add the bot detection feature to the crowdsec traefik bouncer

[sabban]

add the bot detection feature to the crowdsec traefik bouncer

This is an early PR and depends on the crowdsec feature in the PR crowdsecurity/crowdsec#4268 This is not meant to be merged now, but to gather feedbacks.

The bouncer now parses structured AppSec JSON responses:

• action
• http_status
• user_body_content
• user_cookies
• user_headers

When AppSec returns an action other than allow, the plugin writes the provided status, headers, cookies, and body back to the client. This lets CrowdSec serve the challenge HTML, set the
__crowdsec_challenge cookie, and expose the browser-side challenge flow through Traefik.

Legacy behavior is preserved: an empty/non-structured AppSec 403 still falls back to the existing ban handling.

For challenge mode, the Traefik side does not need a new plugin option. It needs AppSec enabled, and the challenge protocol paths must be routed through the same CrowdSec middleware as the protected application route.

The challenge mode has to be enabled crowdsec side, though. Documentation is not published yet, but the WIP documentation is available at crowdsecurity/crowdsec-docs#1099 and crowdsecurity/crowdsec-docs#1100.

This PR is meant to gather feedback and not to be merged right now.

My test configuration docker file.

name: crowdsec-bouncer-traefik-plugin

  services:
    traefik:
      image: traefik:latest
      container_name: traefik
      restart: unless-stopped
      command:
        - --log.level=DEBUG
        - --accesslog
        - --accesslog.filepath=/var/log/traefik/access.log
        - --api.insecure=true
        - --providers.docker=true
        - --providers.docker.exposedbydefault=false
        - --entrypoints.web.address=:80
        - --experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
      depends_on:
        crowdsec:
          condition: service_started
          required: true
      environment:
        DOCKER_API_VERSION: "1.40"
      ports:
        - 8000:80
        - 8080:8080
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock:ro
        - logs-local:/var/log/traefik
        - ./ban.html:/ban.html:ro
        - ./captcha.html:/captcha.html:ro
        - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
    crowdsec:
      image: crowdsec:waf-challenge-pr4268
      container_name: crowdsec
      restart: unless-stopped
      environment:
        BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5=
        COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
        CUSTOM_HOSTNAME: crowdsec
      labels:
        traefik.enable: "false"
      volumes:
        - ./acquis.challenge.yaml:/etc/crowdsec/acquis.yaml:ro
        - logs-local:/var/log/traefik:ro
        - crowdsec-db-pr4268:/var/lib/crowdsec/data
        - crowdsec-config-pr4268:/etc/crowdsec
        - ./local-challenge.yaml:/etc/crowdsec/appsec-configs/local-challenge.yaml:ro

    bar:
      image: traefik/whoami
      container_name: simple-service-bar
      restart: unless-stopped
      labels:
        traefik.enable: "true"
        traefik.http.services.service-bar.loadbalancer.server.port: "80"

        traefik.http.routers.bar.rule: PathPrefix(`/bar`)
        traefik.http.routers.bar.middlewares: crowdsec@docker

        traefik.http.routers.crowdsec-challenge.rule: PathPrefix(`/crowdsec-internal/challenge`)
        traefik.http.routers.crowdsec-challenge.middlewares: crowdsec@docker
        traefik.http.routers.crowdsec-challenge.service: service-bar

        traefik.http.middlewares.crowdsec.plugin.bouncer.enabled: "true"
        traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel: DEBUG
        traefik.http.middlewares.crowdsec.plugin.bouncer.metricsupdateintervalseconds: "15"
        traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode: stream
        traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey: 40796d93c2958f9e58345514e67740e5=
        traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme: http
        traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapihost: crowdsec:8080
        traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsecenabled: "true"
        traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost: crowdsec:7422
        traefik.http.middlewares.crowdsec.plugin.bouncer.remediationheaderscustomname: X-Remediation
        traefik.http.middlewares.crowdsec.plugin.bouncer.ForwardedHeadersTrustedIPs: 172.21.0.1/8

  volumes:
    logs-local:
    crowdsec-db-pr4268:
    crowdsec-config-pr4268: