# Securing Pangolin Resources with CrowdSec and the Middleware Manager - Updated Guide

**URL:** <https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283>\
**Category:** Self-hosted Applications\
**Tags:** middleware-manager, pangolin\
**Created:** [May 28, 2025, 3:46pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283 "2025-05-28T15:46:14Z")\
**Posts on this page:** 20\
**Page:** 5

<div class="post-metadata">

**Author:** ![athkoub](https://forum.hhf.technology/user_avatar/forum.hhf.technology/athkoub/32/1021_2.png) [@athkoub](https://forum.hhf.technology/u/athkoub)\
**Post date:** [January 12, 2026, 6:31pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/84 "2026-01-12T18:31:17Z")

</div>

for the last 2 days i try to install crowdsec bouncer plugin but seems that [https://raw.githubusercontent.com/hhftechnology/middleware-manager/traefik-int/plugin/plugins.json](https://raw.githubusercontent.com/hhftechnology/middleware-manager/traefik-int/plugin/plugins.json) returns 404 not found .

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [January 12, 2026, 8:23pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/85 "2026-01-12T20:23:01Z")

</div>

Try  
[https://raw.githubusercontent.com/hhftechnology/middleware-manager/refs/heads/main/plugin/plugins.json](https://raw.githubusercontent.com/hhftechnology/middleware-manager/refs/heads/main/plugin/plugins.json)

I think the traefik-int branch is gone.

---

<div class="post-metadata">

**Author:** ![00th00](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/0/97f17d/32.png) [@00th00](https://forum.hhf.technology/u/00th00)\
**Post date:** [January 19, 2026, 11:03am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/86 "2026-01-19T11:03:36Z")

</div>

> [@Mattercoder](#):
>
> stalled

> [@Mattercoder](#):
>
> [https://raw.githubusercontent.com/hhftechnology/middleware-manager/refs/heads/main/plugin/plugins.json](https://raw.githubusercontent.com/hhftechnology/middleware-manager/refs/heads/main/plugin/plugins.json)

I am encountering the same issues and even after changing the original url to this one, I still get the error  
“ **Failed to load plugins: Failed to fetch plugins list: External source returned status 404.”**

Is there a working solution on this situation?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [January 19, 2026, 12:26pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/87 "2026-01-19T12:26:30Z")

</div>

Friday evening new version is coming evening. no files will be needed.

 ![image](https://forum-cdn.hhf.technology/original/2X/4/491bd389a1379351b2d5c311664427fbdf0eec92.jpeg)

---

<div class="post-metadata">

**Author:** ![epp69](https://forum.hhf.technology/user_avatar/forum.hhf.technology/epp69/32/4362_2.png) [@epp69](https://forum.hhf.technology/u/epp69)\
**Post date:** [January 23, 2026, 9:00pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/88 "2026-01-23T21:00:10Z")

</div>

any new guide line to install this?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [January 23, 2026, 9:03pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/89 "2026-01-23T21:03:07Z")

</div>

[middleware-manager.hhf.technology](https://middleware-manager.hhf.technology/)

---

<div class="post-metadata">

**Author:** ![websheriff](https://forum.hhf.technology/user_avatar/forum.hhf.technology/websheriff/32/4992_2.png) [@websheriff](https://forum.hhf.technology/u/websheriff)\
**Post date:** [February 9, 2026, 4:19am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/90 "2026-02-09T04:19:25Z")

</div>

When starting crowdsec, I get an error for both local\_api\_credentials.yaml file and the online\_api\_credentials.yaml, even though they are created and verified their file path. Anyone else run into this and have an idea on what I could be doing wrong?

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [February 9, 2026, 8:04am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/91 "2026-02-09T08:04:38Z")

</div>

Try to shell into the container and check if those files are correct

```auto
docker run --rm -it \
  --name crowdsec-shell \
  --entrypoint /bin/sh \
  -e GID="1000" \
  -e COLLECTIONS="crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" \
  -e ENROLL_INSTANCE_NAME="pangolin-crowdsec" \
  -e PARSERS="crowdsecurity/whitelists" \
  -e ENROLL_KEY="REMOVED" \
  -e ACQUIRE_FILES="/var/log/traefik/access.log" \
  -e ENROLL_TAGS="docker" \
  -v "$(pwd)/config/crowdsec:/etc/crowdsec" \
  -v "$(pwd)/config/crowdsec/db:/var/lib/crowdsec/data" \
  -v "$(pwd)/config/crowdsec_logs/auth.log:/var/log/auth.log:ro" \
  -v "$(pwd)/config/crowdsec_logs/syslog:/var/log/syslog:ro" \
  -v "$(pwd)/config/crowdsec_logs:/var/log" \
  -v "$(pwd)/config/traefik/logs:/var/log/traefik" \
  -v "$(pwd)/config/traefik/conf/captcha.html:/etc/traefik/conf/captcha.html" \
  crowdsecurity/crowdsec:latest

```

---

<div class="post-metadata">

**Author:** ![websheriff](https://forum.hhf.technology/user_avatar/forum.hhf.technology/websheriff/32/4992_2.png) [@websheriff](https://forum.hhf.technology/u/websheriff)\
**Post date:** [February 9, 2026, 1:53pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/92 "2026-02-09T13:53:46Z")

</div>

I was able to do that and everything seems fine there but still getting the error with those two files.

