CrowdSec
CrowdSec: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/core/perimeter-protection. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
CrowdSec analyzes supported logs for suspicious behavior. Start with its official Docker setup and a copied, sanitized sample log. The Security Engine detects and produces decisions; blocking requires a compatible remediation component, often called a bouncer. Installing the engine alone does not prove traffic is blocked.
Settings and data
Persist engine configuration and state. Configure acquisition for the log format actually produced by the gateway, then select the matching parser/collection. Mount only necessary logs read-only. Keep local API credentials and remediation credentials separate and private.
Check it
Check acquisition/parser metrics using the documented cscli commands. First prove that lines are read and parsed. Then test one controlled decision against a disposable client through the documented remediation test, keeping an independent administrative recovery path.
When something fails
No alerts may mean no input, wrong parser, or no triggering behavior; it is not proof of safety. False positives require checking the matched scenario and client-IP handling. Never trust arbitrary forwarded IP headers. Record how to remove a test decision and how to recover from blocking yourself before enforcing policies.