# Securing Pangolin Resources with CrowdSec and the Middleware Manager - Updated Guide

**URL:** <https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283>\
**Category:** Self-hosted Applications\
**Tags:** middleware-manager, pangolin\
**Created:** [May 28, 2025, 3:46pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283 "2025-05-28T15:46:14Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [May 28, 2025, 3:46pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/1 "2025-05-28T15:46:14Z")

</div>

# 🛡 Securing Pangolin Resources with CrowdSec and the Middleware Manager

This guide walks you through integrating the [CrowdSec Bouncer Traefik Plugin](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin) with [Pangolin](https://github.com/fosrl/pangolin) and the [Middleware Manager](https://github.com/hhftechnology/middleware-manager). This setup enables advanced traffic protection, behavioral analysis, and CAPTCHA enforcement using CrowdSec.

> ✅ This is an updated guide to the [original guide](https://forum.hhf.technology/t/part-1-integrating-crowdsec-with-pangolin/439) leveraging the **Plugin Hub** in the Middleware Manager, which simplifies Traefik plugin usage!

 ![logostogether](https://forum-cdn.hhf.technology/original/2X/3/335611862e6f79630753a8d452f46a1d69751799.jpeg)

* * *

## 🧰 Prerequisites

- A working Pangolin reverse proxy set up (see [installation guide](https://forum.hhf.technology/t/installing-and-setting-up-pangolin-and-middleware-manager/2255/3))
- Middleware Manager installed
- Traefik dashboard enabled (guide: [here](https://forum.hhf.technology/t/traefik-dashboard-a-vital-prerequisite-for-debugging-pangolin-and-middleware-manager/2208))
- A domain name pointed at your server
- Docker & Docker Compose
- A [CrowdSec Console](https://app.crowdsec.net/) account

* * *

## 🚀 Step-by-Step Setup

### 1. 📥 Get Your CrowdSec Enrollment Key

- Visit [https://app.crowdsec.net/](https://app.crowdsec.net/)
- Copy your **Enrollment Key**

 ![GetEnrollmentKey](https://forum-cdn.hhf.technology/original/2X/7/7ce68ed5e5fadd3b3792d1f6d2bb6c5de182fa55.png)

📸 Screenshot show the enrollment key copy location \_

* * *

### 2. 📁 Set Up Directory Structure

The target folder structure is important

```auto

/root/config/
├── crowdsec/
│ ├── acquis.yaml # Defines log acquisition sources
│ ├── config.yaml # Main CrowdSec configuration
│ ├── local_api_credentials.yaml # API credentials for bouncers
│ ├── online_api_credentials.yaml # API credentials for bouncers
│ ├── patterns/ # Fodler for patterns
│ ├── profiles.yaml # Defines remediation profiles
│ ├── user.yaml # User configuration
│ └── hub/
│ └── notifications/
| └── discord.yaml (optional) # Optional notification config
├── crowdsec_logs/ # Crowdsec Logs
├── traefik/
│ ├── conf/
│ │ └── captcha.html # HTML template for captcha challenges
│ ├── rules/
│ └── dynamic_config.yml # Dynamic Traefik configuration
│ ├── traefik_config.yml # Static Traefik configuration
│ └── logs/ # Directory for Traefik logs
└── letsencrypt/ # Let's Encrypt certificates

```

To create this run the following:

```bash
mkdir -p ./config/crowdsec/notifications
mkdir -p ./config/crowdsec/hub
mkdir -p ./config/crowdsec_logs
mkdir -p ./config/crowdsec/patterns
mkdir -p ./config/traefik/conf
mkdir -p ./config/traefik/logs

