Skip to content

CrowdSec integration

If a CrowdSec instance protects your stack, GeoMetrikks can talk to its Local API (LAPI) and show active decisions (bans) joined with the traffic it already stores: for each banned IP you see the country, city and request count from your own access logs.

Register GeoMetrikks as a bouncer on the CrowdSec side and point the app at the LAPI:

Terminal window
docker exec crowdsec cscli bouncers add geometrikks   # prints the API key
Terminal window
CROWDSEC_LAPI_URL=http://crowdsec:8080
CROWDSEC_BOUNCER_API_KEY=<key from cscli bouncers add>

That gives read-only access: a Security page (ban stats and the active decision list cross-referenced with your traffic), a “Banned” badge on matching IPs in the access-logs and top-IP tables, and a map overlay marking banned IPs seen in your traffic within the selected time range.

To also ban and unban from the UI, add machine credentials:

/etc/crowdsec/local_api_credentials.yaml
# -f - prints the credentials instead of overwriting the container's own
docker exec crowdsec cscli machines add geometrikks --auto -f -
Terminal window
CROWDSEC_MACHINE_ID=geometrikks
CROWDSEC_MACHINE_PASSWORD=<password from cscli machines add>

With write access, a shield button appears next to IPs across the app (access logs, top-IP tables, map popups) with a ban-duration picker (1h to forever) and an unban action for banned IPs, and the Security page gains alert history and a manual “Ban IP” dialog with an optional reason. Manual bans carry origin geometrikks, and every ban and unban is audit-logged with the acting user.

Ban decisions stream live: the app polls the LAPI decision stream every CROWDSEC_STREAM_POLL_INTERVAL seconds (default 15) and pushes changes over a WebSocket, so badges react within seconds when CrowdSec bans or unbans an IP anywhere, not only from this UI.

[!NOTE] CrowdSec only decides; enforcement still needs a real bouncer (firewall-bouncer, nginx bouncer, Traefik plugin, …) in front of your stack. GeoMetrikks displays and manages decisions; it does not block traffic.

A machine that only logs in occasionally shows a “last seen” long ago in cscli machines list and the CrowdSec console. That is expected. Without CROWDSEC_* settings the integration is off and nothing else changes.