Fixed by myself, deleted directory and created a new captcha 
docker logs Crowdsec shows
sqlite is not using WAL mode
the Crowdsec doc say it would be ok to add
use_wal: true
to db_conig in user_yaml
Will this be ok, here?
I have not seen that before. Please try it
Accept the enrollment on crowdsec console
I did enroll and accepted it, it is shown on the ui. I do not see any alerts.
The decision list is empty.
oot@ubuntu-4gb-nbg1-2:~# docker exec -it crowdsec cscli metrics
╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Acquisition Metrics │
├──────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────┤
│ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │
├──────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤
│ file:/var/log/traefik/access.log │ 95 │ 95 │ - │ 74 │ - │
╰──────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯
╭───────────────────────────────────────────╮
│ Local API Decisions │
├─────────────────┬────────┬────────┬───────┤
│ Reason │ Origin │ Action │ Count │
├─────────────────┼────────┼────────┼───────┤
│ ssh:bruteforce │ CAPI │ ban │ 2699 │
│ http:bruteforce │ CAPI │ ban │ 1432 │
│ http:crawl │ CAPI │ ban │ 646 │
│ http:exploit │ CAPI │ ban │ 8977 │
│ http:scan │ CAPI │ ban │ 2546 │
╰─────────────────┴────────┴────────┴───────╯
╭────────────────────────────────────╮
│ Local API Metrics │
├────────────────────┬────────┬──────┤
│ Route │ Method │ Hits │
├────────────────────┼────────┼──────┤
│ /v1/allowlists │ GET │ 21 │
│ /v1/heartbeat │ GET │ 20 │
│ /v1/usage-metrics │ POST │ 1 │
│ /v1/watchers/login │ POST │ 1 │
╰────────────────────┴────────┴──────╯
╭────────────────────────────────────────────╮
│ Local API Machines Metrics │
├───────────┬────────────────┬────────┬──────┤
│ Machine │ Route │ Method │ Hits │
├───────────┼────────────────┼────────┼──────┤
│ localhost │ /v1/allowlists │ GET │ 21 │
│ localhost │ /v1/heartbeat │ GET │ 20 │
╰───────────┴────────────────┴────────┴──────╯
╭───────────────────────────────────────────────────────────────╮
│ Parser Metrics │
├────────────────────────────────────┬──────┬────────┬──────────┤
│ Parsers │ Hits │ Parsed │ Unparsed │
├────────────────────────────────────┼──────┼────────┼──────────┤
│ child-crowdsecurity/http-logs │ 285 │ 230 │ 55 │
│ child-crowdsecurity/traefik-logs │ 190 │ 95 │ 95 │
│ crowdsecurity/dateparse-enrich │ 95 │ 95 │ - │
│ crowdsecurity/geoip-enrich │ 95 │ 95 │ - │
│ crowdsecurity/http-logs │ 95 │ 95 │ - │
│ crowdsecurity/non-syslog │ 95 │ 95 │ - │
│ crowdsecurity/public-dns-allowlist │ 95 │ 95 │ - │
│ crowdsecurity/traefik-logs │ 95 │ 95 │ - │
│ crowdsecurity/whitelists │ 95 │ 95 │ - │
╰────────────────────────────────────┴──────┴────────┴──────────╯
╭────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Scenario Metrics │
├──────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────┤
│ Scenario │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├──────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ crowdsecurity/http-crawl-non_statics │ 2 │ - │ 18 │ 43 │ 16 │
│ crowdsecurity/http-probing │ 2 │ - │ 6 │ 29 │ 4 │
│ crowdsecurity/http-sensitive-files │ - │ - │ 1 │ 2 │ 1 │
╰──────────────────────────────────────┴───────────────┴───────────┴──────────────┴────────┴─────────╯
╭───────────────────────────────────────────────────────────────────────────────────────╮
│ Whitelist Metrics │
├────────────────────────────────────┬─────────────────────────────┬──────┬─────────────┤
│ Whitelist │ Reason │ Hits │ Whitelisted │
├────────────────────────────────────┼─────────────────────────────┼──────┼─────────────┤
│ crowdsecurity/public-dns-allowlist │ public DNS server │ 95 │ - │
│ crowdsecurity/whitelists │ private ipv4/ipv6 ip/ranges │ 95 │ - │
╰────────────────────────────────────┴─────────────────────────────┴──────┴─────────────╯
root@ubuntu-4gb-nbg1-2:~#
I do not find the error
Apply the crowdsec middleware to a resource using the middleware manager
You should see some entries like this in resources-override.yml
10-router-auth:
entryPoints:
- websecure
middlewares:
- crowdsec@file
- badger@http
priority: 100
rule: "Host(`YOUR_RESOURCE_DOMAIN`)"
service: "10-service@http"
tls:
certResolver: "letsencrypt"
If not the crowdsec isn’t applied to your incoming routers
I can’t access the MM dashboard. The following error message appears in the log, but unfortunately I don’t understand it with my limited abilities.
Initial resource check failed: failed to fetch resources: HTTP request failed: Get “``http://pangolin:3001/api/v1/traefik-config”:`` dial tcp 172.18.0.4:3001: connect: connection refused
Pangolin logs show api is started
2025-12-01T10:54:43+00:00 [info]: API server is running on http://localhost:3000
2025-12-01T10:54:43+00:00 [info]: Internal server is running on http://localhost:3001
After some minutes of wait, dashboard is reachable, I try
1 Like
Thank you for your patience and support.
I added the crowdsec bouncer to one resource, traefik dashboard shows the added middleware and no errors.
I added my IP, Step 14. Can see it in the decision list. The IP is not blocked, can access the resource
7-Calibre-router-auth-auth:
entryPoints:
- websecure
middlewares:
- crowdsec@file
- badger@http
priority: 100
rule: "Host(`xxxxxxxxxx`)"
service: "7-Calibre-service@http"
tls:
certResolver: "letsencrypt"
1 Like
its an overide file, its a separation from the main router/middleware we have to do to keep a track, what is your issue with it, anywhere it is causing a problem??
thankyou for explanation. Can I get rid off this override, please