---

<div class="post-metadata">

**Author:** ![websheriff](https://forum.hhf.technology/user_avatar/forum.hhf.technology/websheriff/32/4992_2.png) [@websheriff](https://forum.hhf.technology/u/websheriff)\
**Post date:** [February 10, 2026, 1:05am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/93 "2026-02-10T01:05:17Z")

</div>

Additionally, once I’m in the shell if I try to run cscli hub update, I get cscli hub update: failed to update hub: failed to create temporary download file for the index.json file

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [February 10, 2026, 8:03am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/94 "2026-02-10T08:03:30Z")

</div>

That sounds like a file/folder permissions issue. Check your volume mounts and see if you can make even a temp file using touch from within the container. If your container can’t write to the config folder nothing will work

---

<div class="post-metadata">

**Author:** ![websheriff](https://forum.hhf.technology/user_avatar/forum.hhf.technology/websheriff/32/4992_2.png) [@websheriff](https://forum.hhf.technology/u/websheriff)\
**Post date:** [February 10, 2026, 1:19pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/95 "2026-02-10T13:19:55Z")

</div>

I ended up figuring it out last night, not sure why it was calling out those files so I got kinda focused on that and then found the issue was I had the config directory as /etc/config/crowdsec, I’m thinking I accidentally hit an autocomplete in nvim and didn’t notice.

---

<div class="post-metadata">

**Author:** ![mryeetz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/mryeetz/32/5098_2.png) [@mryeetz](https://forum.hhf.technology/u/mryeetz)\
**Post date:** [February 18, 2026, 2:47pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/96 "2026-02-18T14:47:47Z")

</div>

I followed the guide but when I set crowdsec as middleware for a resource the resource starts showing “404 page not found”. When I remove crowdsec bouncer it works again.

What am I missing?

Here’s my Middleware:

```auto
{
  "crowdsec": {
    "crowdsecAppsecEnabled": true,
    "crowdsecAppsecFailureBlock": true,
    "crowdsecAppsecHost": "crowdsec:7422",
    "crowdsecAppsecUnreachableBlock": true,
    "crowdsecLapiHost": "crowdsec:8080",
    "crowdsecLapiKey": "redacted",
    "enabled": true
  }
}

```

docker exec cscli metrics:  
ubuntu@mw-oracle:~/pangolin/config/middleware-manager$ docker exec crowdsec cscli metrics  
±----------------------------------------------------------------------------------------------------------------------------+  
| Acquisition Metrics |  
±----------------------------------±-----------±-------------±---------------±-----------------------±------------------+  
| Source | Lines read | Lines parsed | Lines unparsed | Lines poured to bucket | Lines whitelisted |  
±----------------------------------±-----------±-------------±---------------±-----------------------±------------------+  
| file:/var/log/traefik/access.log | 160 | 160 | - | - | - |  
| file:/var/log/traefik/traefik.log | 825 | 825 | - | - | - |  
±----------------------------------±-----------±-------------±---------------±-----------------------±------------------+  
±------------------------------------------------+  
| Local API Decisions |  
±----------------------±-------±-------±------+  
| Reason | Origin | Action | Count |  
±----------------------±-------±-------±------+  
| http:bruteforce | CAPI | ban | 1231 |  
| http:crawl | CAPI | ban | 747 |  
| http:exploit | CAPI | ban | 15986 |  
| http:scan | CAPI | ban | 864 |  
| vm-management:exploit | CAPI | ban | 1 |  
±----------------------±-------±-------±------+  
±-----------------------------------+  
| Local API Metrics |  
±-------------------±-------±-----+  
| Route | Method | Hits |  
±-------------------±-------±-----+  
| /v1/allowlists | GET | 12 |  
| /v1/heartbeat | GET | 11 |  
| /v1/usage-metrics | POST | 1 |  
| /v1/watchers/login | POST | 67 |  
±-------------------±-------±-----+  
±-------------------------------------------+  
| Local API Machines Metrics |  
±----------±---------------±-------±-----+  
| Machine | Route | Method | Hits |  
±----------±---------------±-------±-----+  
| localhost | /v1/allowlists | GET | 12 |  
| localhost | /v1/heartbeat | GET | 11 |  
±----------±---------------±-------±-----+  
±-------------------------------------------------------------------+  
| Parser Metrics |  
±---------------------------------------±------±-------±---------+  
| Parsers | Hits | Parsed | Unparsed |  
±---------------------------------------±------±-------±---------+  
| child-child-crowdsecurity/traefik-logs | 1.97k | 985 | 985 |  
| child-crowdsecurity/http-logs | 2.96k | 985 | 1.97k |  
| child-crowdsecurity/traefik-logs | 1.97k | 985 | 985 |  
| crowdsecurity/dateparse-enrich | 985 | 985 | - |  
| crowdsecurity/http-logs | 985 | - | 985 |  
| crowdsecurity/non-syslog | 985 | 985 | - |  
| crowdsecurity/public-dns-allowlist | 985 | 985 | - |  
| crowdsecurity/traefik-logs | 985 | 985 | - |  
| crowdsecurity/whitelists | 985 | 985 | - |  
±---------------------------------------±------±-------±---------+  
±--------------------------------------------------------------------------------------+  
| Whitelist Metrics |  
±-----------------------------------±----------------------------±-----±------------+  
| Whitelist | Reason | Hits | Whitelisted |  
±-----------------------------------±----------------------------±-----±------------+  
| crowdsecurity/public-dns-allowlist | public DNS server | 985 | - |  
| crowdsecurity/whitelists | private ipv4/ipv6 ip/ranges | 985 | - |  
±-----------------------------------±----------------------------±-----±------------+

