Docker-Compose/Proxy_Containers/traefik

Source: https://traefik.io/
https://github.com/traefik/traefik

Prerequisites:

To use this docker compose yaml file you will need:
Cloudflare DNS API TOKEN
Running container of docker-socket-proxy
Running container of crowdsec

Guide:

1. Start the docker-socket-proxy container
2. Get your Cloudflare DNS Zone Edit API TOKEN
3. Start your traefik compose.yaml (see .env and fill in the DNS API Token, skip the bouncer API for now)
4. Start your CrowdSec container
5. Generate the Bouncer API Key with: docker exec crowdsec cscli bouncers add traefik-bouncer
   NOTE: Make sure there are no special characters. If it contains anything other than [a-z A-Z 0-9], delete and regenerate:
   docker exec crowdsec cscli bouncers delete traefik-bouncer
docker exec crowdsec cscli bouncers add traefik-bouncer
6. Put the output in your .env under CROWDSEC_BOUNCER_API_KEY
7. Restart traefik container

Verifying:

1. Confirm CrowdSec Is Parsing Traefik Logs: docker exec crowdsec cscli metrics
2. Check the plugins for errors: docker logs traefik 2>&1 | grep -i "crowdsec\|plugin\|error" | tail -20
3. Shows bouncer list: docker exec crowdsec cscli bouncers list
4. Review all logs: docker logs traefik 2>&1 | tail -30
5. You should see /v1/decisions/stream hits incrementing: docker exec crowdsec cscli metrics | grep -A8 "Local API Metrics"

Testing:

Test CrowdSec Is Actually Blocking \

1. Ban your own IP: docker exec crowdsec cscli decisions add --ip <your-ip> \
2. Check your list of banned IPs: docker exec crowdsec cscli decisions list \
3. Go to one of URLs
   Note: using crowdsecMode: stream, decisions sync every 60 seconds — so the ban may take up to a minute to take effect \
4. Unban yourself: docker exec crowdsec cscli decisions delete --ip <your-ip>

Optional:

Setup CrowdSec Console (cloud)

1. Go to app.crowdsec.net and create a free account
2. Once signed in > Click "Engines" in the left sidebar
3. Click "Enroll a new engine" or "Enroll command"
4. Copy the key
5. Back on your server, run: docker exec crowdsec cscli console enroll <enrollment-key>
6. Restart crowdsec container
7. If you ever want to remove: docker exec crowdsec cscli console disable --all