```

#### Optional: Add `.gitignore` (so you dont check in secrets into githib)

Optional - if you are going to be checking in your config into GitHub please remember to create a .gitignore so confidential files are not checked in  
Your .gitignore could look like

```auto
.env
installer
data/
config/key
config/crowdsec/db/crowdsec.db
config/crowdsec/hub/
config/db/db.sqlite
config/traefik/logs/access.log
config/crowdsec/local_api_credentials.yaml
config/crowdsec/online_api_credentials.yaml
config/crowdsec/appsec-configs/
config/crowdsec/appsec-rules/
config/crowdsec/collections/
config/crowdsec/contexts/
config/crowdsec/parsers/
config/crowdsec/patterns/
config/crowdsec/scenarios/
*.bak.*

```

* * *

### 3. 🛠 Create Required Config Files

Create these files under `./config/crowdsec`:

#### `acquis.yaml` – for log sources

```auto
filenames:
 - /var/log/auth.log
 - /var/log/syslog
labels:
  type: syslog
---
poll_without_inotify: false
filenames:
  - /var/log/traefik/*.log
labels:
  type: traefik
---
listen_addr: 0.0.0.0:7422 
appsec_config: crowdsecurity/appsec-default
name: myAppSecComponent
source: appsec
labels:
  type: appsec

```

This configuration:

- Monitors system logs for SSH and authentication attacks
- Watches Traefik logs for web attacks
- Enables the Application Security (WAF) component on port 7422

#### `config.yaml` – main settings

```auto
common:
  daemonize: false
  log_media: stdout
  log_level: info
  log_dir: /var/log/
config_paths:
  config_dir: /etc/crowdsec/
  data_dir: /var/lib/crowdsec/data/
  simulation_path: /etc/crowdsec/simulation.yaml
  hub_dir: /etc/crowdsec/hub/
  index_path: /etc/crowdsec/hub/.index.json
  notification_dir: /etc/crowdsec/notifications/
  plugin_dir: /usr/local/lib/crowdsec/plugins/
crowdsec_service:
  acquisition_path: /etc/crowdsec/acquis.yaml
  acquisition_dir: /etc/crowdsec/acquis.d
  parser_routines: 1
plugin_config:
  user: nobody
  group: nobody
cscli:
  output: human
db_config:
  log_level: info
  type: sqlite
  db_path: /var/lib/crowdsec/data/crowdsec.db
  flush:
    max_items: 5000
    max_age: 7d
  use_wal: false
api:
  client:
    insecure_skip_verify: false
    credentials_path: /etc/crowdsec/local_api_credentials.yaml
  server:
    log_level: info
    listen_uri: 0.0.0.0:8080
    profiles_path: /etc/crowdsec/profiles.yaml
    trusted_ips: # IP ranges, or IPs which can have admin API access
      - 127.0.0.1
      - ::1
    online_client: # Central API credentials (to push signals and receive bad IPs)
      credentials_path: /etc/crowdsec/online_api_credentials.yaml
    enable: true
prometheus:
  enabled: true
  level: full
  listen_addr: 0.0.0.0
  listen_port: 6060

```

This configuration:

Sets up the CrowdSec API server to listen on all interfaces (0.0.0.0)  
Configures path to credentials and profiles  
Allows connections from all IPs, which is needed for the Traefik plugin to communicate with CrowdSec

#### `profiles.yaml` – remediation profiles

```auto
name: captcha_remediation
filters:
  - Alert.Remediation == true && Alert.GetScope() == "Ip" && Alert.GetScenario() contains "http"
decisions:
  - type: captcha
    duration: 4h
on_success: break

---
name: default_ip_remediation
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 4h
on_success: break

---
name: default_range_remediation
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
 - type: ban
   duration: 4h
on_success: break

```

This configuration:

- Creates a captcha profile for HTTP-related attacks
- Sets up IP banning for other types of attacks
- Configures ban durations of 4 hours  
Important: Make sure to comment out any notification configurations in this file (slack, splunk, http, email) if you’re not using them, as they might cause errors.

