docker-compose.yml

services:
  crowdsec:
    image: crowdsec-firewalla:latest
    container_name: crowdsec
    # host networking so the bouncer can write iptables/ipset on the
    # Firewalla's netns (bridge networking would confine it to the
    # container's own netns, which has no filter table the host sees).
    network_mode: host
    cap_add:
      - NET_ADMIN    # iptables + ipset
      - NET_RAW      # some packet helpers
    restart: always
    volumes:
      # State: decisions DB, cscli machine id, bouncer api_key.
      # Persisting these across container restarts means no re-enroll
      # with CAPI and no duplicate bouncer registrations every reboot.
      - /data/crowdsec/db:/var/lib/crowdsec/data
      - /data/crowdsec/config:/etc/crowdsec

      # Host root read-only — log sources live here.
      # See acquis.d/firewalla.yaml for exactly which files we read.
      - /:/host:ro
    environment:
      # Collections installed on first boot; idempotent thereafter.
      # Add more from https://hub.crowdsec.net/ by appending here.
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/sshd crowdsecurity/iptables

      # CAPI (community blocklist + signal push). Required for the free
      # ~200-300k IP community feed. Set to "true" to run fully offline
      # using only local log-derived decisions.
      - DISABLE_ONLINE_API=false

      # Optional: CrowdSec Console enrollment key. Gives you a web UI at
      # app.crowdsec.net. Grab from the console after signup. Leave
      # empty to skip.
      - ENROLL_KEY=

      # Optional: where HTTP notifications post to. Fill in to get
      # push alerts when a decision fires (e.g. an ntfy.sh topic URL).
      # See notifications/http.yaml.
      - CROWDSEC_WEBHOOK_URL=

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"