Home Linux Stuff

SYS:ONLINE

Fleet-Wide Intrusion Prevention: Deploying CrowdSec with Docker, Caddy & Firewall Bouncers

Oct 25, 2026

2 min read

Legacy intrusion prevention tools like Fail2ban operate in total isolation: an attacker scanning one server is only banned after repeated failed attempts, and the ban is never shared with the rest of your infrastructure. CrowdSec modernizes intrusion prevention by pairing open-source behavioral log analysis with a global collaborative threat intelligence network. When an IP attacks any CrowdSec user worldwide, it is flagged across the entire community network before it ever reaches your infrastructure. This guide details deploying CrowdSec in Docker, configuring log acquisition for SSH and Caddy, and enforcing network-wide bans via host firewall bouncers.

⚡ Quick Runbook: Production Docker Compose Deployment

Deploy the CrowdSec Local API (LAPI) and log parser stack with Caddy integration:

# /opt/stacks/crowdsec/compose.yaml
services:
  crowdsec:
    image: crowdsecurity/crowdsec:v1.6.3
    container_name: crowdsec
    restart: unless-stopped
    environment:
      - GID=1000
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/sshd crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
    volumes:
      - /opt/stacks/crowdsec/data:/var/lib/crowdsec/data
      - /opt/stacks/crowdsec/config:/etc/crowdsec
      - /var/log/auth.log:/var/log/auth.log:ro
      - /var/log/syslog:/var/log/syslog:ro
      - /opt/stacks/caddy/logs:/var/log/caddy:ro
    networks:
      - security-net
    ports:
      - "127.0.0.1:8080:8080"

networks:
  security-net:
    name: security-net

1. Configuring Log Acquisition (acquis.yaml)

Instruct CrowdSec which log streams to parse for malicious behavior. Create /opt/stacks/crowdsec/config/acquis.yaml:

# Host SSH authentication logs
filenames:
  - /var/log/auth.log
labels:
  type: syslog
---
# Caddy JSON structured access logs
filenames:
  - /var/log/caddy/access.log
labels:
  type: caddy

2. Installing the Host Firewall Bouncer (nftables / iptables)

While the CrowdSec container performs detection and decision-making, the bouncer enforces actual block rules on your host’s network interfaces via nftables:

# 1. Generate an API key inside the CrowdSec container
docker exec -t crowdsec cscli bouncers add host-firewall-bouncer

# Copy the generated API key string, then install the package on the host:
sudo apt-get update && sudo apt-get install -y crowdsec-firewall-bouncer-nftables

# 2. Configure the bouncer to connect to your local container LAPI
sudo tee /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml <<'CONFIG'
mode: nftables
api_url: http://127.0.0.1:8080/
api_key: 
inactivity_threshold: 10s
blacklists_ipv4: crowdsec-blacklists
blacklists_ipv6: crowdsec6-blacklists
CONFIG

# 3. Restart and verify the bouncer service
sudo systemctl restart crowdsec-firewall-bouncer
sudo systemctl status crowdsec-firewall-bouncer

3. Verification & Threat Inspection

Verify active log processing, scenario detections, and active IP decisions:

# Check log parsing metrics
docker exec -t crowdsec cscli metrics

# View active IP ban decisions
docker exec -t crowdsec cscli decisions list

# Inspect alert history
docker exec -t crowdsec cscli alerts list

# Test manual ban of a test IP (e.g., 198.51.100.42 for 15 minutes)
docker exec -t crowdsec cscli decisions add --ip 198.51.100.42 --duration 15m --reason "Manual Test"

# Verify nftables rule presence on the host
sudo nft list set inet crowdsec crowdsec-blacklists

Related Runbooks in This Series

Tags: