Allow the SSL_CERTS_PATH to be configurable in the install.sh file

[LePresidente]

Fixes #27

This removes lua_ssl_trusted_certificate through my testing everything still works as expected on both ssl and normal sites.

[LePresidente]

Actually according to the docs this is only required for the following which doesn't even look used

Specifies a file path with trusted CA certificates in the PEM format used to verify the certificate of the SSL/TLS server in the [tcpsock:sslhandshake](github://github.com/?anchor=tcpsocksslhandshake) method.

[he2ss]

We added this because when using captcha mode in the bouncer, it need this to work.
Did you check that the captcha mode is still working ?

[LePresidente]

I just tested this now using a V2 recaptcha key [v2 Tickbox] and it worked as expected

[he2ss]

I just tested locally and I have the same issue has we faced when using captcha:

2022/04/06 10:44:10 [error] 11#11: *1 [lua] crowdsec.lua:444: Allow(): Error while validating captcha: no resolver defined to resolve "www.google.com", client: 172.17.0.1, server: localhost, request: "POST / HTTP/1.1", host: "helloworld.local", referrer: "http://helloworld.local/"

Did you checked your error logs ?
As the resolver is not found, the request not banned if the captcha is wrong.

Also, I realized that you need to remove the lua_ssl_trusted_certificate from ./openresty/crowdsec_openresty.conf file in the docker image. You forgot because you're using the install script instead of the docker image.

How to reproduce

• Check out this PR
• Remove the line 3 from ./openresty/crowdsec_openresty.conf
• Change Dockerfile line 20 by COPY ./openresty/crowdsec_openresty.conf /etc/nginx/conf.d/crowdsec_openresty.conf
• Build the image, add a decision with type captcha and run the image with secret et site key to have captcha running

[LePresidente]

Ok i'm going to put this on hold for now, it is required for the captcha I just don't think the overhead is worth it. So going to try figure out if this is possible to improve

[LePresidente]

Ok Changed my approach, Just need to be able to change the SSL_CERTS_PATH

Using the existing ca-certificate.crt file my ram usage was 1.145GiB for my 7 vhosts
Using the Google CA certificate directly /etc/ssl/certs/GTS_root_R1.pem with my 7 vhosts has my ram usage at 104.6MiB with nothing else changed.

[LePresidente]

I'm not exactly sure whats causing the extreme memory usage, but this at least fixes it for my case

[LePresidente]

I did edit the Dockerfile to add the resolver line back into crowdsec_openresty.conf for testing though

[he2ss]

👍