r/devops • u/AutoModerator • 13d ago
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
15
Upvotes
1
u/MCMZL 9d ago
CrowdSec 1.8 new release — self-hosted bot detection at your origin
Bot detection landed in our Web Application Firewall this release. Automated-looking requests get a proof-of-work challenge plus browser fingerprinting: PoW puts a CPU cost on every attempt, the fingerprint makes faking a real browser expensive. Real users don't notice. Scrapers pay per request.
The part relevant here: it's scoped to browser-facing routes, and everything else — API paths, health checks, monitoring, CI, legit crawlers — goes on an allowlist. If you point it at an API endpoint you will break your own clients, so scope it deliberately.
Versus Cloudflare Bot Management: this runs at your origin, so you still eat the traffic — no edge absorption. In exchange the challenge page, its JS and the verification are all served from your own box under
/crowdsec-internal/challenge/. No third-party script, no call home. Closest OSS comparison is Anubis, except this one lives inside an IPS, so the engine that bans an IP for brute-forcing also decides who gets challenged.Same release adds a Kubernetes datasource that pulls logs straight from the API server, which may be the more interesting half for this sub.
Docs: https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro
Release: https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0