#### `user.yaml`

```auto
common:
  daemonize: false
  log_media: stdout
  log_level: info
  log_dir: /var/log/
config_paths:
  config_dir: /etc/crowdsec/
  data_dir: /var/lib/crowdsec/data
crowdsec_service:
  parser_routines: 1
cscli:
  output: human
db_config:
  type: sqlite
  db_path: /var/lib/crowdsec/data/crowdsec.db
  user: crowdsec
  #log_level: info
  password: crowdsec
  db_name: crowdsec
  host: "127.0.0.1"
  port: 3306
api:
  client:
    insecure_skip_verify: false # default true
    credentials_path: /etc/crowdsec/local_api_credentials.yaml
  server:
    #log_level: info
    listen_uri: 127.0.0.1:8080
    profiles_path: /etc/crowdsec/profiles.yaml
    online_client: # Central API
      credentials_path: /etc/crowdsec/online_api_credentials.yaml
prometheus:
  enabled: true
  level: full

```

This configures the user configuration paths

#### `simulation.yaml`

```auto
simulation: false
# exclusions:
# - crowdsecurity/ssh-bf

```

#### `local_api_credentials.yaml`

```auto
url: http://0.0.0.0:8080
login: localhost
password: UNIQUE_PASSWORD_WILL_BE_INSERTED_HERE

```

#### `online_api_credentials.yaml`

```auto
touch ./config/crowdsec/online_api_credentials.yaml

```

* * *

### 4. 🧱 Traefik Setup

#### Add Captcha Template:

```bash
cd ./config/traefik/conf
wget https://gist.githubusercontent.com/hhftechnology/48569d9f899bb6b889f9de2407efd0d2/raw/captcha.html
cd ../../..

```

#### Update `traefik_config.yml` logging format:

change from

```auto
log:
    format: common
    level: INFO

```

to:

```auto
log:
    level: "INFO"
    format: "json"

accessLog:
    filePath: "/var/log/traefik/access.log"
    format: json

```

* * *

### 5. 🐳 Add CrowdSec to Docker Compose

You’ll need to update your Docker Compose file to include CrowdSec. Here’s how to add the CrowdSec service.  
Make sure you insert your enrolment key that you obtain in a previous step

```auto
# Add CrowdSec services
  crowdsec:
    command: -t
    container_name: crowdsec
    environment:
      ACQUIRE_FILES: /var/log/traefik/*.log
      COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
      ENROLL_INSTANCE_NAME: pangolin-crowdsec
      ENROLL_TAGS: docker
      ENROLL_KEY: INSERT-ENROLLMENT-KEY-HERE
      GID: "1000"
      PARSERS: crowdsecurity/whitelists
    healthcheck:
      test:
        - CMD
        - cscli
        - lapi
        - status
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    image: crowdsecurity/crowdsec:latest
    depends_on:
      - gerbil  
    labels:
      - traefik.enable=false
    ports:
      - 8080:8080
      - 6060:6060
    expose:
      - 8080
      - 6060
      - 7422
    restart: unless-stopped
    volumes:
      - ./config/crowdsec:/etc/crowdsec
      - ./config/crowdsec/db:/var/lib/crowdsec/data
      - ./config/crowdsec_logs/auth.log:/var/log/auth.log:ro
      - ./config/crowdsec_logs/syslog:/var/log/syslog:ro
      - ./config/crowdsec_logs:/var/log
      - ./config/traefik/logs:/var/log/traefik
      - ./config/traefik/conf/captcha.html:/etc/traefik/conf/captcha.html

```

This configuration:

Sets up CrowdSec with the Traefik collections and parsers  
Maps volumes for configuration and logs  
Exposes the necessary ports for the API and metrics  
Configures health checks and dependencies

* * *

### 6. Check that Crowdsec starts

Assuming that the other docker stack is running (otherwise start it) then you can bring to bring up crowdsec

```auto
docker compose up crowdsec

```

you are looking for errors like the following in the `docker logs crowdsec`

```auto
crowdsec | time="2025-05-28T08:45:27Z" level=fatal msg="no configuration paths provided"
crowdsec | Error: open null: no such file or directory

```

this indicates that some of the configuration files cant be found. So check the conf.yaml file to ensure everything is set correctly.

