docker local_api_credentials.yaml being re-created at startup

[Kornelius777]

What happened?

My machines run crowdsec in a multi-server setup.

Now, for the first time, I wanted to try a docker deployment.

The relevant part of my docker-compose.yml looks like:

  crowdsec:
    image: crowdsecurity/crowdsec
    hostname: crowdsec
    container_name: crowdsec
    environment: 
      COLLECTIONS: "crowdsecurity/nginx"
    depends_on:
      - nginx
    volumes:
      - /docker/crowdsec:/etc/crowdsec
      - /docker/logs-nginx:/var/log/nginx:ro
      - crowdsec-db:/var/lib/crowdsec/data/
      - /var/log/auth.log:/var/log/auth.log:ro
      - /var/log/syslog:/var/log/syslog.log:ro

After a first start, I issued
cscli lapi register --machine WHATEVER --url http://10.10.10.10:8080

and on the LAPI:
cscli machines validate WHATEVER

Afterwards, /etc/crowdsec/local_api_credentials.yaml was pointing to the correct LAPI and the LAPI showed the new machine being online.

After a docker compose down && docker compose up -d, local_api_credentials.yaml was re-created from scratch with default values.

Well... This way, no multi-server setup is possible.

Please change this behaviour so that local_api_credentials.yaml will be preserved.

What did you expect to happen?

Preserve local_api_credentials.yaml

How can we reproduce it (as minimally and precisely as possible)?

see above

Anything else we need to know?

No response

Crowdsec version

docker crowdsecurity/crowdsec:latest

OS version

No response

Enabled collections and parsers

No response

Acquisition config

No response

Config show

No response

Prometheus metrics

No response

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

No response

[github-actions]

@Kornelius777: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[Kornelius777]

answering myself:

My bad!

After amending my docker-compose.yml to

  crowdsec:
    image: crowdsecurity/crowdsec
    hostname: crowdsec
    container_name: crowdsec
    environment: 
      COLLECTIONS: "crowdsecurity/nginx"
      DISABLE_LOCAL_API: true
      AGENT_USERNAME: "WHATEVER"
      AGENT_PASSWORD: "WHATEVER"
      LOCAL_API_URL: "http://10.10.10.10:8080"
    depends_on:
      - nginx
    volumes:
      - /docker/crowdsec:/etc/crowdsec
      - /docker/logs-nginx:/var/log/nginx:ro
      - crowdsec-db:/var/lib/crowdsec/data/
      - /var/log/auth.log:/var/log/auth.log:ro
      - /var/log/syslog:/var/log/syslog.log:ro

everything works as expected.

Please close!

[LaurenceJJones]

You beat me to it, yes when using an external LAPI you must define these 2 environments at least:

      DISABLE_LOCAL_API: true
      LOCAL_API_URL: "http://10.10.10.10:8080"

The others are not needed directly needed unless you are using secrets or something but you can hardcode it if you want to ensure they never change.