Traefik with CrowdSec Security Engine

Traefik with CrowdSec Security Engine is an edge appliance that terminates inbound HTTP and HTTPS traffic, routes it to your backend services, and defends it at the same time. Traefik handles routing, load balancing and automatic certificate issuance. The CrowdSec Security Engine reads Traefik's own access log, recognises probing, crawling, brute force and known exploitation patterns through its behavioural scenarios, and records a ban decision. A bouncer middleware inside Traefik enforces that decision on the very next request, so an attacking source is refused at the edge instead of reaching your application.

The loop is the product, and it is already wired. Installing a proxy and a detection engine side by side does nothing on its own: the engine has to be pointed at the proxy's logs, the right parser has to be installed, and a bouncer has to be connected back to the proxy before a single request is ever blocked. All of that is done and verified here. Traefik writes a JSON access log, the CrowdSec collection that understands that format is installed, and the bouncer middleware is attached to the routers. Anything you publish through this proxy inherits the protection with no changes to your application.

It works with no internet access and no account. The bouncer is stored on the instance rather than downloaded when the proxy starts, so nothing is fetched from a plugin registry at boot. Detection and enforcement both run against decisions held locally on the instance. No enrollment credential is baked into the image, and none is needed. If you do want community blocklists and the hosted console later, enrolling is a single documented command and is entirely your choice.

No default or shared credentials ship in the image. This appliance has three secrets that many deployments leave at a known value: the engine's local API credential, the bouncer API key, and the proxy dashboard password. The captured image contains none of them. On the first boot of your instance a one shot service mints all three uniquely, then the proxy starts. The proxy cannot start before that has happened, and a start time guard refuses to run it on a placeholder or on any published example key. The dashboard is never served without authentication, and a blocked visitor is refused before the sign in prompt is ever shown, so the dashboard cannot be used to guess credentials.

Key capabilities: host, path and header based routing with load balancing; automatic Let's Encrypt certificates with storage on a dedicated data disk so issued certificates survive; a live web dashboard behind authentication; behavioural detection of scanning, crawling, brute force and known exploitation attempts; enforcement at the edge with a branded block page; SSH brute force protection as well as web; a whitelist so your own management networks can never be locked out; and support for reading the true client address when the instance sits behind a load balancer.

Traefik and the CrowdSec Security Engine are both distributed under the MIT licence, free and open source with no per user or per deployment fee. Traefik is a trademark of Traefik Labs and CrowdSec is a trademark of CrowdSec SAS; cloudimg is not affiliated with, sponsored by or endorsed by either project, and names them only to identify the software included. cloudimg provides packaging, the secure by default configuration, per instance credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.