CrowdSec integration

If a CrowdSec instance protects your stack, GeoMetrikks can talk to its Local API (LAPI) and show active decisions (bans) joined with the traffic it already stores: for each banned IP you see the country, city and request count from your own access logs.

docker exec crowdsec cscli bouncers add geometrikks   # prints the API key

CROWDSEC_LAPI_URL=http://crowdsec:8080
CROWDSEC_BOUNCER_API_KEY=<key from cscli bouncers add>

That gives read-only access: a Security page (ban stats and the active decision list cross-referenced with your traffic), a “Banned” badge on matching IPs in the access-logs and top-IP tables, and a Banned IPs map view. Its red markers count the banned addresses seen at each location within the selected time range, the popup lists every IP there with its current decisions, and the map controls show banned traffic totals and the top five banned IPs by requests.

To also ban and unban from the UI, add machine credentials:

# -f - prints the credentials instead of overwriting the container's own
docker exec crowdsec cscli machines add geometrikks --auto -f -

CROWDSEC_MACHINE_ID=geometrikks
CROWDSEC_MACHINE_PASSWORD=<password from cscli machines add>

With write access, a shield button appears next to IPs across the app (access logs, top-IP tables, map popups). It bans for a preset duration (1h to forever) or unbans a banned IP, and “More options…” opens the ban dialog for that IP. The same dialog is the Security page’s “Ban IP” button. It takes an IP or a CIDR range, a ban or a captcha, a preset or custom duration such as 90m or 3d, and an optional reason. Unbanning an IP leaves any range decision that covers it in place. The Security page also gains alert history, and in the Banned IPs map popup a decision’s scenario name opens its alert. Blocklist decisions have no alert of their own to open. Manual decisions carry origin geometrikks, and every ban and unban is audit-logged with the acting user.

CrowdSec 1.8 adds bot detection to its WAF. A browser challenge rejects clients whose fingerprint scores like an automation tool. Each rejection is an alert of kind bot-detection with no decision of its own, so it never shows up as a ban. With machine credentials, the Security page lists these alerts and opens them with the challenge outcome, the score and the signals behind it. Filtering alert history by kind needs CrowdSec 1.7 or newer. The challenge itself needs the AppSec component and a bouncer that supports it. The CrowdSec docs cover that setup.

Ban decisions stream live: the app polls the LAPI decision stream every CROWDSEC_STREAM_POLL_INTERVAL seconds (default 15) and pushes changes over a WebSocket, so badges react within seconds when CrowdSec bans or unbans an IP anywhere, not only from this UI.

[!NOTE] CrowdSec only decides; enforcement still needs a real bouncer (firewall-bouncer, nginx bouncer, Traefik plugin, …) in front of your stack. GeoMetrikks displays and manages decisions; it does not block traffic.

A machine that only logs in occasionally shows a “last seen” long ago in cscli machines list and the CrowdSec console. That is expected. Without CROWDSEC_* settings the integration is off and nothing else changes.