If you experience issues in getting Crowdsec going you can reset the database to clear out any residual config

```auto
rm -rf ./config/crowdsec/db/

```

and then change the config and start docker again.

### 7. 🌐 Pull the Hub Index

The first time you start crowdsec you will see an error like

```auto
crowdsec | Error: invalid hub index: unable to read index file: open /etc/crowdsec/hub/.index.json: no such file or directory. Run 'sudo cscli hub update' to download the index again

```

we will now manually pull down the hub update by accessing the container’s shell and running the command

```auto
docker run --rm -it \
  --name crowdsec-shell \
  --entrypoint /bin/sh \
  -e GID="1000" \
  -e COLLECTIONS="crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" \
  -e ENROLL_INSTANCE_NAME="pangolin-crowdsec" \
  -e PARSERS="crowdsecurity/whitelists" \
  -e ENROLL_KEY="REMOVED" \
  -e ACQUIRE_FILES="/var/log/traefik/access.log" \
  -e ENROLL_TAGS="docker" \
  -v "$(pwd)/config/crowdsec:/etc/crowdsec" \
  -v "$(pwd)/config/crowdsec/db:/var/lib/crowdsec/data" \
  -v "$(pwd)/config/crowdsec_logs/auth.log:/var/log/auth.log:ro" \
  -v "$(pwd)/config/crowdsec_logs/syslog:/var/log/syslog:ro" \
  -v "$(pwd)/config/crowdsec_logs:/var/log" \
  -v "$(pwd)/config/traefik/logs:/var/log/traefik" \
  -v "$(pwd)/config/traefik/conf/captcha.html:/etc/traefik/conf/captcha.html" \
  crowdsecurity/crowdsec:latest

```

you can then run

```auto
cscli hub update

```

you will see  
`Downloading /etc/crowdsec/hub/.index.json`

### 8. Generate the online\_api\_credentials

You need to regenerate the /etc/crowdsec/online\_api\_credentials.yaml. The easiest way is rm /etc/crowdsec/online\_api\_credentials.yaml and register again using the enrolment key from the previous step

```auto
touch /etc/crowdsec/online_api_credentials.yaml
cscli capi register
cscli console enroll <id>

```

try

```auto
docker compose up crowdsec

```

if you see an error - Instance already enrolled. You can use ‘–overwrite’ to force enroll

if you error the error `crowdsec | time="2025-05-28T12:37:09Z" level=fatal msg="crowdsec init: while loading parsers: failed to load parser config `

then you will need to install the parsers

```auto
docker run --rm -it \
  --name crowdsec-shell \
  --entrypoint /bin/sh \
  -e GID="1000" \
  -e COLLECTIONS="crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" \
  -e ENROLL_INSTANCE_NAME="pangolin-crowdsec" \
  -e PARSERS="crowdsecurity/whitelists" \
  -e ENROLL_KEY="REMOVED" \
  -e ACQUIRE_FILES="/var/log/traefik/access.log" \
  -e ENROLL_TAGS="docker" \
  -v "$(pwd)/config/crowdsec:/etc/crowdsec" \
  -v "$(pwd)/config/crowdsec/db:/var/lib/crowdsec/data" \
  -v "$(pwd)/config/crowdsec_logs/auth.log:/var/log/auth.log:ro" \
  -v "$(pwd)/config/crowdsec_logs/syslog:/var/log/syslog:ro" \
  -v "$(pwd)/config/crowdsec_logs:/var/log" \
  -v "$(pwd)/config/traefik/logs:/var/log/traefik" \
  -v "$(pwd)/config/traefik/conf/captcha.html:/etc/traefik/conf/captcha.html" \
  crowdsecurity/crowdsec:latest