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [February 18, 2026, 7:35pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/97 "2026-02-18T19:35:35Z")

</div>

Make sure you accept the enrollment on the crowdsec console web ui

---

<div class="post-metadata">

**Author:** ![mryeetz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/mryeetz/32/5098_2.png) [@mryeetz](https://forum.hhf.technology/u/mryeetz)\
**Post date:** [February 19, 2026, 8:54am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/98 "2026-02-19T08:54:58Z")

</div>

I already had it enrolled, but it seems to be having issues now.

“ **Critical**

Security Engine: No working remediation components

Since February 18, 2026 (12:40)

Security Engine has no working remediation components and cannot block attacks effectively.

**Important**

Security Engine: no activity

Since February 08, 2026 (16:02)

Security Engine has not pushed alerts for more than 48 hours and might not be functioning properly.”

I have 3 remediation components (Traefik bouncers), one doesn’t show a version and any other info and two others seem to be inactive for 13 days now.

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [February 19, 2026, 11:09am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/99 "2026-02-19T11:09:26Z")

</div>

Check the traefik dashboard localhost:8080. You might have an issue with the middleware/plugin

---

<div class="post-metadata">

**Author:** ![mryeetz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/mryeetz/32/5098_2.png) [@mryeetz](https://forum.hhf.technology/u/mryeetz)\
**Post date:** [February 19, 2026, 11:54am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/100 "2026-02-19T11:54:03Z")

</div>

The dashboard shows:

plugin: unknown plugin type: crowdsec

---

<div class="post-metadata">

**Author:** ![mryeetz](https://forum.hhf.technology/user_avatar/forum.hhf.technology/mryeetz/32/5098_2.png) [@mryeetz](https://forum.hhf.technology/u/mryeetz)\
**Post date:** [February 19, 2026, 11:57am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/101 "2026-02-19T11:57:59Z")

</div>

Apparently I had to change the JSON in middleware manager to start with

`{ "crowdsec-bouncer-traefik" }`

instead of

`{ "crowdsec" }`

---

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [February 19, 2026, 12:24pm UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/102 "2026-02-19T12:24:57Z")

</div>

Step 12 above has the correct name. Glad it works now. If you feel the guide should be updated let me know where

---

<div class="post-metadata">

**Author:** ![Eldritzh](https://forum.hhf.technology/user_avatar/forum.hhf.technology/eldritzh/32/1073_2.png) [@Eldritzh](https://forum.hhf.technology/u/Eldritzh)\
**Post date:** [February 20, 2026, 8:28am UTC](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283/103 "2026-02-20T08:28:38Z")

</div>

If I run pangolin on my own hardware, not a vps.

Could I easily follow this and add crowdsec/mwm to my setup?

Asking as I tried adding it before, but it broke in some fashion (mwm couldnt add the plugin - posted on discord).

[Previous page](https://forum.hhf.technology/t/securing-pangolin-resources-with-crowdsec-and-the-middleware-manager-updated-guide/2283.md?page=4)