CrowdSec + Bouncer + Dashboard

intermediate

Collaborative security engine with reputation system.

Overview

CrowdSec is a modern, open-source intrusion prevention system that combines behavioral analysis with collaborative threat intelligence. Created in 2019 by Thibault Koechlin and Philippe Humeau, CrowdSec analyzes logs in real-time to detect attack patterns, then shares anonymized threat data with a global community network. Unlike traditional security tools that rely solely on static signatures, CrowdSec uses crowd-sourced intelligence to identify emerging threats and build collective immunity against malicious actors. This stack combines CrowdSec's detection engine with the firewall bouncer for automated IP blocking and Metabase for comprehensive security analytics and reporting. The firewall bouncer acts as the enforcement layer, automatically blocking malicious IPs detected by CrowdSec at the iptables level, while PostgreSQL stores detection data that Metabase transforms into actionable security dashboards. This configuration provides enterprise-grade threat detection and response capabilities with the ability to visualize attack patterns, bouncer effectiveness, and security metrics through Metabase's powerful analytics interface. Organizations seeking proactive security monitoring with automated response capabilities will find this stack particularly valuable. The combination of real-time threat detection, automatic blocking, and comprehensive reporting makes it ideal for security teams who need both operational protection and strategic security insights, while benefiting from CrowdSec's collaborative threat intelligence network.

Key Features

Real-time log analysis with behavioral detection algorithms for SSH, HTTP, and custom application attacks
Collaborative threat intelligence sharing with CrowdSec's global community network
Automatic iptables firewall rule management through the cs-firewall-bouncer integration
Multiple detection scenarios including brute-force, DDoS, and application-specific attack patterns
Metabase analytics dashboard with customizable security metrics and attack visualization
PostgreSQL-backed data persistence for long-term threat analysis and reporting
Collection-based configuration system supporting Linux, Nginx, SSH, and custom parsers
API-driven architecture enabling integration with external security tools and SIEM systems

Common Use Cases

1Web server protection with automated blocking of brute-force attacks and malicious bot traffic
2SSH hardening for Linux servers with real-time detection of credential stuffing attempts
3Multi-server security monitoring with centralized threat intelligence and reporting
4Compliance reporting with historical attack data and security metrics visualization
5DevOps security automation integrating threat detection into CI/CD pipeline monitoring
6Small business security operations center with low-maintenance automated threat response
7Research and threat hunting using CrowdSec's community intelligence and Metabase analytics

Prerequisites

Minimum 2GB RAM (1GB for CrowdSec/Metabase, 512MB for PostgreSQL, 512MB for system overhead)
Docker host with privileged access for firewall bouncer NET_ADMIN and NET_RAW capabilities
Available ports 3000 (Metabase), 8080 (CrowdSec API), and iptables access for bouncer
Log file access with readable /var/log directory containing application logs to monitor
Environment variables BOUNCER_API_KEY, POSTGRES_USER, and POSTGRES_PASSWORD configured
Basic understanding of iptables rules and firewall management for bouncer troubleshooting

For development & testing. Review security settings, change default credentials, and test thoroughly before production use. See Terms

docker-compose.yml

1services: 
2  crowdsec: 
3    image: crowdsecurity/crowdsec:latest
4    environment: 
5      - GID=1000
6      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd
7      - CUSTOM_HOSTNAME=crowdsec
8    volumes: 
9      - crowdsec-data:/var/lib/crowdsec/data
10      - crowdsec-config:/etc/crowdsec
11      - /var/log:/var/log:ro
12    ports: 
13      - "8080:8080"
14    networks: 
15      - crowdsec-network
16    restart: unless-stopped
17
18  bouncer-firewall: 
19    image: crowdsecurity/cs-firewall-bouncer:latest
20    environment: 
21      - CROWDSEC_AGENT_HOST=crowdsec:8080
22      - CROWDSEC_BOUNCER_API_KEY=${BOUNCER_API_KEY}
23    cap_add: 
24      - NET_ADMIN
25      - NET_RAW
26    network_mode: host
27    depends_on: 
28      - crowdsec
29    restart: unless-stopped
30
31  dashboard: 
32    image: metabase/metabase:latest
33    environment: 
34      - MB_DB_TYPE=postgres
35      - MB_DB_HOST=postgres
36      - MB_DB_PORT=5432
37      - MB_DB_DBNAME=metabase
38      - MB_DB_USER=${POSTGRES_USER}
39      - MB_DB_PASS=${POSTGRES_PASSWORD}
40    volumes: 
41      - metabase-data:/metabase-data
42    ports: 
43      - "3000:3000"
44    depends_on: 
45      - postgres
46    networks: 
47      - crowdsec-network
48    restart: unless-stopped
49
50  postgres: 
51    image: postgres:15
52    environment: 
53      - POSTGRES_USER=${POSTGRES_USER}
54      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
55      - POSTGRES_DB=metabase
56    volumes: 
57      - postgres-data:/var/lib/postgresql/data
58    networks: 
59      - crowdsec-network
60    restart: unless-stopped
61
62volumes: 
63  crowdsec-data: 
64  crowdsec-config: 
65  metabase-data: 
66  postgres-data: 
67
68networks: 
69  crowdsec-network: 
70    driver: bridge

.env Template

.env

1# CrowdSec
2POSTGRES_USER=metabase
3POSTGRES_PASSWORD=secure_postgres_password
4
5# Generate bouncer API key:
6# docker exec crowdsec cscli bouncers add firewall-bouncer
7BOUNCER_API_KEY=your_bouncer_api_key

Usage Notes

1API at http://localhost:8080
2Dashboard at http://localhost:3000
3Generate bouncer key first
4Community blocklists
5Multiple bouncer types available

