diff --git a/Proxy_Containers/traefik/README.md b/Proxy_Containers/traefik/README.md index dbd6f43..81fbf41 100644 --- a/Proxy_Containers/traefik/README.md +++ b/Proxy_Containers/traefik/README.md @@ -21,23 +21,16 @@ Running container of [crowdsec](https://scripts.gabesville.com/Gabesville/Docker ### Verifying: 1. Confirm CrowdSec Is Parsing Traefik Logs: `docker exec crowdsec cscli metrics` +2. docker logs traefik 2>&1 | grep -i "crowdsec\|plugin\|error" | tail -20 +3. docker exec crowdsec cscli bouncers list +4. docker logs traefik 2>&1 | tail -30 +5. docker exec crowdsec cscli metrics | grep -A8 "Local API Metrics" +You should see /v1/decisions/stream hits incrementing. If that's clean, the stack is fully operational. ### Testing: -Test CrowdSec Is Actually Blocking -Ban your own IP -docker exec crowdsec cscli decisions add --ip -Unban yourself -docker exec crowdsec cscli decisions delete --ip -docker logs traefik 2>&1 | grep -i "crowdsec\|plugin\|error" | tail -20 - -docker exec crowdsec cscli bouncers list -docker logs traefik 2>&1 | tail -30 -docker exec crowdsec cscli bouncers delete traefik-bouncer - - -docker exec crowdsec cscli metrics | grep -A8 "Local API Metrics" -You should see /v1/decisions/stream hits incrementing. If that's clean, the stack is fully operational. - -One Thing to Note -Since you're using crowdsecMode: stream, decisions sync every 60 seconds — so the ban may take up to a minute to take effect after step 2. If you want instant testing, temporarily switch to crowdsecMode: live in config.yaml, test, then switch back to stream. \ No newline at end of file +Test CrowdSec Is Actually Blocking \ +Ban your own IP: `docker exec crowdsec cscli decisions add --ip ` \ +Go to one of URLs \ +Note: using crowdsecMode: stream, decisions sync every 60 seconds — so the ban may take up to a minute to take effect \ +Unban yourself: `docker exec crowdsec cscli decisions delete --ip ` \ No newline at end of file