Docker-Compose/Proxy_Containers/traefik/README.md

Source: https://traefik.io/
https://github.com/traefik/traefik

Prerequisites:

To use this docker compose yaml file you will need:
Cloudflare DNS API TOKEN
Running container of docker-socket-proxy
Running container of crowdsec

Guide:

1. Start the docker-socket-proxy container
2. Get your Cloudflare DNS Zone Edit API TOKEN
3. Start your traefik compose.yaml (see .env and fill in the DNS API Token, skip the bouncer API for now)
4. Start your CrowdSec container
5. Generate the Bouncer API Key with: docker exec crowdsec cscli bouncers add traefik-bouncer
   NOTE: Make sure there are no special characters. If it contains anything other than [a-z A-Z 0-9], delete and regenerate:
   docker exec crowdsec cscli bouncers delete traefik-bouncer
docker exec crowdsec cscli bouncers add traefik-bouncer
6. Put the output in your .env under CROWDSEC_BOUNCER_API_KEY
7. Restart traefik container

Verifying:

1. Confirm CrowdSec Is Parsing Traefik Logs: docker exec crowdsec cscli metrics
2. docker logs traefik 2>&1 | grep -i "crowdsec|plugin|error" | tail -20
3. docker exec crowdsec cscli bouncers list
4. docker logs traefik 2>&1 | tail -30
5. docker exec crowdsec cscli metrics | grep -A8 "Local API Metrics" You should see /v1/decisions/stream hits incrementing. If that's clean, the stack is fully operational.

Testing:

Test CrowdSec Is Actually Blocking
Ban your own IP: docker exec crowdsec cscli decisions add --ip <your-ip>
Go to one of URLs
Note: using crowdsecMode: stream, decisions sync every 60 seconds — so the ban may take up to a minute to take effect
Unban yourself: docker exec crowdsec cscli decisions delete --ip <your-ip>