # Nginx logs for analysis
• "/var/run/docker.sock:/var/run/docker.sock:ro"

[Zoey2936]

what exactly does not work? please provide all your compose files again and complete

[psychedelicu]

Also, in NPMPlus logs i get there errors:

nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
[SETTING UP STORAGE /data/nginx/access.log] {0} @ {0/s}
[SETTING UP STORAGE /data/nginx/access.log] {0} @ {0/s}
GoAccess - version 1.8.1 - Nov 2 2023 19:51:14
Config file: No config file used
Fatal error has occurred
Error occurred at: src/parser.c - read_log - 2150
Unable to open the specified log file '/data/nginx/access.log'. No such file or directory
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [warn] "ssl_stapling" ignored, issuer certificate not found for certificate "/data/tls/dummycert.pem"
nginx: [error] invalid PID number "" in "/usr/local/nginx/logs/nginx.pid"
error: error running shared postrotate script for '/data/nginx/*.log '

[Zoey2936]

most are warnings, they should vanish if you set

NPMplus/compose.yaml

Line 31 in 9d53762

# - "DEFAULT_CERT_ID=1" # ID of cert, which should be used instead of dummycerts, default 0/unset/dummycerts

there are two errors which will be fixed in the next release

[Zoey2936]

does crowdsec work now?

[psychedelicu]

yes, it was an issue with crowdsec on unraid, after server restart, the ip was changing everytime. But i added a custom network with a fixed IP. It's workingnow, but it is safe to use it like this?

[Zoey2936]

Should be ok

[Zoey2936]

You could try to add the nextcloud cpllection to crowdsec and configure it

[psychedelicu]

I already did that. The collection folder is empty though. This is how it should be?

[Zoey2936]

Should work

[Nihimia]

Hi,

About this error :

nginx: [error] invalid PID number "" in "/usr/local/nginx/logs/nginx.pid"
error: error running shared postrotate script for '/data/nginx/*.log '

I've seen your modification, thank you ! But a ; is missing :

if [ -f /usr/local/nginx/logs/nginx.pid ]; then nginx -s reload fi
if [ -f /usr/local/nginx/logs/nginx.pid ]; then nginx -s reload; fi

[Zoey2936]

will be fixed

[Nihimia]

wow that was fast, thank you ! 👍

[Zoey2936]

is now fixed

[psychedelicu]

After update, the webgui is not working anymore, neither websites.

nginx: [emerg] unknown directive "off" in /data/nginx/proxy_host/2.conf:60
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed
cp: not replacing '/usr/local/nginx/conf/conf.d/goaccess.conf'
cp: not replacing '/usr/local/nginx/conf/conf.d/goaccess-no-server-name.conf'
Working on file: /data/nginx/custom/server_stream_udp.conf
nginx: [emerg] unknown directive "off" in /data/nginx/proxy_host/2.conf:60
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

[psychedelicu]

I found the issue. Also, now i can remove the http3 off lines from the config. Thanks!

client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;
http3 off;
http3_hq off;
http2 off;
chunked_transfer_encoding off;
fastcgi_request_buffering off;
fastcgi_read_timeout 60s;

But now i get this error. Any idea how to fix it?

2024/03/04 10:35:34 [error] 1076#1076: *161 SSL_do_handshake() failed (SSL: error:0A0000EB:SSL routines::no application protocol) while handling frames, client: 192.168.1.103, server: 0.0.0.0:443

[Zoey2936]

Please remove all custom configs

[Zoey2936]

All customs confs you need to set in npm for using nc aio are already done in npmplus

[psychedelicu]

Done, but i want to add http2 off; to disable it, because my upload speed increases from 8mb to 12-16mb. But it seems if i restart unraid (not just npmplus), npmplus not starting due to an error on proxy config.

i have to remove this line. if i remove it, save file, in nginx proxy is still present, and it works disabling http2, but only after server restart it causing problems.

[Zoey2936]

you shouldn't disable http2, also http2 is not your slowing fact, instead try disabling proxy buffering

[psychedelicu]

I have enabled http2 again then, if you say. I've tried once more to disable proxy_buffering, but no luck! What can cause this? My domain in on cloudflare, no proxy enabled. If i turn on dns rewrite on adguard home, speed jumps to 30-40mb. Something is wrong on my setup.

[Zoey2936]

do you use vpns in your setup? do have multiple nats? etc?

[psychedelicu]

I have an omada RT605 router, Switch TL SG2008, And a tp-link ax 1500 in access point mode. The thing is before i bought the RT605 router, ax 1500 was my main router and i didn't had this issue with nextcloud.

I don't use vpns.
My nextcloud aio is the stack from unraid apps.

I'm not sure how this should look tough: