crowdsec

The crowdsec role installs CrowdSec and its iptables firewall bouncer (crowdsec-firewall-bouncer-iptables) from the official repository.

What it does

• Adds the CrowdSec apt repository. The downloaded signing key must carry crowdsec_apt_key_fingerprint; if it does not, the run stops and the key file is removed.
• Checks that every entry of security_allowlist and crowdsec_allowlist is an IP address or CIDR.
• Installs the collections in crowdsec_collections (crowdsecurity/linux, crowdsecurity/sshd). Collections you installed otherwise are left alone.
• Writes one acquisition file per entry of crowdsec_acquisitions in /etc/crowdsec/acquis.d (noixdev-<name>.yaml) and deletes files of entries you removed. The default reads the journal of ssh.service.
• Removes the setup.*.yaml files the package generates on first install (crowdsec_remove_setup_acquisitions), so no log is read twice and every failure is counted once.
• Writes a whitelist parser from the allowlists.
• Registers the bouncer once as crowdsec_bouncer_name. Its API key is kept only in the bouncer’s configuration and never appears in the output.

The bouncer and Docker

The bouncer blocks in the INPUT chain and, when Docker is present, in DOCKER-USER. That second chain matters because ports published by containers bypass INPUT.

crowdsec_bouncer_docker_user decides:

• unset (default): guard DOCKER-USER only if /usr/bin/docker exists when the role runs;
• true or false: force it on or off.

With DOCKER-USER on, the bouncer starts after docker.service.

Key variables

Variable	Default	Meaning
security_allowlist	[]	Management networks never banned. Shared with fail2ban. See the lockout guard.
crowdsec_allowlist	[]	Further addresses never banned on this host.
crowdsec_collections	linux, sshd	Hub collections that must be installed.
crowdsec_acquisitions	the ssh.service journal	Log sources. Keep at least one; CrowdSec does not start without.
crowdsec_bouncer_docker_user	unset	Also block in DOCKER-USER.
crowdsec_lapi_port	8080	Local API port on 127.0.0.1. Change it when the host publishes 8080 itself.
crowdsec_console_enroll_key	empty	Enrolls the instance in the CrowdSec console.
crowdsec_console_name	inventory_hostname_short	Instance name in the console.

All variables: crowdsec in the reference.

Example

- hosts: servers
  become: true
  vars:
    security_allowlist: [192.0.2.0/24, 2001:db8::/32]
  roles:
    - noixdev.infra.base
    - noixdev.infra.docker
    - noixdev.infra.crowdsec

Reading Traefik access logs

Traefik must write its access log to a file on the host (it does not by default). Add the collection and a file source:

crowdsec_collections:
  - crowdsecurity/linux
  - crowdsecurity/sshd
  - crowdsecurity/traefik
crowdsec_acquisitions:
  - name: sshd
    source: journalctl
    journalctl_filter: [_SYSTEMD_UNIT=ssh.service]
    labels: { type: syslog }
  - name: traefik
    source: file
    filenames: [/opt/traefik/logs/access.log]
    labels: { type: traefik }

Each acquisition entry is a name plus the keys CrowdSec expects (source, filenames or journalctl_filter, labels).

Console enrollment

Set crowdsec_console_enroll_key (from the CrowdSec console) to enroll the instance once. Accept it in the console afterwards. Until you do, every run tries again and reports a change. Keep the key in a vault.

Gotchas

• Run docker before crowdsec. With crowdsec_bouncer_docker_user unset, the role looks for the Docker binary at that moment. Set it to true explicitly if the order cannot be guaranteed.
• Fill security_allowlist first. See the lockout guard.
• Keep at least one acquisition. Without a log source CrowdSec does not start.
• Port 8080 is used by the Local API on 127.0.0.1. Change crowdsec_lapi_port if something else on the host publishes 8080.