Traefik¶

Traefik embeds the Myra EU CAPTCHA through the CrowdSec Bouncer Traefik Plugin. The plugin does not come from Myra Security. It queries the decisions of CrowdSec and, for the captcha decision, shows a challenge of the Myra EU CAPTCHA.

Sequence¶

The plugin works as a middleware upstream of your service:

Decision	Behaviour
`ban`	The plugin refuses the request.
`captcha`	The plugin shows the `captcha.html` template with the widget, verifies the solved token, and lets the IP address through for the duration of the grace period.
no decision	The plugin sends the request to your service unchanged.

In contrast to Caddy, CrowdSec therefore decides who sees a challenge. To protect all requests of a domain, use the separate bouncer. See CrowdSec.

Requirements¶

The following requirements must be met:

Requirement	Value
Traefik	Version that supports plugins
CrowdSec	Agent in operation with an available local API
Credentials	Public sitekey and secret from the Details view

Registering the plugin¶

Proceed as follows to make the plugin known:

► Add the following to the static configuration traefik.yml:

experimental:
  plugins:
    bouncer:
      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      version: v1.3.5

► Restart Traefik.
➔ Traefik downloads the plugin at startup.

Preparing the template and the bouncer¶

Proceed as follows to provide the template of the challenge and to register the bouncer:

► Download the template:

curl -o captcha.html \
  https://raw.githubusercontent.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/main/captcha.html

► Embed the file as a volume into the container of Traefik.
► Register the bouncer at CrowdSec:

docker exec crowdsec cscli bouncers add traefik-bouncer

↳ The command outputs an API key. Make a note of it.

Setting up the middleware¶

To set up the middleware, add the following to the dynamic configuration:

http:
  middlewares:
    crowdsec:
      plugin:
        bouncer:
          crowdsecLapiKey: "<API key from cscli bouncers add>"
          crowdsecLapiHost: "crowdsec:8080"
          captchaProvider: eucaptcha
          captchaSiteKey: "EUCAPTCHA_SITE_KEY"
          captchaSecretKey: "EUCAPTCHA_SECRET_KEY"
          captchaGracePeriodSeconds: 1800
          captchaHTMLFilePath: /captcha.html

The following keys apply to the Myra EU CAPTCHA:

Key	Description
`captchaProvider`	Provider of the challenge. For the Myra EU CAPTCHA, the value is `eucaptcha`.
`captchaSiteKey`	Public sitekey.
`captchaSecretKey`	Secret of the sitekey.
`captchaGracePeriodSeconds`	Duration in seconds for which a passed challenge is valid.
`captchaHTMLFilePath`	Path to the `captcha.html` template in the container.

► Assign the middleware to the routes that are to be protected.

Warning

The secret belongs exclusively in the configuration on the server. Store it in an environment variable or in a service for the management of secrets.

Note

The installation wizard in the Integration tab of the sitekey shows the same steps. See Integration.