# CrowdSec Manager for Pangolin: User Guide **URL:** \ **Category:** Firewalls & Security\ **Tags:** crowdsec, pangolin\ **Created:** [March 1, 2025, 4:31pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579 "2025-03-01T16:31:43Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 1, 2025, 4:31pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/1 "2025-03-01T16:31:43Z")
# From Bash Script to Web Application: The CrowdSec Manager Evolution ## Migration CrowdSec Manager has evolved from a command-line bash script into a full-featured web application. This migration represents a significant leap forward in usability, functionality, and maintainability. In this post, we’ll explore the journey, the improvements, and how to migrate from the old script-based approach to the new web-based solution. * * * ## The Evolution: Why We Migrated ### The Original Bash Script The original CrowdSec Manager was a comprehensive bash script (`setup_crowdsec_manager.sh`) that provided 15 menu-driven options for managing CrowdSec in a Pangolin Docker environment. While functional, it had limitations: - **Terminal-only interface** : Required SSH access and command-line knowledge - **Limited interactivity** : Menu-driven navigation with text prompts - **No persistent state** : Settings weren’t saved between sessions - **Manual log viewing** : Required terminal commands to view logs - **No real-time monitoring** : Static views of system status - **Limited automation** : Difficult to integrate with other tools ### The New Web Application The new CrowdSec Manager is a modern, full-stack application built with: - **Backend** : Go (Golang) with Gin web framework - **Frontend** : React 18 with TypeScript, Vite, and Shadcn/ui components - **Architecture** : RESTful API with WebSocket support for real-time features - **Database** : SQLite for persistent settings and configuration - **Deployment** : Docker container for easy deployment * * * ## Key Improvements ### 1. **Modern Web Interface** **Before (Bash Script):** ```bash =========================================== CrowdSec Manager - Main Menu =========================================== 1. Check System Health 2. Run Complete Diagnostic Check ... Enter your choice [0-15]: ``` **After (Web Application):** - Beautiful, responsive web UI accessible from any browser - Real-time dashboard with live status updates - Intuitive navigation with sidebar menu - Visual indicators for system health - Interactive charts and graphs for metrics ![Dashboard](https://forum-cdn.hhf.technology/original/2X/c/ce0d62695acc25a74e4829e9e144e9f63426ab55.png) ### 2. **Real-Time Features** **New Capabilities:** - **Live Log Streaming** : WebSocket-based real-time log viewing for all services - **Live Status Updates** : Automatic refresh of container status and metrics - **Real-Time Decision Monitoring** : Watch security decisions as they happen - **Live Alert Feed** : See security alerts in real-time **Before** : Static log viewing required manual terminal commands ```bash docker logs -f crowdsec ``` **After** : Click a button in the web UI to stream logs with automatic scrolling and filtering ### 3. **Enhanced IP Management** **New Features:** - **Visual IP Security Dashboard** : See all blocked IPs with reasons and timestamps - **Bulk Operations** : Manage multiple IPs at once - **IP History** : Track IP actions over time - **Advanced Filtering** : Search and filter decisions by type, reason, or date - **Quick Actions** : One-click unban, whitelist, or block operations **Before** : Manual IP entry through text prompts ```bash Enter IP to unban: 1.2.3.4 ``` **After** : Visual table with search, sort, and bulk actions ![IP Management](https://forum-cdn.hhf.technology/original/2X/9/989bbbd617920d1ff02e72cd38d043775600a57a.jpeg) ### 4. **Comprehensive Backup System** **New Capabilities:** - **Automated Backups** : Schedule backups with cron job integration - **Backup Management UI** : View, restore, and delete backups visually - **Retention Policies** : Automatic cleanup of old backups - **Backup Verification** : Check backup integrity before restoration - **One-Click Restore** : Restore entire system with a single click **Before** : Manual backup creation required script execution **After** : Automated scheduling with visual management interface ![Backup Management](https://forum-cdn.hhf.technology/original/2X/4/44320429c170bc2df0cd566412af8b0a804f4a22.jpeg) ### 5. **Advanced Log Analysis** **New Features:** - **Multi-Service Log Viewer** : View logs from CrowdSec, Traefik, Pangolin, and Gerbil - **Advanced Traefik Analysis** : Statistics, top IPs, status codes, and more - **Log Filtering** : Filter by service, date, or search term - **Export