```

```auto
ls /etc/crowdsec/config/patterns/

```

if you don’t see any folders your crowdsec doesn’t have the required patterns

Here’s a working around to download them

```auto
wget -P /opt https://github.com/crowdsecurity/crowdsec/archive/refs/tags/v1.6.9-rc2.zip
unzip /opt/v1.6.9-rc2.zip -d /opt
cp -r /opt/crowdsec-1.6.9-rc2/config/patterns/* /etc/crowdsec/patterns/
rm -rf /opt/crowdsec-1.6.9-rc2 /opt/v1.6.9-rc2.zip

```

try

```auto
docker compose up crowdsec -d

```

Everything should be working fine now. Check by looking at the logs `docker logs crowdsec`

* * *

### 9. 🔐 Generate API Key for Crowdsec Bouncer

```bash
docker exec crowdsec cscli bouncers add traefik-bouncer

```

it will return something like

```auto
API key for 'traefik-bouncer':

   YOUR-LAPI-KEY-HERE

Please keep this key since you will not be able to retrieve it! You will need it later

```

Save the API key for use in the middleware.

* * *

### 10. ☁ Set Up Cloudflare Turnstile

- Visit [https://dash.cloudflare.com/](https://dash.cloudflare.com/)
- Create a **Turnstile Widget**
- Copy the **site key** and **secret key**  
 ![AddingTurnstyle](https://forum-cdn.hhf.technology/original/2X/b/b65d741e730f794c12213efd58299f11b0330aa5.png)

📸 Screenshot Widget config page

* * *

### 11. 🧩 Add the Crowdsec Bouncer Plugin in the Middleware Manager

We now use the middleware manager to install the Crowdsec Bouncer Plugin to our traefik\_config

 ![InstallCrowdsecBouncerWithMiddleware](https://forum-cdn.hhf.technology/original/2X/c/c1aa5efe3b43918127d4b2d805592890b567d2d9.png)

## 📸 Screenshot - Adding Plugin

### 12. 🧩 Add the Middleware in Middleware Manager

Navigate to **Middleware Manager \> Plugins** and configure the CrowdSec plugin with:

```json
{
  "crowdsec-bouncer-traefik": {
    "enabled": true,
    "captchaProvider": "turnstile",
    "captchaSiteKey": "YOUR_TURNSTILE_KEY",
    "captchaSecretKey": "YOUR_TURNSTILE_SECRET",
    "captchaHTMLFilePath": "/etc/traefik/conf/captcha.html",
    "crowdsecLapiHost": "crowdsec:8080",
    "crowdsecAppsecHost": "crowdsec:7422",
    "crowdsecLapiKey": "YOUR_API_KEY",
    "crowdsecMode": "live",
    "clientTrustedIPs": [],
    "forwardedHeadersTrustedIPs": ["0.0.0.0/0"]
  }
}

```

 ![EditCrowdsecMiddleware](https://forum-cdn.hhf.technology/original/2X/b/b2c25b2a1e0f4079701dae9d8a3d44d7995c9dc6.png)

📸 _Screenshot Middleware Manager CrowdSec form_

* * *

### 13. 🌐 Protect a Resource

Protect a test or live resource (e.g., `secure.yourdomain.com`) in Pangolin and attach the **CrowdSec middleware** using the Middleware Manager.

 ![AddingMiddleToResource](https://forum-cdn.hhf.technology/original/2X/1/184c34e763de81e237cf09d73c73b007707a4296.png)

📸 _Screenshot: Attaching middleware to resource_

* * *

### 14. 🧪 Test

Manually trigger a CAPTCHA challenge:

```bash
docker exec crowdsec cscli decisions add --ip YOUR_IP --type captcha -d 1h

```

 ![decision-captcha](https://forum-cdn.hhf.technology/original/2X/6/6fddde6ecc8f162dfa1236a245c19ae01db41520.png)

Visit your protected site and validate the CAPTCHA appears.

