coop-cloud/traefik
7
2
Fork 20
Code Issues 17 Pull Requests 5 Releases Wiki Activity

WIP: feat: adds crowdsec #122

Draft
devydave wants to merge 3 commits from devydave/traefik:feat-crowdsec into master
pull from: devydave/traefik:feat-crowdsec
merge into: :master
Conversation 10 Commits 3 Files Changed 7
+123 -2
devydave commented 2026-07-18 11:08:40 +00:00
Owner
Copy Link
Copy Source

We were in urgent need of some DDOS protection, because one of our projects got attacked. This is the solution that is currently running as a mitigation in production.
Feel free to review :)

We were in urgent need of some DDOS protection, because one of our projects got attacked. This is the solution that is currently running as a mitigation in production. Feel free to review :) * [x] I have deployed and tested my changes * [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash) * [ ] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes) * [ ] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes)
❤️ 2 🎉 1
devydave added 1 commit 2026-07-18 11:08:41 +00:00
feat: adds crowdsec
continuous-integration/drone/pr Build is failing
Details
e34a0e909d
abra.sh
@@ -1,3 +1,4 @@
export TRAEFIK_YML_VERSION=v32
export FILE_PROVIDER_YML_VERSION=v12
export TRAEFIK_YML_VERSION=v33
export FILE_PROVIDER_YML_VERSION=v15
devydave commented 2026-07-18 11:09:44 +00:00
Author
Owner
Copy Link
Copy Source

will fix the version skip when I have more time ^^

will fix the version skip when I have more time ^^
devydave marked this conversation as resolved
devydave marked the pull request as work in progress 2026-07-28 20:45:22 +00:00
p4u1 commented 2026-08-25 17:20:06 +00:00
Owner
Copy Link
Copy Source

@devydave can you rebase and integrate the access log feature from fauno?

@devydave can you rebase and integrate the access log feature from fauno?
p4u1 commented 2026-08-25 17:22:14 +00:00
Owner
Copy Link
Copy Source

@devydave can you rebase and integrate the access log feature from fauno?

@devydave can you rebase and integrate the access log feature from fauno?
fauno commented 2026-10-29 14:15:29 +00:00
Owner
Copy Link
Copy Source

@hex here's previous art on getting a waf into traefik

@hex here's previous art on getting a waf into traefik
devydave commented 2026-10-30 10:31:37 +00:00
Author
Owner
Copy Link
Copy Source

@hex @fauno if there is more interest I can try to finish it, we do not use it anymore at the moment but the recent CVE problems showed it would be nice to have

@hex @fauno if there is more interest I can try to finish it, we do not use it anymore at the moment but the recent CVE problems showed it would be nice to have
hex commented 2026-10-30 10:40:14 +00:00
Owner
Copy Link
Copy Source

The brotli issue would be far from solved with a WAF, but a WAF would definitely reduce the attack surface. I do think it would help.

The brotli issue would be far from solved with a WAF, but a WAF would definitely reduce the attack surface. I do think it would help.
fauno commented 2026-10-30 17:54:06 +00:00
Owner
Copy Link
Copy Source

@devydave i think this is only working option for traefik so far in term of wafs, right? i've been looking into coraza but the open source plugin is unmaintained and the production plugin is for traefik enterprise edition. it'd be great if you had the time to finish it, otherwise i can try soon!