Capabilities** : Download logs for analysis - **Real-Time Streaming** : Watch logs as they’re generated **Before** : Separate commands for each service ```bash docker logs crowdsec --tail 50 docker logs traefik --tail 50 ``` **After** : Unified log viewer with tabs for each service and real-time streaming ![Logs Viewer](https://forum-cdn.hhf.technology/original/2X/8/877dcd7c9685a68bce8dde6645c4c7a558caf831.jpeg) ### 6. **Decision and Alert Analysis** **New Capabilities:** - **Decision Analysis Dashboard** : Visual breakdown of security decisions - **Alert Analysis** : Detailed analysis of CrowdSec alerts - **Trend Visualization** : See security trends over time - **Export Reports** : Generate reports for analysis **Before** : Simple list of blocked IPs **After** : Comprehensive analysis with charts and statistics ![Alert List Analysis](https://forum-cdn.hhf.technology/original/2X/f/f42ed88ba4c023c2879b0f930205013a45afa711.jpeg) ![Decision List Analysis](https://forum-cdn.hhf.technology/original/2X/a/a7375d294e4f63cd3727cee7d0470484412c5ddd.jpeg) ### 7. **Enhanced Configuration Management** **New Features:** - **Visual Configuration Editor** : Edit CrowdSec and Traefik configs through the UI - **Settings Persistence** : Save preferences and settings in database - **Configuration Validation** : Validate configs before applying - **Version History** : Track configuration changes **Before** : Manual file editing with vi/nano **After** : Web-based editor with syntax highlighting and validation ![Configuration](https://forum-cdn.hhf.technology/original/2X/e/ee4db75bfb943c08bf52605fdfe34744ad8941fd.jpeg) ### 8. **Service Management** **New Capabilities:** - **Service Control Panel** : Start, stop, restart services from the UI - **Service Health Monitoring** : Real-time status of all services - **Graceful Shutdown** : Safe shutdown procedures - **Service Dependencies** : Visual representation of service relationships ![Services Management](images/Services Management.png) ### 9. **Cron Job Management** **New Feature:** - **Visual Cron Editor** : Create and manage cron jobs through the UI - **Pre-configured Jobs** : Templates for common tasks - **Job History** : View execution history and logs ![Cron Job Management](images/Cron Job Management.png) ### 10. **System Updates** **New Capabilities:** - **Update Management UI** : Update Docker images with custom tags - **Rollback Support** : Automatic rollback on failure - **Update History** : Track update operations - **Flexible Updates** : Update with or without CrowdSec ![System Update](images/System Update.png) * * * ## Feature Comparison | Feature | Bash Script | Web Application | |---------|------------|-----------------| | **Interface** | Terminal menu | Modern web UI | | **Access** | SSH required | Browser from anywhere | | **Real-Time Logs** | Manual `docker logs -f` | WebSocket streaming | | **IP Management** | Text prompts | Visual table with search | | **Backup Management** | Manual script execution | Automated with UI | | **Log Analysis** | Basic tail commands | Advanced analysis with stats | | **Decision Analysis** | Simple list | Charts and trends | | **Configuration** | File editing | Web-based editor | | **Multi-User** | Single terminal session | Multiple concurrent users | | **Mobile Access** | Not practical | Responsive design | | **API Access** | N/A | Full REST API | | **Settings Persistence** | None | SQLite database | | **Automation** | Limited | Cron job integration | * * * ## Migration Guide ### For Existing Bash Script Users If you’re currently using the bash script version, here’s how to migrate: #### Step 1: Backup Your Current Setup ```bash # Create a backup of your current configuration ./setup_crowdsec_manager.sh # Select option for backup (if available) # Or manually backup: cp -r /root/config ./backup-config-$(date +%Y%m%d) ``` #### Step 2: Prepare for Migration ```bash # Ensure you have Docker and Docker Compose installed docker --version docker compose version # Create required directories sudo mkdir -p /root/config /root/config/traefik/logs mkdir -p ./backups ./data # Ensure the pangolin network exists docker network create pangolin ``` #### Step 3: Deploy the Web Application ```bash # Pull the latest image docker pull hhftechnology/crowdsec-manager:latest # Create docker-compose.yml (see README.md for full config) # Start the container docker compose up -d # Verify it's running docker ps | grep crowdsec-manager curl http://localhost:8080/health ``` #### Step 4: Access the Web Interface 1. Open your browser to `http://your-server-ip:8080` 2. Verify all services are running via the Dashboard 3. Whitelist your current IP (Whitelist Management page) 4. Review your existing configuration #### Step 5: Migrate Settings The web application will automatically detect your existing CrowdSec and Traefik configurations. However, you may want to: 1. **Review Whitelists** : Check that all whitelisted IPs are present 2. **Verify Scenarios** : Ensure custom scenarios are still active 3. **Check Captcha Setup** : Verify captcha configuration if previously set up 4. **Review Backups** : Create a new backup through the UI #### Step 6: Set Up Automation 1. **Configure Automated Backups** : Set up cron jobs through the Cron Management page 2. **Schedule Health Checks** : Use the API to set up monitoring 3. **Configure Alerts** : Set up notifications for critical events * * * ## API Access One of the major advantages of the new application is full API access. You can now integrate CrowdSec Manager with other tools: ### Example: Automated IP Whitelisting ```bash #!/bin/bash # Whitelist current IP automatically curl -X POST http://localhost:8080/api/whitelist/current \ -H "Content-Type: application/json" \ -d '{"add_to_crowdsec": true, "add_to_traefik": true}' ``` ### Example: Health Check Monitoring ```bash #!/bin/bash # Check system health and alert if issues found HEALTH=$(curl -s http://localhost:8080/api/health/complete) if echo "$HEALTH" | grep -q '"status":"error"'; then # Send alert notification echo "CrowdSec Manager health check failed!" fi ``` ### Example: Automated Backup ```bash #!/bin/bash # Create backup via API curl -X POST http://localhost:8080/api/backup/create \ -H "Content-Type: application/json" \ -d '{"dry_run": false}' ``` * * * ## Technical Architecture ### Backend (Go) - **Framework** : Gin web framework for high performance - **Docker Integration** : Direct Docker API access for container management - **Database** : SQLite for lightweight, file-based storage - **Logging** : Structured logging with configurable levels - **API** : RESTful API with comprehensive error handling ### Frontend (React) - **Framework** : React 18 with TypeScript - **Build Tool** : Vite for fast development and builds - **UI Components** : Shadcn/ui for modern, accessible components - **State Management** : TanStack Query for server state - **Routing** : React Router for navigation - **Styling** : Tailwind CSS for responsive design ### Key Technologies - **WebSockets** : Real-time log streaming and updates - **Docker API** : Direct container management - **File System Access** : Read/write configuration files - **Cron Integration** : Schedule automated tasks - **Backup System** : Comprehensive backup and restore * * * ## Benefits of the Migration ### For End Users 1. **Easier Access** : No SSH required, access from any browser 2. **Better UX** : Intuitive interface with visual feedback 3. **Real-Time Monitoring** : See what’s happening as it happens 4. **Mobile Friendly** : Responsive design works on phones/tablets 5. **Multi-User Support** : Multiple people can use it simultaneously ### For Administrators 1. **Better Monitoring** : Comprehensive dashboards and analytics 2. **Automation** : Cron job integration for scheduled tasks 3. **API Access** : Integrate with other tools and scripts 4. **Audit Trail** : Database tracks all operations 5. **Easier Maintenance** : Web-based configuration management ### For Developers 1. **Extensible** : Well-structured codebase for adding features 2. **API-First** : Full REST API for integration 3. **Modern Stack** : Go and React are industry-standard technologies 4. **Type Safety** : TypeScript prevents common errors 5. **Maintainable** : Clean architecture and separation of concerns * * * ## What’s Next? The migration to a web application opens up many possibilities: - **Mobile App** : Native mobile applications using the API - **Multi-Instance Support** : Manage multiple CrowdSec installations - **Advanced Analytics** : Machine learning for threat detection - **Integration Hub** : Connect with other security tools - **Notification System** : Email, Slack, Discord integrations - **Role-Based Access** : Multi-user with permissions - **Audit Logging** : Comprehensive audit trail - **Plugin System** : Extensible architecture for custom features * * * ## Conclusion The migration from bash script to web application represents a significant evolution in CrowdSec Manager. While the bash script served its purpose well, the new web application provides: - **Better User Experience** : Modern, intuitive interface - **More Features** : Real-time monitoring, advanced analysis, automation - **Better Integration** : API access for automation and tooling - **Easier Maintenance** : Web-based configuration and management - **Future-Proof** : Modern architecture ready for new features Whether you’re a long-time user of