# CrowdSec core — chart crowdsecurity/crowdsec 0.24.0 (appVersion v1.7.8)
# Deploys: LAPI (decisions DB), log-processing agent, and AppSec (WAF) component.
#
# Detection strategy here = CAPI community blocklists + AppSec (inline WAF).
# We intentionally do NOT parse Envoy access logs (no reliable first-party
# Envoy parser); the kdwils bouncer forwards requests to AppSec instead.
# Remediation/enforcement is done by the separate `crowdsec-envoy-bouncer`.

#=============================#
#= Local API (LAPI)          =#
#=============================#
lapi:
  # Pre-register the "envoy" bouncer. The CrowdSec image turns BOUNCER_KEY_<name>
  # into a registered bouncer named <name> on first start. The kdwils bouncer
  # authenticates with this same key.
  env:
    - name: BOUNCER_KEY_envoy
      valueFrom:
        secretKeyRef:
          name: crowdsec-secrets
          key: bouncer-key
  # Chart default is requests == limits == 500m, which will not schedule: the
  # node is at 95% of allocatable CPU in requests while actually using ~10%.
  resources:
    requests:
      cpu: 50m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi
  persistentVolume:
    data:
      enabled: true
      storageClassName: longhorn
      size: 2Gi
    config:
      enabled: true
      storageClassName: longhorn
      size: 100Mi

#=============================#
#= Log-processing agent      =#
#=============================#
agent:
  # Disabled: detection comes from AppSec + CAPI, not log tailing. Chart 0.24.0
  # refuses to render the agent DaemonSet with an empty acquisition list anyway.
  enabled: false

#=============================#
#= AppSec (WAF) component     =#
#=============================#
appsec:
  enabled: true
  # Inline on every public request, so it keeps a generous limit but a small
  # request (same reason as lapi above).
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 1000m
      memory: 512Mi
  # Hub collections installed into the AppSec pod at startup (the WAF rule sets).
  env:
    - name: COLLECTIONS
      value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"
  acquisitions:
    - source: appsec
      listen_addr: "0.0.0.0:7422"
      path: /
      # Virtual-patching ruleset (CRS-based vpatch rules). Verify it loaded after
      # first deploy with: cscli appsec-configs list / cscli appsec-rules list
      appsec_config: crowdsecurity/virtual-patching
      labels:
        type: appsec