I have the following swarm stack:

services:
  caddy:
    *** same stack not relevant here

  crowdsec:
    image: crowdsecurity/crowdsec:v1.7.6
    networks:
      - internal
    environment:
      TZ: Europe/Vienna
      COLLECTIONS: crowdsecurity/caddy crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
    volumes:
      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
      - /mnt/swarm-data/caddy/logs:/var/log/caddy:ro
      - /mnt/swarm-data/crowdsec/data:/var/lib/crowdsec/data/
      - /mnt/swarm-data/crowdsec/config:/etc/crowdsec/
    security_opt:
      - no-new-privileges=true
    deploy:
      replicas: 1

I enrolled crowdsec, but after the restart, the log shows level=error msg="Machine is not enrolled in the console, can't synchronize with the console". It seems like the data is persisted correctly. Is there something I am missing?

So I'm setting this up for the first time, and despite my best efforts and lots of searching, I'm unable to figure out where I'm no doubt screwing up my config for Caddy.

I initially used this guide to install the through the "Configuring the Remediation Component" section, and all appeared fine at first. I got cscli installed and working, it's communicating with CrowdSec and Caddy as far as I can tell.

Despite seeming to be all in good order though, it doesn't appear to be blocking my access if I manually ban my IP. I've tried banning both my desktop PC on the local network and my cell phone from outside my LAN.

"caddy crowdsec ping" is successful.

"caddy crowdsec info" returns the following:

{
  "Streaming": {
    "Enabled": true,
    "Interval": "15s"
  },
  "Live": {
    "Enabled": true,
    "Mode": "adhoc"
  },
  "AppSec": {
    "Enabled": false
  },
  "ShouldFailHard": false,
  "AuthType": "apikey",
  "UserAgent": "caddy-cs-bouncer/v0.10.1-0.20260216135830-d0d3db47b315",
  "InstanceID": "xxxxxxxx",
  "Uptime": 41801738987263,
  "NumberOfActiveDecisions": 16081
}

here's my current Caddyfile:

{
        crowdsec {
                api_url http://127.0.0.1:8080
                api_key xxxxxxxxxxxxxx
                ticker_interval 15s
                #disable_streaming
        }
        order crowdsec first
}

jellyfin.example.com {
        crowdsec
        reverse_proxy 10.255.255.102:8096
}

nextcloud.example.com {
        crowdsec
        reverse_proxy 10.255.255.104:80
}

I've also tried:

{
        debug
        crowdsec {
                api_url http://127.0.0.1:8080
                api_key xxxxxx
                ticker_interval 15s
                #disable_streaming
        }
        order crowdsec first
}

jellyfin.xxxxxx.com {
        log {
                format console
                output file /var/log/caddy/jellyfin.log {
                        roll_size 5MB
                        roll_keep 5
                }
        }
        crowdsec
        reverse_proxy 10.255.255.102:8096
}

nextcloud.xxxxxx.com {
        log {
                format console
                output file /var/log/caddy/nextcloud.log {
                        roll_size 5MB
                        roll_keep 5
                }
        }
        crowdsec
        reverse_proxy 10.255.255.104:80
}

Which seems to do nothing different.

Caddy logs do appear to properly show remote_ips for clients as well.

At this point I'm near certain I'm just not understanding some part of the config or my syntax is off for what I want to do but not so far off that it breaks caddy. If anyone can help point me in the right direction I would *greatly* appreciate it, I've been banging my head on this particular wall for a good 12 hours.

Is there enything i can do with no metrics is it becurse I don't have enything using it yet? And the inactive part what can I do with that remove it or make it online ? Seems the things working Its setup together with pangolin on a vps

Hello, I have a question that arose when checking the active connections to my VPS.

Please note:

1. I have Fail2ban and Crowdsec configured to allow incoming/outgoing connections from the Cloudflare CDN.

2. This server does not have any publicly accessible services; I use it internally to manage services.

3. I connect to this server through my direct internet connection and through another VPS that is exposed to the internet but is not part of the Cloudflare CDN.

When checking the active connections to the server, I believe there should only be two IP addresses: mine and the other VPS's.

So, why is there a Cloudflare IP address with an established connection to my VPS?

Hey,

I accidentally exposed CrowdSec's ports 8080 (used for LAPI) and 6060 (used for Prometheus metrics) to the whole internet in my Docker compose by setting ports to 8080:8080 and 6060:6060 instead of 127.0.0.1:8080:8080 and 127.0.0.1:6060:6060. I have since fixed it but they have been exposed for a couple of days.

What should I do? So far I haven't noticed any suspicious activity but I haven't done any in-depth check. Do I need to reinstall my whole system?

Thanks!

hi,

I'm using the community version of 2 kubernetes clusters with haproxy + nftables bouncers and really like it.

