Self-host traefik-crowdsec-bouncer
v0.5.0CrowdSec bouncer for Traefik forward authentication
- Stars
- 332
- Port
- 8080 (HTTP server for forward auth and health checks)
- Requires
- CrowdSec agent
fbonalair/traefik-crowdsec-bouncerWhat is traefik-crowdsec-bouncer?
traefik-crowdsec-bouncer is a lightweight Go HTTP service that acts as a CrowdSec bouncer for Traefik v2. It uses Traefik's ForwardAuth middleware to check incoming request IPs against CrowdSec's decisions API, returning 403 Forbidden for banned IPs and allowing legitimate traffic through. The service runs as a Docker container configured via environment variables including the CrowdSec API key, agent host, log level, ban response code/message, listening port, and trusted proxies. It exposes health check endpoints (/ping, /healthz) and a Prometheus metrics endpoint. Requires a running CrowdSec agent and Traefik v2 instance.
Should you self-host traefik-crowdsec-bouncer?
traefik-crowdsec-bouncer scores 41/100 on selfhost.directory (how scoring works) and ranks #64 of 78 in Security. It has 332 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is pentagi (83/100, 32 629 stars). It scores higher overall, so compare the two before you pick. See traefik-crowdsec-bouncer vs pentagi side by side.
Features
- Configurable ban response
- ForwardAuth integration
- Health check endpoints
- HTTPS support for CrowdSec API
- IP-based blocking
- Prometheus Metrics
- Trusted proxies support
traefik-crowdsec-bouncer README
More in Network
Traefik-Koptraefik-kop is an open-source agent that reads Docker labels and publishes them to Redis for Traefik, enabling multi-host routing without Swarm or Kubernetes.
tunwgTunwg is a self-hosted, open-source ngrok alternative creating encrypted WireGuard tunnels with automatic HTTPS certificates and custom domains.
webrtc_turnOpen-source TURN relay for AndroMeld that relays encrypted WebRTC traffic when P2P fails. Deploy via Docker on your VPS or one-click Cloudflare Worker.
WireGuard EasyThe easiest way to run WireGuard VPN + Web-based Admin UI.
aiwayaiway is a self-hosted transparent SNI proxy that routes AI service traffic through your VPS using DNS and SNI routing, no VPN needed.
Apt-Cacher NGapt-cacher-ng is a self-hosted, open-source caching proxy that shares downloaded packages across a local network, supporting Debian, Ubuntu, Arch, and openSUSE.
awlAnywherelan is a self-hosted, open-source mesh VPN connecting devices directly without a central server. It provides SOCKS5 proxy and full-tunnel VPN gateway.
blocky-uiSelf-hosted web UI for blocky DNS ad-blocker. Toggle blocking, run queries, manage lists, flush cache — works without JavaScript.
cftunnelcftunnel is a self-hosted, open-source tunneling CLI for free HTTP/WS via Cloudflare and full TCP/UDP via self-hosted frp relay.
cloudflare-verified-ddnsSelf-hosted Cloudflare DDNS updater verifying DNS via DoH, adaptive polling, detailed telemetry. Python 3.13+, minimal Docker image.
containernetwork-autofixContainerNetwork AutoFix auto-recreates Docker containers using --net=container: networking when the master container restarts, preserving state. For Unraid and Docker.
copypartySelf-hosted file server with accelerated resumable uploads, deduplication, WebDAV, SFTP, FTP, TFTP, SMB, media indexing, thumbnails — all in one Python file.
0 comments