{"id":46368101,"url":"https://github.com/samuelba/traefik_crowdsec_bouncer","last_synced_at":"2026-03-05T02:35:10.422Z","repository":{"id":230893773,"uuid":"624966166","full_name":"samuelba/traefik_crowdsec_bouncer","owner":"samuelba","description":"A service written in Rust that acts as a CrowdSec bouncer for the Traefik ForwardAuth middleware.","archived":false,"fork":false,"pushed_at":"2026-01-29T20:17:56.000Z","size":145,"stargazers_count":0,"open_issues_count":2,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-30T07:49:33.829Z","etag":null,"topics":["crowdsec","crowdsec-bouncer","docker","rust","rust-lang","security","traefik","traefik-v2"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/samuelba.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-04-07T17:56:46.000Z","updated_at":"2026-01-29T19:26:45.000Z","dependencies_parsed_at":"2024-04-01T12:46:54.347Z","dependency_job_id":"28f5221e-8fa2-454b-9056-c6312790b7c4","html_url":"https://github.com/samuelba/traefik_crowdsec_bouncer","commit_stats":null,"previous_names":["samuelba/traefik_crowdsec_bouncer"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/samuelba/traefik_crowdsec_bouncer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/samuelba%2Ftraefik_crowdsec_bouncer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/samuelba%2Ftraefik_crowdsec_bouncer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/samuelba%2Ftraefik_crowdsec_bouncer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/samuelba%2Ftraefik_crowdsec_bouncer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/samuelba","download_url":"https://codeload.github.com/samuelba/traefik_crowdsec_bouncer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/samuelba%2Ftraefik_crowdsec_bouncer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30107274,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T01:39:18.192Z","status":"online","status_checked_at":"2026-03-05T02:00:06.710Z","response_time":93,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crowdsec","crowdsec-bouncer","docker","rust","rust-lang","security","traefik","traefik-v2"],"created_at":"2026-03-05T02:35:09.852Z","updated_at":"2026-03-05T02:35:10.405Z","avatar_url":"https://github.com/samuelba.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"![GitHub](https://img.shields.io/github/license/samuelba/traefik_crowdsec_bouncer)\n[![ci](https://github.com/samuelba/traefik_crowdsec_bouncer/actions/workflows/ci.yml/badge.svg)](https://github.com/samuelba/traefik_crowdsec_bouncer/actions/workflows/ci.yml)\n[![codecov](https://codecov.io/gh/samuelba/traefik_crowdsec_bouncer/branch/main/graph/badge.svg)](https://codecov.io/gh/samuelba/traefik_crowdsec_bouncer)\n![GitHub tag (latest SemVer)](https://img.shields.io/github/v/tag/samuelba/traefik_crowdsec_bouncer)\n![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/samuelba/traefik_crowdsec_bouncer)\n\n# Traefik CrowdSec Bouncer\n\nThis projects implements a simple HTTP server that acts as a bouncer for the Traefik ForwardAuth middleware. \nIt uses the CrowdSec API to check if the IP address of the request is banned or not.\n\nThe service support three modes \"stream\", \"live\" and \"none\". \nThe mode can be configured with the `CROWDSEC_MODE` environment variable.\n\n| Mode    | Description                                                                                                         |\n|---------|---------------------------------------------------------------------------------------------------------------------|\n| stream  | Periodically, every `STREAM_UPDATE_INTERVAL` seconds, fetch the list of blocked IP addresses from the CrowdSec API. |\n| live    | Call the CrowdSec API for every unknown IP address and store it for `LIVE_CACHE_EXPIRATION` seconds in the cache.   |\n| none    | Call the CrowdSec API for every request (not very resource friendly).                                               |\n\n## Usage\n\n### Docker Compose\n\nExample `docker-compose.yml` file\n\n```yaml\nservices:\n  traefik-crowdsec-bouncer:\n    # Build the image locally.