26e98698d8
Phase 2 and 4 of docs/roadmap/storage-locations.md. Apps can now be placed on a location and moved between them. CFG_<APP>_STORAGE lands in all 37 app templates, holding a location NAME rather than a path: names survive a migrate to a host with different disks, paths do not. The 11 infrastructure apps that other apps reach by literal path (traefik, prometheus, grafana, adguard, gluetun, crowdsec, headscale, dashy, pihole, unbound, wireguard) are pinned. libreportal itself never gets the key — it is pinned structurally by webuiDir. Pinning needed no second config key. "Pinned" is not a fact about a value, it is a statement about whether the field may be edited, so it goes in the comment beside **ADVANCED** and **DEV** as **READONLY**, and the field factory renders those disabled. That marker earns its keep beyond this feature: derived fields already warned in prose that editing them does nothing (crowdsec.config:72) next to a perfectly editable input. storage_app_config.sh keeps the comment honest — it carries the resolved path for hand-recovery and regenerates the dropdown from the registry, but only writes when something actually changed, since the app .config is user-editable and lives in the container-owned tree. app move stops the app (a live copy of a running Postgres is a corrupt copy), snapshots it, copies, verifies, and only then removes the source. The copy runs in libreportal-ownership because it must: app data holds rootless sub-UID files the manager can neither read nor recreate. Verified against two real ext4 filesystems that a cross-device move preserves uid 231141 and the payload, and that the source survives every refusal path — unregistered destination, the WebUI app, a traversal in the app name, and an occupied destination. Task titles registered in both tables, with a specific rule so a move renders as "Nextcloud - Move to bigdisk" rather than the generic fallback dropping the destination. lp-task-names could not be run to confirm — it borrows the WebUI container's node and no containers are running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
78 lines
4.3 KiB
Plaintext
78 lines
4.3 KiB
Plaintext
#
|
|
# =============================================================================
|
|
# GENERAL CONFIGURATION
|
|
# =============================================================================
|
|
# APP_NAME = name of application for use in scripts
|
|
# HOST_INSTALL = true means apt + systemd install on the host, not Docker
|
|
# HOST_PACKAGE = dpkg package name; drives the "installed" badge
|
|
# HOST_SERVICES = all units; feeds the Services + Logs tabs
|
|
# HOST_LOG_FILES = <unit>|<path>,... mapping for the log viewer
|
|
# BACKUP = include in backup operations
|
|
# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
|
|
# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed; ships the official CrowdSec Grafana dashboards)
|
|
# PROMETHEUS_LISTEN = address CrowdSec's metrics endpoint binds to; must be reachable from the Prometheus container (default: all interfaces, port 6060 — keep the :6060 port)
|
|
#
|
|
CFG_CROWDSEC_APP_NAME=crowdsec
|
|
# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
|
|
# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
|
|
# apps whose compose identity (container_name, Traefik routers, backup labels)
|
|
# is instance-safe — see scripts/instance/instance_create.sh.
|
|
# Not instanced by design. CrowdSec ships no docker-compose.yml at all — it is a
|
|
# host-level security agent plus Traefik bouncer, not a composed app, so there is
|
|
# no service identity for `instance create` to clone. It is also a singleton by
|
|
# nature: one decision engine watching the whole box is the point.
|
|
CFG_CROWDSEC_MULTI_INSTANCE=false
|
|
CFG_CROWDSEC_HOST_INSTALL=true
|
|
CFG_CROWDSEC_HOST_PACKAGE=crowdsec
|
|
CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
|
|
CFG_CROWDSEC_HOST_LOG_FILES="crowdsec.service|/var/log/crowdsec.log,crowdsec-firewall-bouncer.service|/var/log/crowdsec-firewall-bouncer.log"
|
|
CFG_CROWDSEC_BACKUP=true
|
|
# STORAGE = which storage location holds this app's data.
|
|
CFG_CROWDSEC_STORAGE=default # Storage Location - Fixed: other apps reference crowdsec by path **READONLY**
|
|
CFG_CROWDSEC_BACKUP_STRATEGY=auto
|
|
CFG_CROWDSEC_UPDATE_TYPE=auto
|
|
CFG_CROWDSEC_MONITORING=false
|
|
CFG_CROWDSEC_PROMETHEUS_LISTEN=0.0.0.0:6060
|
|
#
|
|
# =============================================================================
|
|
# BEHAVIOUR
|
|
# =============================================================================
|
|
# ENABLED = master switch; false disables services (package stays)
|
|
# AUTO_UPDATE = pull hub parser/scenario updates from hub.crowdsec.net
|
|
# COMMUNITY_BLOCKLIST = subscribe to the free pooled blocklist (CAPI)
|
|
# CONSOLE_ENROLL = enroll this agent with the hosted SaaS at app.crowdsec.net (NOT the local dashboard)
|
|
# CONSOLE_TOKEN = enrollment token from app.crowdsec.net (only used when CONSOLE_ENROLL=true)
|
|
# BOUNCER = attach the Traefik bouncer middleware to every public route
|
|
#
|
|
CFG_CROWDSEC_ENABLED=true
|
|
CFG_CROWDSEC_COMMUNITY_BLOCKLIST=true
|
|
CFG_CROWDSEC_CONSOLE_ENROLL=false
|
|
CFG_CROWDSEC_CONSOLE_TOKEN=
|
|
CFG_CROWDSEC_BOUNCER=true
|
|
#
|
|
# =============================================================================
|
|
# METADATA
|
|
# =============================================================================
|
|
# CATEGORY = grouping in the app grid
|
|
# TITLE = display name
|
|
# DESCRIPTION = one-liner
|
|
# LONG_DESCRIPTION = card body text
|
|
# URL = source / docs link
|
|
# ACTIONS = available lifecycle verbs
|
|
#
|
|
CFG_CROWDSEC_CATEGORY="security,recommended"
|
|
CFG_CROWDSEC_TITLE="CrowdSec"
|
|
CFG_CROWDSEC_DESCRIPTION="Intrusion Prevention"
|
|
CFG_CROWDSEC_LONG_DESCRIPTION="An open-source intrusion prevention system: it spots brute-force, scans and web exploits in your logs and blocks the offending IPs at the firewall"
|
|
CFG_CROWDSEC_URL="https://www.crowdsec.net"
|
|
CFG_CROWDSEC_ACTIONS="configure|install|restart|shutdown|uninstall|tools"
|
|
#
|
|
# =============================================================================
|
|
# ADVANCED
|
|
# =============================================================================
|
|
# LAPI_HOST = LAPI bind address; 0.0.0.0 so Traefik can reach via host.docker.internal
|
|
# TRAEFIK_LAPI_KEY = auto-generated on install; use the "Rotate Traefik Bouncer Key" tool to replace it (editing this value does not re-register the bouncer)
|
|
#
|
|
CFG_CROWDSEC_LAPI_HOST=0.0.0.0:8080
|
|
CFG_CROWDSEC_TRAEFIK_LAPI_KEY=
|