 ![Captcha](https://forum-cdn.hhf.technology/original/2X/8/8097279bc11a65d0deb2cc3405c799b8ad21925f.png)

* * *

### 15. 🔧 Troubleshooting

```bash
# View decisions
docker exec crowdsec cscli decisions list

# Clear test decision
docker exec crowdsec cscli decisions delete --ip YOUR_IP

# Monitor logs
docker compose logs traefik -f
docker logs crowdsec

# Check installed scenarios
docker exec crowdsec cscli collections list

```

* * *

## 🔄 Maintenance Tips

- Update CrowdSec regularly:

```bash
docker exec crowdsec cscli hub update
docker exec crowdsec cscli collections upgrade

```

- Add allowlists for trusted IPs
- Monitor metrics at `http://localhost:6060/metrics`
- Use the Traefik dashboard to validate middleware status

 ![TraefikDashboardCrowdsec](https://forum-cdn.hhf.technology/original/2X/d/d9389780b7ff5f3c98f2752dbe7cbfa08b038158.png)

📸 _Screenshot: Traefik dashboard with middleware visible_

* * *

## Useful Commands

Useful Commands for Monitoring and Troubleshooting

```auto
# View CrowdSec overview
docker exec crowdsec cscli status

# Check which collections are installed
docker exec crowdsec cscli collections list

# Monitor CrowdSec resources
docker stats crowdsec

# Check AppSec metrics
curl http://localhost:6060/metrics | grep appsec

# View Traefik logs
docker exec -it crowdsec ls -l /var/log/traefik/

# Check CrowdSec metrics
docker exec -it crowdsec cscli metrics

# View active decisions
docker exec -it crowdsec cscli decisions list

# Monitor CrowdSec logs
docker exec -it crowdsec tail -f /var/log/traefik/access.log 

# Manually add decisions for testing
docker exec crowdsec cscli decisions add --ip <IP> --type captcha -d 1h
docker exec crowdsec cscli decisions add -i <IP> -t ban -d 1h

# Monitor Traefik logs
docker compose logs traefik -f

# Restart services
docker compose restart traefik crowdsec

# View/manage bouncers
docker exec crowdsec cscli bouncers list
docker exec crowdsec cscli bouncers add traefik-bouncer
docker exec crowdsec cscli bouncers delete traefik-bouncer

```

## ✅ Summary

You now have:

- CrowdSec actively protecting your reverse proxy
- CAPTCHA support via Cloudflare Turnstile
- Easy middleware management using Middleware Manager
- Visibility with the Traefik dashboard

* * *

## 🙌 Final Words

I have tried to summarize this in a way that is mostly understandable but [here is a link to the detailed steps](https://gist.github.com/oidebrett/b9483edf0d8e9e79c536b7eb816c312f) in case you need them.

CrowdSec + Pangolin + Middleware Manager form a powerful triad for self-hosted security. With behavior-based detection, real-time blocking, and collaborative intelligence, you’re far better equipped to defend your infrastructure.

Happy securing! 🛡

```auto

```

---

<div class="post-metadata">

**Author:** ![asudave](https://forum.hhf.technology/user_avatar/forum.hhf.technology/asudave/32/1175_2.png) [@asudave](https://forum.hhf.technology/u/asudave)\
**Post date:** [May 29, 2025, 7:47am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/2 "2025-05-29T07:47:29Z")

</div>

I’m sure I’m missing something, but I got to step 10 and I am not able to access any of my sites (pangolin, middleware-manager, traefik). I get an http error 403. You don’t have authorization to view this page.

I’ve checked the logs and nothing looks out of the ordinary (i.e., no errors). Not sure what went wrong.

---

<div class="post-metadata">

**Author:** ![noe6172](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/919ad9/32.png) [@noe6172](https://forum.hhf.technology/u/noe6172)\
**Post date:** [May 31, 2025, 11:40am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/3 "2025-05-31T11:40:31Z")

</div>

Great guide. Congratulations. It works fine for me.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![knaackville](https://forum.hhf.technology/user_avatar/forum.hhf.technology/knaackville/32/957_2.png) [@knaackville](https://forum.hhf.technology/u/knaackville)\
**Post date:** [May 31, 2025, 6:19pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/4 "2025-05-31T18:19:33Z")

</div>

This is fantastic. Working well on my end. Thank you for putting together!

