|
| 1 | +# Example |
| 2 | + |
| 3 | +Read the example captcha before this, to better understand what is done here. |
| 4 | + |
| 5 | +### Traefik configuration |
| 6 | + |
| 7 | +The minimal configuration is defined below to implement custom captcha. |
| 8 | +This documentation use https://github.com/a-ve/wicketpeeker, a self-hosted captcha provider that have a similar API than big providers. |
| 9 | + |
| 10 | +Minimal API requirement: |
| 11 | + |
| 12 | +- the JS file URL to load the captcha on the served `captcha.html` |
| 13 | +- the HTML className to tell to the JS where to display the challenge |
| 14 | +- the verify URL endpoint to send the field `response` from the captcha with `content-type: application/x-www-form-urlencoded` |
| 15 | +- the name of the field when you POST the resolved captcha to Traefik |
| 16 | + |
| 17 | +- the JS file need to respect the `data-callback` on the div that contains the captcha if you use our template, but you can customize it by your side |
| 18 | + |
| 19 | +```yaml |
| 20 | + traefik: |
| 21 | + ... |
| 22 | + labels: |
| 23 | + # Choose captcha provider |
| 24 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaProvider=custom" |
| 25 | + # Define captcha grace period seconds |
| 26 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaGracePeriodSeconds=1800" |
| 27 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaCustomJsURL=http://captcha.localhost:8000/fast.js" |
| 28 | + # Inside Traefik container the plugin must be able to reach wicketkeeper service so we can go through a Traefik localhost |
| 29 | + # domain which would resolve traefik itself and the port for the dashboard |
| 30 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.CaptchaCustomValidateURL=http://wicketkeeper:8080/v0/siteverify" |
| 31 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.CaptchaCustomKey=wicketkeeper" |
| 32 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.CaptchaCustomResponse=wicketkeeper_solution" |
| 33 | + # Define captcha HTML file path |
| 34 | + - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaHTMLFilePath=/captcha.html" |
| 35 | +``` |
| 36 | +
|
| 37 | +```yaml |
| 38 | +wicketkeeper: |
| 39 | + image: ghcr.io/a-ve/wicketkeeper:latest |
| 40 | + user: root |
| 41 | + ports: |
| 42 | + - "8080:8080" |
| 43 | + environment: |
| 44 | + - ROOT_URL=http://localhost:8080 |
| 45 | + - LISTEN_PORT=8080 |
| 46 | + - REDIS_ADDR=redis:6379 |
| 47 | + - DIFFICULTY=4 |
| 48 | + - ALLOWED_ORIGINS=* |
| 49 | + - PRIVATE_KEY_PATH=/data/wicketkeeper.key |
| 50 | + volumes: |
| 51 | + - ./data:/data |
| 52 | + depends_on: |
| 53 | + - redis |
| 54 | +redis: |
| 55 | + image: redis/redis-stack-server:latest |
| 56 | +``` |
| 57 | +
|
| 58 | +## Exemple navigation |
| 59 | +
|
| 60 | +We can try to query normally the whoami server: |
| 61 | +
|
| 62 | +```bash |
| 63 | +curl http://localhost:8000/foo |
| 64 | +``` |
| 65 | + |
| 66 | +We can try to ban ourself and retry. |
| 67 | + |
| 68 | +```bash |
| 69 | +docker exec crowdsec cscli decisions add --ip 10.0.0.20 -d 10m --type captcha |
| 70 | +``` |
| 71 | + |
| 72 | +To play the demo environment run: |
| 73 | + |
| 74 | +```bash |
| 75 | +make run_custom_captcha |
| 76 | +``` |
0 commit comments