@devydave i think this is only working option for traefik so far in term of wafs, right? i've been looking into coraza but the open source plugin is unmaintained and the production plugin is for traefik enterprise edition. it'd be great if you had the time to finish it, otherwise i can try soon!
devydave added 1 commit 2026-11-08 18:53:05 +00:00
Merge branch 'master' into feat-crowdsec
continuous-integration/drone/pr Build is failing
Details
aac117f594
devydave added 1 commit 2026-11-08 20:19:41 +00:00
refactor: refactor to new access log implementation
continuous-integration/drone/pr Build is failing
Details
5ad8d0509a
README.md
@@ -78,0 +114,4 @@
When there are not bans yet you can try by banning your own IP.
```
abra app run <domain> crowdsec cscli decisions add --ip <your-ip> -d 10m # this will be effective 10min
devydave commented 2026-11-08 20:22:52 +00:00
Author
Owner
Copy Link
Copy Source

This command is not working at the moment because the flags get parsed as abra flags and when I wrap them in " the cli is not found inside the container. For me it feels like a bug ideas anyone?

This command is not working at the moment because the flags get parsed as abra flags and when I wrap them in " the cli is not found inside the container. For me it feels like a bug ideas anyone?
fauno commented 2026-11-09 14:06:23 +00:00
Owner
Copy Link
Copy Source

would you try any of these combinations?

toolshed/abra#790

would you try any of these combinations? https://git.coopcloud.tech/toolshed/abra/issues/790
devydave commented 2026-11-08 20:29:37 +00:00
Author
Owner
Copy Link
Copy Source

@fauno I adjusted the PR with your access log changes with the following env it works. Maybe I will adjust the pattern like the access log that CROWDSEC_ENABLED is not needed.

COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"

COMPOSE_FILE="$COMPOSE_FILE:compose.crowdsec.yml"
CROWDSEC_ENABLED=1
CROWDSEC_BOUNCER_ENABLED=1
SECRET_CROWDSEC_LAPI_KEY_VERSION=v2

What will be your use case for the crowdsec integration? When you enable it on a service the traefik logs get scanned for patterns and bans sus behaviour and bans the IP for 4h. A ban results in a 403 being sent. There is an option for captcha, that could be implemented.
image.png

@fauno I adjusted the PR with your access log changes with the following env it works. Maybe I will adjust the pattern like the access log that `CROWDSEC_ENABLED` is not needed. ``` COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml" COMPOSE_FILE="$COMPOSE_FILE:compose.crowdsec.yml" CROWDSEC_ENABLED=1 CROWDSEC_BOUNCER_ENABLED=1 SECRET_CROWDSEC_LAPI_KEY_VERSION=v2 ``` What will be your use case for the crowdsec integration? When you enable it on a service the traefik logs get scanned for patterns and bans sus behaviour and bans the IP for 4h. A ban results in a 403 being sent. There is an option for captcha, that could be implemented. ![image.png](/attachments/6a800536-39c3-4d73-b896-ff0223d0c557)
image.png
55 KiB
README.md
@@ -77,1 +77,4 @@
## Crowdsec
IMPORTANT even though Crowdsec is Open Source, the software sends information of the attacker IP and what decision(ban or captcha) to a centralized server for communit managed block lists.
fauno commented 2026-11-09 14:08:17 +00:00
Owner
Copy Link
Copy Source

there's a typo in communit[y]. also, does it mean to say that any visitor ip address is sent to crowdsec? or is there a local decision about what looks like an attack?

there's a typo in communit[y]. also, does it mean to say that any visitor ip address is sent to crowdsec? or is there a local decision about what looks like an attack?
devydave commented 2026-11-13 20:48:41 +00:00
Author
Owner
Copy Link
Copy Source

I did not find out to configure it yet, but there are both options. You can only make decisions locally and do not upstream the IP, but then you do not get access to the full provided community ban list. The other option is you upstream the IPs which get banned and get full access to the ban list.

I did not find out to configure it yet, but there are both options. You can only make decisions locally and do not upstream the IP, but then you do not get access to the full provided community ban list. The other option is you upstream the IPs which get banned and get full access to the ban list.
README.md
@@ -78,0 +91,4 @@
abra app run <domain> crowdsec cscli bouncers add crowdsecBouncer
```
After that insert the LAPI key(command below) and redeploy traefik with `CROWDSEC_BOUNCER_ENABLED=1` and `CROWDSEC_TRAEFIK_CONFIG_VERSION=v2`.
fauno commented 2026-11-09 14:10:50 +00:00
Owner
Copy Link
Copy Source

did you actually need to increase the config version? the template doesn't change so docker should accept it even if the rendered config is different

did you actually need to increase the config version? the template doesn't change so docker should accept it even if the rendered config is different
devydave commented 2026-11-13 20:50:04 +00:00
Author
Owner
Copy Link
Copy Source

Oh yeah that is a mistake

Oh yeah that is a mistake
compose.crowdsec.yml
@@ -0,0 +13,4 @@
COLLECTIONS: "crowdsecurity/traefik"
volumes:
- crowdsec-db:/var/lib/crowdsec/data/
- crowdsec-config:/etc/crowdsec/
fauno commented 2026-11-09 14:11:44 +00:00
Owner
Copy Link
Copy Source

what does this volume store?

what does this volume store?
file-provider.yml.tmpl
@@ -25,0 +27,4 @@
plugin:
bouncer:
enabled: {{ if eq (env "CROWDSEC_BOUNCER_ENABLED") "1" }}true{{ else }}false{{ end }}
logLevel: DEBUG
fauno commented 2026-11-09 14:09:54 +00:00
Owner
Copy Link
Copy Source

can this be made configurable?

can this be made configurable?
devydave commented 2026-11-13 20:51:52 +00:00
Author
Owner
Copy Link
Copy Source

Sure, also this is in by mistake from a debugging session, I think the default should be INFO?

Sure, also this is in by mistake from a debugging session, I think the default should be INFO?
traefik.yml.tmpl
@@ -191,0 +197,4 @@
plugins:
bouncer:
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
version: v1.8.1
fauno commented 2026-11-09 14:13:12 +00:00
Owner
Copy Link
Copy Source

do the versions need to match?

do the versions need to match?
devydave commented 2026-11-13 20:53:00 +00:00
Author
Owner
Copy Link
Copy Source

I think this is a coincendence

I think this is a coincendence
Some required checks failed
continuous-integration/drone/pr Build is failing
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u https://git.coopcloud.tech/devydave/traefik feat-crowdsec:devydave-feat-crowdsec
git checkout devydave-feat-crowdsec
Sign in to join this conversation.
Reviewers
No Reviewers
devydave
fauno
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
3wordchant aadil (Aadil Ayub) abra-bot (Abra Bot) ammaratef45 amras (Sarma) BornDeleuze (Born Deleuze) Brooke carla cas (Cassowary) coopcloud dannygroenewegen (Danny Groenewegen) decentral1se (d1) devydave fauno (fauno) hex (Josh Dukes) javielico (Javielico) jjsfunhouse kawaiipunk (KawaiiPunk) knoflook moosemower moritz notplants oxaliq (sorrel) p4u1 (p4u1) renovate-bot (Comrade Renovate Bot) simon stevensting (stevensting) trav (Trav Fryer) yksflip
No Assignees
4 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coop-cloud/traefik#122