the bash script or new to CrowdSec Manager, the web application provides a superior experience for managing your CrowdSec security stack. * * * ## Getting Started Ready to make the switch? Check out the [README.md](https://github.com/hhftechnology/crowdsec_manager/blob/1627f15d0b3ca589a54fed8864fb00a14db9f9e5/README.md) for installation instructions and the [USAGE.md](https://github.com/hhftechnology/crowdsec_manager/blob/1627f15d0b3ca589a54fed8864fb00a14db9f9e5/USAGE.md) for detailed usage guide. **Important** : This is currently BETA software. Always test on a non-production environment first! * * * ## Support - **Issues** : [GitHub Issues](https://github.com/hhftechnology/crowdsec_manager/issues) - **Discussions** : [GitHub Discussions](https://github.com/hhftechnology/crowdsec_manager/discussions) * * * **Built with ❤ for the CrowdSec community** ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 1, 2025, 10:26pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/2 "2025-03-01T22:26:38Z")
Will update more features to this script later this month. It’s an evolved version of the trouble shooting script. ---
**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\ **Post date:** [March 5, 2025, 1:30am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/3 "2025-03-05T01:30:59Z")
When I run this directly after a `sudo docker compose up -d` command on my Pangolin VPS, I get a notice saying that traefik container is NOT running… user@vps:~# sudo docker compose up -d [+] Running 5/5 ✔ Network pangolin Created ✔ Container crowdsec Started ✔ Container pangolin Healthy ✔ Container gerbil Started ✔ Container traefik Started user@vps:~# sudo ./crowdsec-manager.sh /====================================================================== CHECKING PREREQUISITES /====================================================================== [+] Docker is running [+] crowdsec container is running [-] traefik container is NOT running [\*] Temporary files cleaned up. ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 5, 2025, 1:59am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/4 "2025-03-05T01:59:31Z")
I am working on a fix. Please wait ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 5, 2025, 5:44am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/5 "2025-03-05T05:44:10Z")
error resolved please try and let me know. ---
**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\ **Post date:** [March 5, 2025, 5:24pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/6 "2025-03-05T17:24:21Z")
Working now, thank you for all you do! ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 6, 2025, 11:01am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/7 "2025-03-06T11:01:48Z")
Polished few bugs today also. ---
**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\ **Post date:** [March 8, 2025, 12:12am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/9 "2025-03-08T00:12:05Z")
I’m being banned 100% of the time: ```auto crowdsec | time="2025-03-08T00:05:57Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:57 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 1.796826ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:57Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:57 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 2.029658ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:58Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:58 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 2.578648ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:58Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:58 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 2.18327ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:58Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:58 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 3.558341ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:58Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:58 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 1.545924ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:58Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:58 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 4.6205ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" crowdsec | time="2025-03-08T00:05:59Z" level=info msg="172.18.0.6 - [Sat, 08 Mar 2025 00:05:59 UTC] \"GET /v1/decisions?ip=&banned=true HTTP/1.1 403 1.282028ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \"" ``` I’ve made sure that I’m whitelisted: ```auto [+] crowdsec container is running [+] IP is NOT currently blocked by CrowdSec. [+] IP is whitelisted in Traefik configuration (likely part of a subnet). ``` Thoughts? I recently followed your iptables advice (in another thread)… that shouldn’t have any impact here since I’m seeing it logged in Crowdsec, but figured I’d point it out anyhow… ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 8, 2025, 12:32am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/10 "2025-03-08T00:32:02Z")