Only question is if there is a way to use the middleware through Middleware Manager to apply to [pangolin.domain.com](http://pangolin.domain.com). I’d like to have crowdsec also apply to that subdomain.

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [May 31, 2025, 6:50pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/5 "2025-05-31T18:50:06Z")

</div>

Yes you can manually apply it. Because pangolin ui router are not generated in api rather manually update in dynamic file. So either you can put on individual ones or which you feel necessary.

---

<div class="post-metadata">

**Author:** ![asudave](https://forum.hhf.technology/user_avatar/forum.hhf.technology/asudave/32/1175_2.png) [@asudave](https://forum.hhf.technology/u/asudave)\
**Post date:** [June 1, 2025, 8:00am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/6 "2025-06-01T08:00:19Z")

</div>

I’m getting these in the logs for crowdsec after step 6.

 ![image](https://forum-cdn.hhf.technology/original/2X/e/ef3e078ee81c6cd77127812e27a603e1464bb5e9.png)

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 1, 2025, 8:58am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/7 "2025-06-01T08:58:40Z")

</div>

I successfully followed your guide, all looking good, thanks.

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 1, 2025, 8:59am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/8 "2025-06-01T08:59:48Z")

</div>

you will need to register it with crowdsec, you will find that at step 8

---

<div class="post-metadata">

**Author:** ![noe6172](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/919ad9/32.png) [@noe6172](https://forum.hhf.technology/u/noe6172)\
**Post date:** [June 1, 2025, 4:37pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/9 "2025-06-01T16:37:12Z")

</div>

My installation is correct but I think something is wrong in my system. I don’t have any IP banned.  
When I execute “docker exec crowdsec cscli decisions list” always have No active decisions.

I tried to be banned with fail logs and crowdsec don’t ban me.

I will test it slowly.

---

<div class="post-metadata">

**Author:** ![asudave](https://forum.hhf.technology/user_avatar/forum.hhf.technology/asudave/32/1175_2.png) [@asudave](https://forum.hhf.technology/u/asudave)\
**Post date:** [June 2, 2025, 4:30am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/10 "2025-06-02T04:30:49Z")

</div>

That’s not it. Crowdsec never fully starts so I can’t enroll on [crowdsec.net](http://crowdsec.net)

---

<div class="post-metadata">

**Author:** ![knaackville](https://forum.hhf.technology/user_avatar/forum.hhf.technology/knaackville/32/957_2.png) [@knaackville](https://forum.hhf.technology/u/knaackville)\
**Post date:** [June 2, 2025, 6:06pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/11 "2025-06-02T18:06:22Z")

</div>

Hmm, looking at things further, I am not getting any bans either. I don’t think it’s actually parsing any logs. Manual bans work fine.

│ Acquisition Metrics  
│ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │

│ file:/var/log/traefik/access.log │ 1.71k │ - │ 1.71k │ -

Edit: I added crowdsecurity/linux to the collections, and now all is working!

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [June 3, 2025, 3:03am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/12 "2025-06-03T03:03:52Z")

</div>

Thanks for the update. Add a few other also ssh and if you are using immich then immich

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 7, 2025, 8:59am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/13 "2025-06-07T08:59:23Z")

</div>

Hello,  
Could you please detail this a bit more? Do you mean to manually apply it in the `resource-overrides.yml` file as a new router?  
Or to add the needed plugins (duplicate them) manually in the `dynamic_config.yml` and adding their corresponding middlewares to the existing [pangolin.domain.com](http://pangolin.domain.com) routers there? (e.g. to apply Geoblock and Standard Security Headers to [pangolin.domain.com](http://pangolin.domain.com), which is not listed in the resources within the manager).

I have everything sorted out, except this bit here.

