This guide provides an alternative approach to the community guide by using Traefik access logs instead of Syslog or Journalctl. This method allows CrowdSec to analyze requests directly from Traefik’s access log output, which can simplify the setup in containerized environments and avoid relying on host-level logging systems.

1. Make sure Traefik is writing to access.log file

1. Open your pangolin's traefik's configuration file, for example mine is /docker/pangolin/traefik/traefik.yml
2. Add this block anywhere:

   accessLog:
     filePath: "/var/log/traefik/access.log"
     bufferingSize: 100
     format: common
   

3. The block is a first level block, so if you put it near the log block it will look like this:

   log:
     level: INFO
     format: common
   
   accessLog:
     filePath: "/var/log/traefik/access.log"
     bufferingSize: 100
     format: common
   

4. Create the log folder on the host, for example:
   sudo mkdir /docker/pangolin/traefik/logs
5. Then map the folder in Traefik compose:

   services:
     traefik:
       volumes:
         - /docker/pangolin/traefik/logs:/var/log/traefik
   

6. Redeploy with sudo docker compose down and sudo docker compose up so the newly mapped folder work in Traefik
7. Verify logs exist with sudo docker exec -it traefik ls /var/log/traefik it should return access.log
8. You can see the logs with sudo docker exec -it traefik tail -f /var/log/traefik/access.log

2. Install CrowdSec

1. Create the neccessary folders (data and config) for CrowdSec, for example
   sudo mkdir -p /docker/pangolin/crowdsec/{data,config}
2. Add CrowdSec to your Pangolin compose stack, do not forget to map the Traefik access.log location:

   services:
     crowdsec:
       image: crowdsecurity/crowdsec:latest-debian
       container_name: crowdsec
       restart: unless-stopped
       environment:
         COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/linux crowdsecurity/iptables
         ACQUIRE_FILES: /var/log/traefik/access.log
       volumes:
         - /docker/pangolin/crowdsec/data:/var/lib/crowdsec/data
         - /docker/pangolin/crowdsec/config:/etc/crowdsec
         - /docker/pangolin/traefik/logs:/var/log/traefik:ro # this is the trafik log location
   

3. Run it using sudo docker compose down and sudo docker compose up

3. Allow CrowdSec to acquire and parse Traefik log file

1. Stop CrowdSec container
2. Edit the acquis.yaml file in /docker/pangolin/crowdsec/acquis.yaml
3. Remove (or comment out) everything then add this:

   filenames:
     - /var/log/traefik/access.log
   labels:
     type: traefik
   

4. Restart Traefik container
5. Check if the metrics works:
   sudo docker exec -it crowdsec cscli metrics
6. You should see something like this:

   Acquisition Metrics
   ┌─────────────────────────────┬──────────┬──────────┐
   │ Source                      │ Lines    │ Parsed   │
   ├─────────────────────────────┼──────────┼──────────┤
   │ /var/log/traefik/access.log │ 1500     │ 1500     │
   └─────────────────────────────┴──────────┴──────────┘
   

4. Connect Traefik with CrowdSec

1. Stop Traefik container
2. Add CrowdSec bouncer to Traefik static file in /docker/pangolin/traefik/traefik.yml:

   experimental:
     plugins:
       badger:
         moduleName: github.com/fosrl/badger
         version: v1.3.1
       crowdsec-bouncer:
         moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
         version: v1.5.1 # <<<<< latest version when I wrote this guide
   

3. Also add CrowdSec middleware to the static file in the websecure entrypoint:

   entryPoints:
     web:
       address: ':80'
     websecure:
       address: ':443'
       transport:
         respondingTimeouts:
           readTimeout: 30m
       http:
         tls:
           certResolver: cloudflare
         middlewares: # <<<<< add here
           - crowdsec@file
   

4. Get a CrowdSec api key for Traefik by running this:
   sudo docker exec -it crowdsec cscli bouncers add traefik
5. Add CrowdSec bouncer to Traefik's dynamic config, mine is in /docker/pangolin/traefik/rules/dynamic_config.yml:

   http:
     middlewares:
       crowdsec:
         plugin:
           crowdsec-bouncer:
             enabled: true
             crowdsecLapiKey: YOUR_API_KEY
             crowdsecLapiHost: crowdsec:8080
   

6. Restart them all with sudo docker compose down and sudo docker compose up

5. Testing time!

1. Test bans with sudo docker exec -it crowdsec cscli decisions list
2. You will start seeing IP bans like this:

   ╭────┬──────────┬───────────────────┬────────────────────────────────────────────┬────────┬─────────┬──────────────────────────────────┬────────┬────────────┬──────────╮
   │ ID │  Source  │    Scope:Value    │                   Reason                   │ Action │ Country │                AS                │ Events │ expiration │ Alert ID │
   ├────┼──────────┼───────────────────┼────────────────────────────────────────────┼────────┼─────────┼──────────────────────────────────┼────────┼────────────┼──────────┤
   │ 6  │ crowdsec │ Ip:4.204.200.32   │ crowdsecurity/http-probing                 │ ban    │ CA      │ 8075 MICROSOFT-CORP-MSN-AS-BLOCK │ 11     │ 3h59m46s   │ 6        │
   │ 5  │ crowdsec │ Ip:136.0.213.103  │ crowdsecurity/http-probing                 │ ban    │ US      │                                  │ 11     │ 3h58m48s   │ 5        │
   │ 1  │ crowdsec │ Ip:151.145.54.165 │ crowdsecurity/http-admin-interface-probing │ ban    │ CA      │ 31898 ORACLE-BMC-31898           │ 3      │ 3h19m33s   │ 1        │
   ╰────┴──────────┴───────────────────┴────────────────────────────────────────────┴────────┴─────────┴──────────────────────────────────┴────────┴────────────┴──────────╯
   

3. Try to add your own IP from access, first get your own IP in sites like https://whatismyipaddress.com/
4. Add your IP to temporary ban:
   sudo docker exec crowdsec cscli decisions add --ip YOUR_IP_HERE -d 5m
5. You can check that your IP have been added to the ban list with sudo docker exec -it crowdsec cscli decisions list, it should look like this:

   ╭─────┬──────────┬───────────────────┬────────────────────────────────────────────┬────────┬─────────┬──────────────────────────────────┬────────┬────────────┬──────────╮
   │  ID │  Source  │    Scope:Value    │                   Reason                   │ Action │ Country │                AS                │ Events │ expiration │ Alert ID │
   ├─────┼──────────┼───────────────────┼────────────────────────────────────────────┼────────┼─────────┼──────────────────────────────────┼────────┼────────────┼──────────┤
   │ 182 │ cscli    │ Ip:YOUR_IP_HERE   │ manual 'ban' from 'localhost'              │ ban    │         │                                  │ 1      │ 4m54s      │ 182      │
   ╰─────┴──────────┴───────────────────┴────────────────────────────────────────────┴────────┴─────────┴──────────────────────────────────┴────────┴────────────┴──────────╯
   

6. Now your ip is banned for the next 5 minutes. If you open a private browser and try to access any of your subdomain you will get a 403 error.

via GIPHY