Individual Services(4 services)

Copy individual services to mix and match with your existing compose files.

crowdsec

crowdsec:
  image: crowdsecurity/crowdsec:latest
  environment:
    - GID=1000
    - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd
    - CUSTOM_HOSTNAME=crowdsec
  volumes:
    - crowdsec-data:/var/lib/crowdsec/data
    - crowdsec-config:/etc/crowdsec
    - /var/log:/var/log:ro
  ports:
    - "8080:8080"
  networks:
    - crowdsec-network
  restart: unless-stopped

bouncer-firewall

bouncer-firewall:
  image: crowdsecurity/cs-firewall-bouncer:latest
  environment:
    - CROWDSEC_AGENT_HOST=crowdsec:8080
    - CROWDSEC_BOUNCER_API_KEY=${BOUNCER_API_KEY}
  cap_add:
    - NET_ADMIN
    - NET_RAW
  network_mode: host
  depends_on:
    - crowdsec
  restart: unless-stopped

dashboard

dashboard:
  image: metabase/metabase:latest
  environment:
    - MB_DB_TYPE=postgres
    - MB_DB_HOST=postgres
    - MB_DB_PORT=5432
    - MB_DB_DBNAME=metabase
    - MB_DB_USER=${POSTGRES_USER}
    - MB_DB_PASS=${POSTGRES_PASSWORD}
  volumes:
    - metabase-data:/metabase-data
  ports:
    - "3000:3000"
  depends_on:
    - postgres
  networks:
    - crowdsec-network
  restart: unless-stopped

postgres

postgres:
  image: postgres:15
  environment:
    - POSTGRES_USER=${POSTGRES_USER}
    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    - POSTGRES_DB=metabase
  volumes:
    - postgres-data:/var/lib/postgresql/data
  networks:
    - crowdsec-network
  restart: unless-stopped

Quick Start

terminal

1# 1. Create the compose file
2cat > docker-compose.yml << 'EOF'
3services:
4  crowdsec:
5    image: crowdsecurity/crowdsec:latest
6    environment:
7      - GID=1000
8      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd
9      - CUSTOM_HOSTNAME=crowdsec
10    volumes:
11      - crowdsec-data:/var/lib/crowdsec/data
12      - crowdsec-config:/etc/crowdsec
13      - /var/log:/var/log:ro
14    ports:
15      - "8080:8080"
16    networks:
17      - crowdsec-network
18    restart: unless-stopped
19
20  bouncer-firewall:
21    image: crowdsecurity/cs-firewall-bouncer:latest
22    environment:
23      - CROWDSEC_AGENT_HOST=crowdsec:8080
24      - CROWDSEC_BOUNCER_API_KEY=${BOUNCER_API_KEY}
25    cap_add:
26      - NET_ADMIN
27      - NET_RAW
28    network_mode: host
29    depends_on:
30      - crowdsec
31    restart: unless-stopped
32
33  dashboard:
34    image: metabase/metabase:latest
35    environment:
36      - MB_DB_TYPE=postgres
37      - MB_DB_HOST=postgres
38      - MB_DB_PORT=5432
39      - MB_DB_DBNAME=metabase
40      - MB_DB_USER=${POSTGRES_USER}
41      - MB_DB_PASS=${POSTGRES_PASSWORD}
42    volumes:
43      - metabase-data:/metabase-data
44    ports:
45      - "3000:3000"
46    depends_on:
47      - postgres
48    networks:
49      - crowdsec-network
50    restart: unless-stopped
51
52  postgres:
53    image: postgres:15
54    environment:
55      - POSTGRES_USER=${POSTGRES_USER}
56      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
57      - POSTGRES_DB=metabase
58    volumes:
59      - postgres-data:/var/lib/postgresql/data
60    networks:
61      - crowdsec-network
62    restart: unless-stopped
63
64volumes:
65  crowdsec-data:
66  crowdsec-config:
67  metabase-data:
68  postgres-data:
69
70networks:
71  crowdsec-network:
72    driver: bridge
73EOF
74
75# 2. Create the .env file
76cat > .env << 'EOF'
77# CrowdSec
78POSTGRES_USER=metabase
79POSTGRES_PASSWORD=secure_postgres_password
80
81# Generate bouncer API key:
82# docker exec crowdsec cscli bouncers add firewall-bouncer
83BOUNCER_API_KEY=your_bouncer_api_key
84EOF
85
86# 3. Start the services
87docker compose up -d
88
89# 4. View logs
90docker compose logs -f

One-Liner

Run this command to download and set up the recipe in one step:

terminal

1curl -fsSL https://docker.recipes/api/recipes/crowdsec-complete/run | bash

Troubleshooting

CrowdSec API returning 403 errors: Generate bouncer API key using 'docker exec crowdsec cscli bouncers add firewall-bouncer'
Firewall bouncer not blocking IPs: Verify container has NET_ADMIN capabilities and host network mode access to iptables
Metabase connection refused on startup: Check PostgreSQL container health and ensure POSTGRES_USER/PASSWORD environment variables match
CrowdSec not detecting attacks: Verify log file permissions and that /var/log mount contains readable application logs
Dashboard showing no data: Confirm CrowdSec collections are installed and parsers are processing logs successfully
High memory usage in CrowdSec: Reduce log retention period and limit active collections to required services only

Community Notes

Loading notes...

Download Recipe Kit

Get all files in a ready-to-deploy package

Includes docker-compose.yml, .env template, README, and license

Components

crowdseccrowdsec-bouncermetabasepostgresql

Related Recipes

Ad Space

Shortcuts: C CopyF FavoriteD Download