CrowdSec

Overview

CrowdSec is a collaborative intrusion detection and prevention system integrated directly into Traefik. It analyses Traefik access logs in real time, detects attack patterns (brute force, CVE exploitation, bad bots, etc.), and instructs Traefik to block flagged IPs before they reach any backend service.

The stack consists of two containers:

• crowdsec — the Security Engine (LAPI + agent). Ingests logs, applies detection scenarios, maintains a decision list, and shares signals with the CrowdSec community.
• crowdsec-bouncer-traefik — the Traefik bouncer. Traefik forwards every incoming request to it via ForwardAuth; the bouncer checks the IP against CrowdSec's local decision database and returns allow/deny.

Access

Neither CrowdSec container has a web UI. Management is via the cscli CLI inside the crowdsec container:

docker exec -it crowdsec cscli decisions list
docker exec -it crowdsec cscli alerts list
docker exec -it crowdsec cscli metrics

Configuration

Compose project: crowdsec (managed via Portainer)

Containers

crowdsec — Security Engine

Image: crowdsecurity/crowdsec:latest

Key environment variables:

Collections installed:

crowdsec-bouncer-traefik — Traefik Bouncer

Image: fbonalair/traefik-crowdsec-bouncer:latest

Key environment variables:

How the Bouncer Integrates with Traefik

The middleware is defined in /home/jeeves/docker/traefik/config/crowdsec.yml:

http:
  middlewares:
    crowdsec-bouncer:
      forwardAuth:
        address: http://crowdsec-bouncer-traefik:8080/api/v1/forwardAuth
        trustForwardHeader: true

This middleware is referenced on external Traefik routes as crowdsec-bouncer@file.

Log Ingestion

CrowdSec reads Traefik access logs from two bind-mounted paths:

The acquis.yaml config file at /home/jeeves/docker/crowdsec/config/acquis.yaml defines which log files to tail and in what format.

Volumes / Bind Mounts

Dependencies

• Traefik (must be running and writing access logs for CrowdSec to process)
• crowdsec LAPI must be healthy before crowdsec-bouncer-traefik starts
• Internet access required for CrowdSec community hub sync (pulling updated block lists)

Notes / Gotchas

• The BOUNCER_KEY_TRAEFIK / CROWDSEC_BOUNCER_API_KEY pair must match exactly. If mismatched, the bouncer will fail to authenticate with LAPI and Traefik will receive a 200 (passthrough) response from ForwardAuth — effectively disabling the bouncer silently.
• CrowdSec community sharing (online_api_credentials.yaml) requires an account at app.crowdsec.net. The credentials file is stored at /home/jeeves/docker/crowdsec/config/online_api_credentials.yaml.
• crowdsec-bouncer@file middleware must be applied to external routes only. Applying it to internal (*.home.local) routes will check LAN IPs against the community block list, which may block legitimate traffic unexpectedly.
• Manually ban an IP with:

  docker exec -it crowdsec cscli decisions add --ip <IP> --duration 24h --reason "manual"
  

• Remove a ban:

  docker exec -it crowdsec cscli decisions delete --ip <IP>
  

Last Updated: 2026-06-16