Thanks for clarifying 🙂

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [June 7, 2025, 10:21am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/14 "2025-06-07T10:21:31Z")

</div>

If I understand your question correctly you are asking where you apply the crowdsec middleware. If you want to protect an individual resource then you apply it only to the resource. Using the middleware manager will work for this. Don’t manually update resources\_override. Middlewares manager will update there. If however you want to protect the Pangolin resources themselves you will have to manually update dynamic\_config. Middleware manager can’t see the pangolin routers

Heres how I do that

```auto
routers:
    # HTTP to HTTPS redirect router
    main-app-router-redirect:
      rule: "Host(`pangolin.yourdomain.com`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - ip-whitelist@file
        - crowdsec@file
        - redirect-to-https

    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "Host(`pangolin.yourdomain.com`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - ip-whitelist@file
        - crowdsec@file

    # API router (handles /api/v1 paths)
    api-router:
      rule: "Host(`pangolin.yourdomain.com`) && PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - ip-whitelist@file
        - crowdsec@file

    # WebSocket router
    ws-router:
      rule: "Host(`pangolin.yourdomain.com`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - ip-whitelist@file
        - crowdsec@file

```

---

<div class="post-metadata">

**Author:** ![C8opmBMzz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/c8opmbmzz/32/2249_2.png) [@C8opmBMzz](https://forum.hhf.technology/u/C8opmBMzz)\
**Post date:** [June 9, 2025, 3:25pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/15 "2025-06-09T15:25:08Z")

</div>

Hey @Mattercoder  
Thanks for showing your config, all is clear now.  
I wasn’t sure if I could apply middlewares not explicitly defined in dynamic config file, but this can be done by having @file added to the end - eg.

```auto
      middlewares:
        - headers-standard@file ###- this comes from middleware manager.
        - crowdsec # this is defined in the same file (above) as pangolin was installed with crowdsec bundled.

```

---

<div class="post-metadata">

**Author:** ![asudave](https://forum.hhf.technology/user_avatar/forum.hhf.technology/asudave/32/1175_2.png) [@asudave](https://forum.hhf.technology/u/asudave)\
**Post date:** [June 10, 2025, 6:49am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/16 "2025-06-10T06:49:21Z")

</div>

Think I finally have everything set up (Crowdsec, Middleware Manager, Pangolin). I’m a bit confused about how to protect my resources with Crowdsec. How do I use a Crowdsec collection to protect a local service (eg., Vaultwarden)? I assume I need to install the collection per the instructions. How then do I have it see Vaultwarden, which is on a different machine?

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [June 10, 2025, 8:17am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/17 "2025-06-10T08:17:17Z")

</div>

Using the middleware manager, you add the crowdsec middleware to the resource

---

<div class="post-metadata">

**Author:** ![expalmi](https://forum.hhf.technology/user_avatar/forum.hhf.technology/expalmi/32/1908_2.png) [@expalmi](https://forum.hhf.technology/u/expalmi)\
**Post date:** [June 17, 2025, 12:01pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/18 "2025-06-17T12:01:27Z")

</div>

@knaackville can you pleas tell me, how you the problem, how did you add the crowd security/linux to the collections and where? I have the same problem, only the traefik.log is parsed.

---

<div class="post-metadata">

**Author:** ![expalmi](https://forum.hhf.technology/user_avatar/forum.hhf.technology/expalmi/32/1908_2.png) [@expalmi](https://forum.hhf.technology/u/expalmi)\
**Post date:** [June 17, 2025, 2:24pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/19 "2025-06-17T14:24:48Z")

</div>

I am sorry, I followed the instuction,  
when I execute “docker exec crowdsec cscli metrics show acquisition” the only file that gets inspected is /traefik/access.log.

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [June 17, 2025, 5:27pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/20 "2025-06-17T17:27:02Z")

</div>

That’s the correct one. Make sure you go to the crowdsec console and accept the enrollment.

[Next page](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283.md?page=2)