DEV Community

May
May

Posted on

Protecting Traefik with Coolify (note-to-self) 📝

#security

ℹ️ This is a draft.

Add crowdsec repos

curl -s https://install.crowdsec.net | sudo sh
Enter fullscreen mode Exit fullscreen mode

create appsec.yml

appsec_configs:
  - crowdsecurity/appsec-default
labels:
  type: appsec
listen_addr: 0.0.0.0:7422
source: appsec
Enter fullscreen mode Exit fullscreen mode

create docker.yml

source: docker
use_container_labels: true
Enter fullscreen mode Exit fullscreen mode

create syslog.yml

filenames:
 - /var/log/auth.log
 - /var/log/syslog
labels:
  type: syslog
Enter fullscreen mode Exit fullscreen mode

Compose

Edit compose.yml

Crowdsec service

for crowdsec edit volumes and add there folloin files

volumes:
  - ./appsec.yaml:/etc/crowdsec/acquis.d/appsec.yaml
  - ./syslog.yaml:/etc/crowdsec/acquis.d/syslog.yaml
  -  ./docker.yaml:/etc/crowdsec/acquis.d/docker.yaml
Enter fullscreen mode Exit fullscreen mode

Map log fies for crowdsec

- /var/log/auth.log:/var/log/auth.log:ro
- /var/log/syslog:/var/log/syslog:ro
- /var/run/docker.sock:/var/run/docker.sock:ro # to allow read docker logs
Enter fullscreen mode Exit fullscreen mode

Edit Environment ad add following colections:

environment:
      - 'COLLECTIONS=crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux crowdsecurity/appsec-generic-rules crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs'
Enter fullscreen mode Exit fullscreen mode

To allow connection from local bouncers (otuside docker) add

ports:
      - 127.0.0.1:9876:8080 # port mapping for local firewall bouncers
Enter fullscreen mode Exit fullscreen mode

and setup boincer for iptables (for xexample) as in 2026-07-21 - Protecting Traefik with Coolify

Traefik service

edit labels and add

# Crowdsec
      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecAppsecEnabled=true"
      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecAppsecHost=crowdsec:7422"
      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiKey=FWOpKKSt7dVCtqGUwqPetwafMFQw22yCz137emE01nk"
      - crowdsec.enable=true
      - crowdsec.labels.type=traefik
Enter fullscreen mode Exit fullscreen mode

edit command as in 2026-07-21 - Protecting Traefik with Coolify

And dd there

- "--experimental.plugins.bouncer.moduleName=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
      - "--experimental.plugins.bouncer.version=v1.6.0"
Enter fullscreen mode Exit fullscreen mode

Top comments (0)