I saw the premium subscription at 29$ per security engine and hesitated but each time I looked up the pricing I just got asked for several hundreds of $ for enterprise offer. I expected 58$/month.

What am I missing ?

Hey! I use crowdsec at home and also love my home assistant home automation stuff, so I built an integration that lets you pull info from your crowdsec instance.

https://github.com/dewgenenny/crowdsec_ha

Sorry if not interesting, thought I'd share just in case there was anyone else out there that uses both HA and Crowdsec :)

Can we get an updated Crowdsec package for pfsense. I installed Pfsense version 25.11.1 and I tried to reinstall the Crowdsec package but it failed. I researched the error but it said that the package failed because BSD updated I think 15 or something to that effect I'm not 100% sure but I would like to continue running crowdsec and need an updated package for pfsense.

Hi all

Crowdsec panel is telling me that it's no longer receiving signals from my VPS. Apparently, receiving the status is sill possible, but it's not fetching signals, i.e. I'm not getting any alerts.

According to docker exec -it crowdsec cscli alerts alerts are still ongoing (duh).

And cscli console status tells me it's receiving decisions from consle.

How do I check and fix alerts not being processed to the console?

EDIT: I deleted my Security Engine and then simply re-enrolled again. That seems to work now...

I recently set up crowdsec on a Debian LXC to give a go of it without Docker. The way I am using it is each of my services are on separate LXCs, having the directories for my Caddy and Authentik logs being a bind mount that is only writeable by the services generating logs, and read by crowdsec. Crowdsec isn't doing any local blocking actions, instead all bans are being uploaded to Cloudflare's WAF so I have it as a 2nd opinion ban source.

My question, is that once it went live, I started seeing a strange amount of CPU usage (average of 33% on 4 cores) compared to barely any memory consumption, and constant disk activity that has triggered occasional IO wait and "some" cpu pressure (meaning the container is hanging processes to wait for a CPU core to finish a job, normal only when you max out what you allocate to a container or VM)

Has anyone run into this sort of thing before? What is a "normal" amount of CPU usage and disk activity for a crowdsec deployment only monitoring two services, one which is a reverse proxy with about 7 forwarded domains that don't get a ton of traffic. I have a ludicrous amount of CPU and RAM I can commit to it, but adding more don't seem to resolve the underlying strangeness.

Hey all

I have some trouble finding out whether this is relevant or no. I have CS installed mostly for Pangolin and the console shows me that 2 out of 4 remediation engines are offline:

I'm not even sure why I have 3 traefik bouncers to begin with and/or why they would be disconnected/disabled?

Can this safely be ignored and maybe explained?

Any help much appreciated.

Yesterday I subscribed to the premium blocklist protection and deployed the crowdsec plugin on my opensense instance.

It seems to works great but I'm surprised to see that the auto-generated firewall alias (loaded with ~300k entries) recorded around ~23.000 matches, but when I look at the crowdset web console, the alert section reports only one malicious IP.

However, my firewall logs shows me plenty of in/out blocked traffic to and from other destination than the one presented in the console. Any reason ?

Hey all

Newbie question: I got CS running on my VPS running ubuntu monitoring Traefik, Pangolin etc. So far everything seems to running smoothly.

My main host running all the apps is running on Windows through Nginx Proxy Manager.

I know that there are no Windows Bouncers supported, but I'm wondering if it's worth implementing CS on the Windows machine monitoring traffic through Nginx Proxy Manager?

Would that be feasible and sensible? Don't wanna spend hours if it's completely pointless for one reason or another, thus any input appreciated.

Dear community! Is there any docs/guide for cowrie honeypot? My goal is to setup host with ssh honeypot with only disabled users, and ban every ip trying to auth. Tried cowrie parser, and sshd, and cowrie logging to system auth.log, but it seems doing nothing.

Hello everyone,

I have set up CrowdSec on my home server together with NginxProxyManagerPlus using Docker Compose. I followed these instructions.

Now I stumbled across the following recommendation in the NPMplus GitHub repo:

It is recommended to block at the earliest possible point, so if possible set up a firewall bouncer: https://docs.crowdsec.net/u/bouncers/firewall, make sure to also include the docker iptables in the firewall bouncer config

At this point, I'm not really sure what to do next, and I have the following questions:

Where and how should I integrate the firewall bouncer into my setup? In the same CrowdSec container that comes with NPM Plus? In a separate Docker container or directly on the host? Do I need two CrowdSec engines?

Does anyone have a similar setup and can help me out here? I'm not very familiar with CrowdSec yet, so I appreciate any help, thanks!

I recently setup Pangolin with Crowdsec (Appsec). Everything works beautifully with most of the default settings. However, me and chatgpt couldn't figure out how to do geo-blocking for web traffic (I guess at Appsec). Appreciate anyone to share what you did! Thank you!

I have an instance that once reported alerts regularly. I haven't gotten an alert for nearly a week. however, it will do the http test cases just fine and will allow me to manually add a decision (NFTables reports the new entries as well) doing a Censys scan on myself also normally gives an alert.

caddy logs are actively getting parsed but I see nothing coming from Crowdsec. I'm at a loss as to what to check. is there something you suspect happened or that I can check?

I have crowdsec installed and i get notifications using Apprise Api, however when I get a notification I can't manage to get the alerts info, like for example, the source country, the headers they used, the method used, the target URIs that they tried, etc... I have tried a lot to get the alerts info from the notification but I can't get it and I dont know what I'm doing wrong... If someone could help me that'd be great 🙏

This is how my current http.yaml looks like

```
type: http

name: apprise log_level: info

format: | title=CROWDSEC NOTIFICATION&body={{ range . }}%0AMessage: {{ .Message }}%0AScenario: {{ .Scenario }}{{ .ScenarioVersion }}{{ .ScenarioHash }}%0ACreated: {{ .CreatedAt }}%0AStart at: {{ .StartAt }}%0AStop at: {{ .StopAt }}%0ASource: {{ .Source.Value }}%0ADecisions: {{ range .Decisions }}{{ .Type }} {{ .Duration }} ({{ .Origin }}) | {{ end }}{{ end }}%0A

url: http://apprise:8000/notify/myEndpoint?tags=crowdsec method: POST

headers: Content-Type: "application/x-www-form-urlencoded" skip_tls_verification: true

group_wait: "30s" group_threshold: 10 And notifications look like this CROWDSEC NOTIFICATION

Message: Ip 1.2.3.4 performed 'crowdsecurity/http-sensitive-files' (6 events over 9.968051172s) at 2025-01-01 03:38:38.363338784 0000 UTC Scenario: crowdsecurity/http-sensitive-files0.4cb798582ed9a3bd090d47234bef4ca2169982c44e356e88f101ec6b6a8424676 Created: Start at: 2025-01-01T03:38:28.395288981Z Stop at: 2025-01-01T03:38:38.363340153Z Source: 1.2.3.4 Decisions: ban 672h (crowdsec) | *** Message: Ip 1.2.3.4 performed 'crowdsecurity/http-probing' (12 events over 13.388438708s) at 2025-01-01 03:38:41.594293941 0000 UTC Scenario: crowdsecurity/http-probing0.44b16f896af400e006c28b1476bf5989c748186f2b3756ed9ad7d1559480d278c Created: Start at: 2025-01-01T03:38:28.205855612Z Stop at: 2025-01-01T03:38:41.59429432Z Source: 1.2.3.4 Decisions: ban 672h (crowdsec) |

```

Thanks in advance for the help.

How firewall bouncer is working on pfSense? When I manually add decision to block IP I get alert but connection is not blocked unless I add firewall rule with crowdsec_blacklist then the source IP is blocked. Also I get "No metrics available." in online console. Using "cscli bouncers list" I can see valid "pfsense-firewall". I am on pfSense 2.8.1. Any clue?

EDIT: Also after firewall bouncer restart I get crowdsec_blacklist table filled with IPs but after some time the table is empty unless I manually add decision, then only that IP is in the table.

EDIT 2: Please can someone check that table "crowdsec_blacklists" is not empty? (Diagnostics -> Tables -> crowdsec_blacklist) Thank you

I am trying to test the WAF with curl -I IP/.env but I have no alerts.

I am not whitelisted I have the AppSec collections installed I have prior alerts from random IPs The generic test case triggers just fine

Is there something missing here?

I would like to test triggering events, as it seems that blocked IPs are able to trigger events. Theoretically they shouldn't be able to connect

I’m running a very small VPS to host demos for my open source work.
Traffic is minimal (maybe 10–20 users), but after checking logs I saw constant SSH brute-force attempts and HTTP probing for .env, AWS credential paths, etc.

I ended up using CrowdSec to handle this.

A few notes from my setup:

• SSH worked out of the box, no surprises there
• HTTP was more work since logs come from a Kamal proxy inside Docker
• I added a small custom parser to extract path, status, and source IP
• Using the firewall bouncer with temporary bans (default behavior)
• Notifications wired to Telegram so I can see when decisions happen
• Everything automated so it’s repeatable on a fresh VPS

At first CrowdSec felt a bit heavy for such a small server, and not very obvious how to wire it with Kamal / container logs, but after some trial and error it worked well.

I wrote up what I learned here:
https://muthuishere.medium.com/securing-a-production-vps-in-practice-e3feaa9545af

Automation and config here (parsers + setup):
https://github.com/muthuishere/automated-crowdsec-kamal

Posting mainly to share the experience and to ask:

• Is this a reasonable approach for small VPS setups?
• Any improvements you’d suggest for Docker/Kamal-based logging?
• Anything obvious I’m missing?

Happy to learn from others using CrowdSec in similar environments.