← Directory

crowdsec-traefik-bouncer

CrowdSec bouncer for Traefik to block malicious IPs from accessing your services.

  • Security
CrowdSec bouncer for Traefik to block malicious IPs from accessing your services. This utilizes Traefik v2 ForwardAuth Middleware and queries CrowdSec with the client IP. If the client IP is on the ban list, Traefik will issue a HTTP code 403 response. Otherwise, the request will continue as usual. Be sure to install CrowdSec first. See our instructions on CrowdSec here: https://docs.ibracorp.io

Platform availability

Available on 1 of 6 install platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)

Also on Docker Hub and GitHub

Health score

23/100 Low

Maintained
0last commit 1461 days ago
Popular
50332 GitHub stars
Easy to install
351 install platform, install notes, Docker image
Light to run
No data

Based on 3 of 4 factors.

How is this calculated?

A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). Factors without data are left out and the rest are rescaled.

Availability: platform listings confirmed today, links checked 9 days ago

GitHub stars
332
Open issues
21
Last commit
2022-10-09
License
MIT
Activity
stale

Checked yesterday - source: GitHub (fbonalair/traefik-crowdsec-bouncer)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked 10 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Replace the placeholder tokens Run the bouncer command with -g <TOKEN1>,<TOKEN2> replaced by your real CrowdSec tokens, which are the secret keys it uses to talk to your CrowdSec account. If you leave the placeholders in, the bouncer cannot ask CrowdSec who to block, so your setup will not protect anything. source
  • Edit the generated config before starting The command writes a YAML config (a plain-text settings file), usually under /etc/crowdsec/bouncers/. Edit it to match your CrowdSec endpoint, tokens, and other settings before starting the service; if the file is wrong or incomplete, the bouncer may start but still fail to enforce bans. source
  • Use sudo and start the service Run the install and start steps with sudo, which asks for admin rights, because the bouncer writes to /etc and may use systemd (the Linux service manager). If you skip sudo or never start the service, installation can fail with permission errors or the bouncer will not keep running in the background. source

Fetched 10 days ago - each note links to its source

Alternatives (6)

  • Caddy - Caddy is an extensible web server and reverse proxy that serves Transport Layer Security (TLS) by default, making it simple to secure and r…
  • Fossorial Pangolin - Open-source identity-based remote access platform using WireGuard, offering unified management, tunneled connections, granular access contr…
  • Haproxy - HAProxy is a TCP proxy and a HTTP reverse proxy.
  • Nginx Proxy Manager - Nginx Proxy Manager is a self-hosted reverse proxy and web server that lets you expose home or small-office applications to the internet wi…
  • nginx - Nginx is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy, and mail proxy server.
  • traefik - Traefik is a modern HTTP reverse proxy and load balancer that integrates with Docker, Kubernetes, and other container orchestrators to conf…

Checked 7 days ago - source: AlternativeTo

Common questions

What connectivity is required when hosting the fbonalair Traefik bouncer container?

The bouncer must be able to reach CrowdSec and must also be reachable by Traefik.

Do older guides that mention ForwardAuth or cloudFlareIPs still match current Traefik bouncer setup?

No, the source notes that ForwardAuth is gone and there are no more cloudFlareIPs entries in Traefik config files.

Should the bouncer use streaming mode for better performance?

Streaming mode is recommended for performance, with decisions updated every 60 seconds by default.

Should a CrowdSec bouncer be installed on every downstream web server instead of only Traefik?

It should usually run on the internet-facing main entrance, such as Traefik, rather than on every downstream web server. A router or firewall agent can be used if supported.

Answers sourced from discourse.crowdsec.net, github.com, www.reddit.com, www.reddit.com

Community

Collected 10 days ago - public community threads