Add easy way to enable Treafik plugins

[aimbot-luc]

It would be nice for new comers to have an easy settings menu/panel where they can toggle popular Treafik plugins (and maybe some basic settings for them). Such as: Fail2Ban, CrowdSec, Sablier, etc.

[butchooka]

+1 from me

traefik has a very steep learning curve, also most things you only need once like all those tags. So everybody not willing to play with it all time would greatly benefit at least from a short example in faq how and where changes for pangolin have to be made to activate plugins.

I think almost Everyone will want to have fail2ban, perhaps a geo blocker or crowdsec like tools to secure his environment with having almost nothing to do after initial setup.

[miloschwartz]

I agree with this. I think as a first step, we will integrate this into the installer and ask if you want to install/setup these plugins. We could add an option to configure it if you already have an installation that doesn't have the plugins.

[andredatele]

+1 would love to add a Geoblock plugin to my pangolin instance.

[v1rusnl]

Until it's possibly/hopefully baked into Pangolin:

https://github.com/friendly-bits/geoip-shell

Dead easy and a very handy Script. Eliminated 99% of my Bot issues. Just beware to whitelist the Let's Encrypt Cert Resolver in the Script.

[aszurnasirpal]

Can you share how did add those IP addresses for let's encrypt cert resolvers?
I used this list -> https://github.com/n3roGit/LetsEncryptIPs, but unfortunately it's not official, and those let's encrypt IPs can change

[v1rusnl]

After all is setup geoip-shell configure -l "172.65.32.248"

This worked for me after I did dig acme-v02.api.letsencrypt.org which led me to the above IP. This could change in the future since they are in CF CDN. Since I use my own wildcard cert I don't need more IPs because Letsencrypt just checks if my cert's still valid. If you use Letsencrypt to generate certs on the fly via traefik/pangolin you need probably more IPs from your link (if not all) because of their validation scheme of new certs. Then you could turn the geoip-shell off and back on with the command in the readme. Or you whitelist them all and let do crowdsec the rest.