Your bounce is not registered or keys don’t match. ```bash docker exec crowdsec cscli bouncers list docker exec crowdsec cscli bouncers delete traefik-bouncer docker exec crowdsec cscli bouncers add traefik-bouncer ``` ---
**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\ **Post date:** [March 8, 2025, 1:01am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/11 "2025-03-08T01:01:35Z")
> [@hhf.technoloy](#): > > `docker exec crowdsec cscli bouncers add traefik-bouncer` It does say “valid” and I had already tried deleting and re-adding the bouncer. Tried again now and no dice. Could it be an iptables issue with fail2ban or geoblocking? I mostly followed your guide here: [Discord](https://discord.com/channels/1325658630518865980/1347580150791016448) \< could this be an issue at all? ```auto INPUT DROP [4571:309566] -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -m tcp --dport 42522 -j ACCEPT -A INPUT -p udp -m udp --dport 51820 -j ACCEPT # Wireguard -A INPUT -p udp -m udp --dport 17072 -j ACCEPT # Wireguard -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT # Crowdsec -A INPUT -p tcp -m tcp --dport 6060 -j ACCEPT # Crowdsec metrics -A INPUT -p tcp -m tcp --dport 7422 -j ACCEPT # Crowdsec AppSec endpoint -A INPUT -i docker0 -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -i docker0 -o docker0 -j ACCEPT -A FORWARD -i docker0 -o eth0 -j ACCEPT -A FORWARD -i eth0 -o docker0 -j ACCEPT -A OUTPUT -m conntrack --ctstate INVALID -j DROP ``` ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 8, 2025, 4:24am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/12 "2025-03-08T04:24:36Z")
Fail2ban for sure. Please remove it. ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 10, 2025, 4:57pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/13 "2025-03-10T16:57:24Z")
> "If you encounter issues adding IP addresses to your CrowdSec whitelist through the usual methods (e.g., using a management interface), you can manually edit the whitelist configuration file and restart CrowdSec. Here’s an example configuration: ```yaml name: crowdsecurity/my-whitelists description: "Whitelist events from my IPv4 addresses" whitelist: reason: "My IPv4 ranges" ip: - "51.20.140.83" # Added by IP Shield - "10.0.0.88" # Added by IP Shield - "127.0.0.1" cidr: - "65.36.22.25/32" # Added by IP Shield - "192.168.0.0/16" - "10.0.0.0/8" - "172.16.0.0/12" expression: - evt.Parsed.source_ip == '127.0.0.1' - evt.Parsed.source_ip contains '172.17.' ``` > Remember to restart the CrowdSec service after making changes to the configuration file for them to take effect." ```auto docker compose restart crowdsec ``` ---
**Author:** ![Cantello](https://forum.hhf.technology/user_avatar/forum.hhf.technology/cantello/32/1082_2.png) [@Cantello](https://forum.hhf.technology/u/Cantello)\ **Post date:** [March 20, 2025, 9:56am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/16 "2025-03-20T09:56:46Z")
Crowdsec is running, yet the script does not detect it. What could I do to have the container recognized? ```auto [opc@debian ~]$ docker compose up -d --remove-orphans [+] Running 5/5 ✔ Container backrest Running 0.0s ✔ Container crowdsec Running 0.0s ✔ Container pangolin Healthy 1.0s ✔ Container gerbil Running 0.0s ✔ Container traefik Running 0.0s ``` ```auto ====================================================================== CHECKING PREREQUISITES ====================================================================== [+] Docker is running [-] CrowdSec container does not exist. Please ensure it's created. [!] You may need to run your docker-compose first. [*] Temporary files cleaned up. ``` ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 20, 2025, 10:01am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/17 "2025-03-20T10:01:19Z")
> [@hhf.technoloy](#): > > `sudo apt install grep gawk sed tar` `sudo apt install grep gawk sed tar` Run the above command and try. Which is your OS Version? ---
**Author:** ![Cantello](https://forum.hhf.technology/user_avatar/forum.hhf.technology/cantello/32/1082_2.png) [@Cantello](https://forum.hhf.technology/u/Cantello)\ **Post date:** [March 20, 2025, 10:05am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/18 "2025-03-20T10:05:59Z")
> [@hhf.technoloy](#): > > `sudo apt install grep gawk sed tar` Thanks for the quick answer - it’s still the same. But this is my mistake, I’m on Oracle Linux and I read too quickly and missed the Debian & derivatives prerequisite… 🙂 ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 20, 2025, 10:09am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/19 "2025-03-20T10:09:25Z")
