docs - last polish

docs/plugins.md

@@ -1,10 +1,11 @@
 # Plugins
 
-Bunkerized-nginx comes with a plugin system that lets you extend the core with extra security features. To add a plugin you will need to download it, edit its settings and mount it to the `/plugins` volume.
+Bunkerized-nginx comes with a plugin system that lets you extend the core with extra security features.
 
 ## Official plugins
 
 - [ClamAV](https://github.com/bunkerity/bunkerized-nginx-clamav) : automatically scan uploaded files and deny access if a virus is detected
+- [CrowdSec](https://github.com/bunkerity/bunkerized-nginx-crowdsec) : CrowdSec bouncer integration within bunkerized-nginx
 
 ## Community plugins
 
@@ -13,9 +14,10 @@ If you have made a plugin and want it to be listed here, feel free to [create a
 ## Use a plugin
 
 The generic way of using a plugin consists of :
-- Download it to a folder (e.g. : myplugin/)
-- Edit the settings inside the plugin.json files (e.g. : myplugin/plugin.json)
-- Mount the plugin folder to the /plugins/plugin-id inside the container (e.g. : /where/is/myplugin:/plugins/myplugin)
+- Download the plugin into your local drive (e.g., git clone)
+- Edit the settings inside the plugin.json files (e.g., myplugin/plugin.json)
+- If you are using a container based integration, you need to mount it to the [plugins special folder](https://bunkerized-nginx.readthedocs.io/en/latest/special_folders.html#plugins) inside the container (e.g., /where/is/myplugin:/plugins/myplugin)
+- If you are using Linux integration, copy the downloaded plugin folder to the [plugins special folder](https://bunkerized-nginx.readthedocs.io/en/latest/special_folders.html#plugins) (e.g., cp -r myplugin /plugins)
 
 To check if the plugin is loaded you should see log entries like that :
 
@@ -52,6 +54,20 @@ Settings names and default values can be choosen freely. There will be no confli
 local M		= {}
 local logger	= require "logger"
 
+-- this function will be called at startup
+-- the name MUST be init without any argument
+function M.init ()
+	-- the logger.log function lets you write into the logs
+	-- only ERROR level is available in init()
+	logger.log(ngx.ERR, "MyPlugin", "*NOT AN ERROR* init called")
+
+	-- here is how to retrieve a setting
+	local my_setting = ngx.shared.plugins_data:get("pluginid_MY_SETTING")
+	logger.log(ngx.ERR, "MyPlugin", "*NOT AN ERROR* my_setting = " .. my_setting)
+	
+	return true
+end
+
 -- this function will be called for each request
 -- the name MUST be check without any argument
 function M.check ()
@@ -66,7 +82,6 @@ function M.check ()
 	if my_setting == "block" then
 		ngx.exit(ngx.HTTP_FORBIDDEN)
 	end
-
 end
 
 return M

docs/security_tuning.md

@@ -199,6 +199,8 @@ You can quickly protect sensitive resources (e.g. : admin panels) by requiring H
 - `AUTH_BASIC_PASSWORD=changeme` : the password required
 - `AUTH_BASIC_TEXT=Restricted area` : the text that will be displayed to the user
 
+Please note that bunkerized-nginx also supports [Authelia](https://github.com/authelia/authelia) for authentication (see the corresponding [environment variables](https://bunkerized-nginx.readthedocs.io/en/latest/environment_variables.html#authelia) and a [full example](https://github.com/bunkerity/bunkerized-nginx/tree/dev/examples/authelia)).
+
 ## Whitelisting
 
 Adding extra security can sometimes trigger false positives. Also, it might be not useful to do the security checks for specific clients because we decided to trust them. Bunkerized-nginx supports two types of whitelist : by IP address and by reverse DNS.

docs/troubleshooting.md

@@ -2,13 +2,15 @@
 
 ## Logs
 
-When troubleshooting, the logs are your best friends. We try our best to provide user-friendly logs to help you understand what happened. Please note that we don't store the logs inside the container, they are all displayed on stdout/stderr so Docker can capture them. They can be displayed using the [docker logs](https://docs.docker.com/engine/reference/commandline/logs/) command.
+When troubleshooting, the logs are your best friends. We try our best to provide user-friendly logs to help you understand what happened.
+
+If you are using container based integrations, you can get the logs using your manager/orchestrator (e.g., docker logs, docker service logs, kubectl logs, ...). For Linux integration, everything is stored inside the `/var/log` folder.
 
 You can edit the `LOG_LEVEL` environment variable to increase or decrease the verbosity of logs with the following values : `debug`, `info`, `notice`, `warn`, `error`, `crit`, `alert` or `emerg` (with `debug` being the most verbose level).
 
 ## Permissions
 
-Don't forget that bunkerized-nginx runs as an unprivileged user with UID/GID 101. Double check the permissions of files and folders for each volumes (see the [volumes list](https://bunkerized-nginx.readthedocs.io/en/latest/volumes.html)).
+Don't forget that bunkerized-nginx runs as an unprivileged user with UID/GID 101 when using container based integrations or simply the `nginx` user on Linux. Double check the permissions of files and folders for each special folders (see the [volumes list](https://bunkerized-nginx.readthedocs.io/en/latest/special_folders.html)).
 
 ## ModSecurity