How to Configure CrowdSec Manager on Pangolin to Read AdGuard Home Logs from Another Server?

General
2

Best approach: Install a lightweight CrowdSec Agent on your AdGuard Home server and connect it to the CrowdSec Manager (LAPI) on Pangolin.

This is the cleanest, most secure, and officially recommended way for multi-server setups.

Recommended Architecture

  • Pangolin server → Runs the full CrowdSec (LAPI + Manager + bouncer for Traefik).
  • AdGuard Home server → Runs only the CrowdSec Agent (parses logs locally) and forwards alerts/decisions to Pangolin’s LAPI.

Step-by-Step Setup

  1. On Pangolin Server (Manager/LAPI)

    • Make sure CrowdSec is installed and the Local API is listening.
    • Check/enable the API:
      docker exec crowdsec cscli lapi status
    • Generate a registration token for the remote agent:
      docker exec crowdsec cscli machines add adguard-agent --auto
      Copy the generated token/password.

  2. On AdGuard Home Server (Install Agent)

    • Install CrowdSec (agent-only is fine):
      curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt install crowdsec
    • Register the agent to your Pangolin LAPI:
      Edit /etc/crowdsec/local_api_credentials.yaml:
      url: http://<PANGOLIN_INTERNAL_IP_OR_TUNNEL_HOSTNAME>:8080
login: adguard-agent
password: <the_token_you_generated>
    • Restart CrowdSec:
      sudo systemctl restart crowdsec

  3. Configure AdGuard Home Log Acquisition
    Install the AdGuard Home parser/collection:

    sudo cscli parsers install LePresidente/adguardhome-logs
sudo cscli collections install LePresidente/adguardhome

    Then create /etc/crowdsec/acquis.d/adguardhome.yaml:

    filenames:
  - /path/to/adguardhome/logs/query.log   # or wherever your logs are (often /var/log/adguardhome/ or /opt/adguardhome/data/)
  - /path/to/adguardhome/logs/*.log
labels:
  type: adguardhome

    Restart CrowdSec on AdGuard server.

  4. Secure Communication
    Since AdGuard Home is behind Pangolin (via Newt tunnel), use the internal tunnel hostname/IP for the LAPI URL. This keeps everything encrypted over the WireGuard-based tunnel — no need to expose port 8080 publicly.

Alternative Options (Less Ideal)

  • Log Centralization: Forward AdGuard logs via rsyslog/journald to Pangolin, then read them centrally. More complex and higher latency.
  • NFS/SMB Mount: Mount the log directory from AdGuard to Pangolin. Works but not great for real-time and adds complexity.

Why Agent + Central LAPI is Best

  • Logs are parsed close to the source (low latency, respects local paths).
  • Decisions are centralized (one source of truth for bans).
  • Secure (uses the existing Pangolin tunnel).
  • Scalable if you add more services later.

would you like me to give you the exact commands to your OS (Docker? Linux distro?) or help the current setup on Pangolin first?

also, feel free to join the Discord mentioned if you want live 1:1 help — but I’m happy to walk you through it here too, sorry for delayed response, was away from desk.