I don’t have oracle linux. so didn’t test on it. No issues. Use the bot instead [Pangolin Discord bot to Manage the stack](https://forum.hhf.technology/t/pangolin-discord-bot-to-manage-the-stack/816/14) If you just need crowdsec management then use `hhftechnology/pangolin-discord-bot:crowdsec` ---
**Author:** ![manilx](https://forum.hhf.technology/user_avatar/forum.hhf.technology/manilx/32/983_2.png) [@manilx](https://forum.hhf.technology/u/manilx)\ **Post date:** [March 20, 2025, 10:36am UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/20 "2025-03-20T10:36:13Z")
I have the same issue running on Debian 12. Not detecting crowdsec. ` apt install grep gawk sed tar` has been run ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [March 20, 2025, 12:48pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/21 "2025-03-20T12:48:15Z")
share your `docker ps` and did you run `sudo apt update && sudo apt upgrade -y ` ? ---
**Author:** ![manilx](https://forum.hhf.technology/user_avatar/forum.hhf.technology/manilx/32/983_2.png) [@manilx](https://forum.hhf.technology/u/manilx)\ **Post date:** [March 20, 2025, 1:28pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/22 "2025-03-20T13:28:22Z")
`sudo apt update && sudo apt upgrade -y ` has been performed ```auto 6f2c4b4d3f47 traefik:latest "/entrypoint.sh --co…" About a minute ago Up About a minute traefik 8f49d4f5074c fosrl/gerbil:latest "/entrypoint.sh --re…" About a minute ago Up About a minute 0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:51820->51820/udp, [::]:51820->51820/udp gerbil bef78c75814b fosrl/pangolin:latest "docker-entrypoint.s…" About a minute ago Up About a minute (healthy) pangolin 5a06ba1d80c2 crowdsecurity/crowdsec:latest "/bin/bash /docker_s…" About a minute ago Up About a minute (healthy) 0.0.0.0:6060->6060/tcp, [::]:6060->6060/tcp crowdsec b5ebb601e9ec portainer/portainer-ce:latest "/portainer" 33 hours ago Up 2 hours 8000/tcp, 9000/tcp, 0.0.0.0:9443->9443/tcp, [::]:9443->9443/tcp portainer b79bdc4f4d1c portainer/agent:latest "./agent" 33 hours ago Up 2 hours 0.0.0.0:9001->9001/tcp, [::]:9001->9001/tcp portainer_agent 1c75e4361c66 henrygd/beszel-agent "/agent" 4 days ago Up 2 hours beszel-agent 72e965180b63 louislam/dockge:1 "/usr/bin/dumb-init …" 2 weeks ago Up 2 hours (healthy) 0.0.0.0:5001->5001/tcp, [::]:5001->5001/tcp dockge 234265b03979 rustdesk/rustdesk-server:latest "hbbs -r rust.manilx…" 2 weeks ago Up 2 hours 0.0.0.0:21115-21116->21115-21116/tcp, [::]:21115-21116->21115-21116/tcp, 0.0.0.0:21116->21116/udp, [::]:21116->21116/udp hbbs dc7b605b61d8 rustdesk/rustdesk-server:latest "hbbr -k a37AQsWJwuL…" 2 weeks ago Up 2 hours 0.0.0.0:21117->21117/tcp, [::]:21117->21117/tcp hbbr 0bf348f470e6 containrrr/watchtower "/watchtower" 4 weeks ago Up 2 hours (healthy) 8080/tcp watchtower ``` ---
**Author:** ![manilx](https://forum.hhf.technology/user_avatar/forum.hhf.technology/manilx/32/983_2.png) [@manilx](https://forum.hhf.technology/u/manilx)\ **Post date:** [March 20, 2025, 1:35pm UTC](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579/23 "2025-03-20T13:35:05Z")
```auto └─# ./setup_crowdsec_manager.sh % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 128k 100 128k 0 0 377k 0 --:--:-- --:--:-- --:--:-- 376k % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 4066 100 4066 0 0 12722 0 --:--:-- --:--:-- --:--:-- 12746 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1860 100 1860 0 0 6627 0 --:--:-- --:--:-- --:--:-- 6642 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 2842 100 2842 0 0 9956 0 --:--:-- --:--:-- --:--:-- 9937 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 11989 100 11989 0 0 45960 0 --:--:-- --:--:-- --:--:-- 46111 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 3526 100 3526 0 0 14055 0 --:--:-- --:--:-- --:--:-- 14104 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 15554 100 15554 0 0 59171 0 --:--:-- --:--:-- --:--:-- 59140 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 8864 100 8864 0 0 9170 0 --:--:-- --:--:-- --:--:-- 9175 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 2315 100 2315 0 0 1930 0 0:00:01 0:00:01 --:--:-- 1932 ====================================================================== CHECKING PREREQUISITES ====================================================================== [+] Docker is running [-] CrowdSec container does not exist. Please ensure it's created. [!] You may need to run your docker-compose first. [*] Temporary files cleaned up. ``` [Next page](https://forum.hhf.technology/t/crowdsec-manager-for-pangolin-user-guide/579.md?page=2)