crowdsec:
    image: crowdsecurity/crowdsec:v1.6.6
    restart: unless-stopped
    environment:
      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/http-dos crowdsecurity/wordpress Dominic-Wagner/vaultwarden LePresidente/grafana LePresidente/overseerr"
      CUSTOM_HOSTNAME: crowdsec
      BOUNCER_KEY_PLUGIN: <REDACTED>
      DOCKER_HOST: tcp://traefik_dockerproxy:2375
    deploy:
      placement:
        constraints:
          - node.role == manager
    volumes:
      - logs:/var/log/traefik:ro
      - crowdsec-config:/etc/crowdsec/
    labels:
      - "traefik.enable=false"
    networks:
      - crowdsec

 dockerproxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:0.3
    container_name: dockerproxy
    environment:
    environment:
      - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg (default=info)
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=0 # Watchtower
      # Not always needed
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - ALLOW_START=0
      - ALLOW_STOP=0
      - ALLOW_RESTARTS=0
      - CONTAINERS=1 # Traefik, portainer, netdata etc.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=0 # Portainer
      - INFO=1 # Portainer
      - NETWORKS=0 # Portainer
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=1
      - SYSTEM=1
      - TASKS=0 # Portainer
      - VOLUMES=0 # Portainer
    networks:
      - crowdsec
    deploy:
      placement:
        constraints: [node.role == manager]
    volumes:
        - /var/run/docker.sock:/var/run/docker.sock:ro # Mounted as read-only
    restart: unless-stopped