Protecting Traefik with Coolify (note-to-self) 📝
ℹ️ This is a draft. Add crowdsec repos curl -s https://install.crowdsec.net | sudo sh instal IP tables bouncer as from 2026-07-21 - Coolify-Crowdsec create appsec.yml appsec_configs : - crowdsecurity/appsec-default labels : type : appsec listen_addr : 0.0.0.0:7422 source : appsec create docker.yml source : docker use_container_labels : true create syslog.yml filenames: - /var/log/auth.log -…
This draft outlines the steps to protect Traefik using Coolify and Crowdsec. The draft was written on 2026-07-21.
First, install the Crowdsec repositories using the command `curl -s https://install.crowdsec.net | sudo sh`. Next, enable necessary services in Docker compose files, `compose.yml`, `docker.yml`, and `syslog.yml`.
Map the log files for Crowdsec: `/var/log/auth.log` to `/var/log/auth.log:ro`, `/var/log/syslog` to `/var/log/syslog:ro`, and `/var/run/docker.sock` to `/var/run/docker.sock:ro`.
Set up the environment by adding `COLLECTIONS=crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux crowdsecurity/appsec-generic-rules crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs` to the environment variable.
To enable local bouncers, open port `127.0.0.1:9876:8080` in the firewall. Then, add bouncer configurations for iptables in Traefik service.
Configure Traefik to use Crowdsec by setting the following labels: `traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true`, `traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecAppsecEnabled=true`, `traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecAppsecHost=crowdsec:7422`, and `traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiKey=FWOpKKSt7dVCtqGUwqPetwafMFQw22yCz137emE01nk`.
Finally, enable Crowdsec for Traefik by setting `crowdsec.enable=true` and add the necessary plugin configurations.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