\n    build:\n        context: .\n        dockerfile: Dockerfile\n    image: traefik-crowdsec-bouncer:latest\n\n    # Use the image from Docker Hub.\n    # image: samuelba/traefik_crowdsec_bouncer:latest\n\n    container_name: traefik-crowdsec-bouncers\n    restart: unless-stopped\n    environment:\n      # CrowdSec API key. Get it with e.g. `docker exec -it crowdsec cscli bouncers add traefik-crowdsec-bouncer`.\n      - CROWDSEC_API_KEY=abc123\n      # CrowdSec API host including the port e.g. crowdsec:8080.\n      - CROWDSEC_HOST=crowdsec:8080\n      # Call CrowdSec API over HTTPS (true) or HTTP (false).\n      - CROWDSEC_HTTPS=false\n      # List of trusted proxies (CIDR) separated by commas.\n      # Example: Trust local Docker network (172.16.0.0/12) and a specific load balancer IP (10.0.0.1/32).\n      - CROWDSEC_TRUSTED_PROXIES=172.16.0.0/12,10.0.0.1/32\n      # The mode to verify the IP address. Can be either \"stream\", \"live\" or \"none\".\n      # In \"stream\" mode the service will periodically fetch the list of blocked IP addresses from the CrowdSec API.\n      # In \"live\" mode the service will call the CrowdSec API for every unknown IP address and store it for 'LIVE_CACHE_EXPIRATION' seconds in the cache.\n      # In \"none\" mode the service will call the CrowdSec API for every request. Not very resource friendly.\n      - CROWDSEC_MODE=stream\n      # Stream update interval in seconds. Only needed in \"stream\" mode.\n      - STREAM_UPDATE_INTERVAL=5\n      # The cache expiration time in seconds. Only needed in \"live\" mode.\n      - LIVE_CACHE_EXPIRATION=5\n      # The port the service should listen on. Default is 8080.\n      - PORT=8080\n      # The log level. Can be either \"debug\", \"info\", \"warn\" or \"error\". Default is \"warn\".\n      - LOG_LEVEL=warn\n```\n\n## Configuration\n\nThe service can be configured with the following environment variables:\n\n| Variable | Description | Default |\n|----------|-------------|---------|\n| `CROWDSEC_API_KEY` | The CrowdSec API key. | |\n| `CROWDSEC_HOST` | The CrowdSec API host. | |\n| `CROWDSEC_HTTPS` | Call CrowdSec API over HTTPS (true) or HTTP (false). | false |\n| `CROWDSEC_MODE` | The mode to verify the IP address. Can be either \"stream\", \"live\" or \"none\". | stream |\n| `CROWDSEC_TRUSTED_PROXIES` | List of trusted proxies (CIDR) separated by commas. | |\n| `STREAM_UPDATE_INTERVAL` | The interval in seconds to fetch the list of blocked IP addresses from the CrowdSec API. Only needed in \"stream\" mode. | 0 |\n| `LIVE_CACHE_EXPIRATION` | The cache expiration time in seconds. Only needed in \"live\" mode. | 0 |\n| `PORT` | The port the service should listen on. | 8080 |\n| `LOG_LEVEL` | The log level. Can be either \"debug\", \"info\", \"warn\" or \"error\". | warn |\n\n## Token Generation\n\nTo generate a token for the bouncer, you can use the `cscli` command line tool on your CrowdSec instance.\n\n```bash\ndocker exec -it crowdsec cscli bouncers add traefik-crowdsec-bouncer\n```\n\n## API Endpoints\n\nThe service exposes the following API endpoints:\n\n| Method | Path | Description |\n|--------|------|-------------|\n| GET | `/api/v1/forwardAuth` | The main authentication endpoint. It checks if the IP address is blocked or not. |\n| GET | `/api/v1/blockList` | Returns the list of blocked IP addresses. Only available in \"stream\" mode. |\n| GET | `/api/v1/health` | The health check endpoint. It returns 200 OK if the service is healthy. |\n\n## Traefik Dynamic Configuration\n\nTo configure the bouncer as a middleware in Traefik, you can use the following dynamic configuration:\n\n```yaml\nhttp:\n  middlewares:\n    crowdsec-bouncer:\n      forwardAuth:\n        address: http://traefik-crowdsec-bouncers:8080/api/v1/forwardAuth\n        trustForwardHeader: true\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsamuelba%2Ftraefik_crowdsec_bouncer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsamuelba%2Ftraefik_crowdsec_bouncer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsamuelba%2Ftraefik_crowdsec_bouncer/lists"}