Awesome CrowdSec

A curated list of awesome CrowdSec resources, bouncers, integrations, and tools.

CrowdSec is an open-source, crowd-powered security suite that detects and blocks malicious behavior using community-driven threat intelligence. Think Fail2Ban meets a global IP reputation network.

Contents

• Official Resources
• Bouncers
  • Firewall
  • Web Servers & Proxies
  • Cloud & CDN
  • CMS & Applications
  • Other Bouncers
• Firewall Integrations
• Web UIs & Management
• Blocklist & Threat Intelligence
• Docker Stacks & Examples
• Dashboards & Monitoring
• SIEM & Security Operations
• API Clients & SDKs
• Developer Tools
• Integrations

Official Resources

• crowdsec - The core detection engine that parses logs and applies behavioral scenarios.
• CrowdSec Console - Cloud console for fleet management, threat visualization, and CTI lookups.
• crowdsec-docs - Source repository for the official documentation.
• Documentation - Official documentation covering installation, configuration, and API usage.
• hub - Community-maintained parsers, scenarios, and collections for various log sources.
• sec-lists - Curated keyword and pattern lists used by CrowdSec scenarios.

Bouncers

Firewall

• crowdsec-unifi-bouncer - Syncs CrowdSec decisions to UniFi firewalls via the UniFi API with Docker support.
• cs-firewall-bouncer - Official bouncer supporting iptables, nftables, ipset, and pf on Linux/BSD.
• cs-firewall-bouncer-docker - Containerized version of the official firewall bouncer for Docker deployments.
• cs-mikrotik-bouncer-alt - Community MikroTik RouterOS bouncer using the REST API.
• cs-windows-firewall-bouncer - Official bouncer that manages Windows Firewall rules.

Web Servers & Proxies

• caddy-crowdsec-bouncer - Caddy module that blocks malicious traffic using CrowdSec decisions.
• crowdsec-bouncer-traefik-plugin - Traefik middleware plugin with IP verification and WAF support.
• cs-apache2-bouncer - Official Apache HTTP Server bouncer using mod_lua.
• cs-haproxy-bouncer - Official HAProxy bouncer using the Stream Processing Offload Engine.
• cs-haproxy-spoa-bouncer - HAProxy SPOE filter with WAF capabilities and IP-based protection (beta).
• cs-nginx-bouncer - Official Nginx bouncer using Lua for request filtering.
• cs-openresty-bouncer - OpenResty/Nginx bouncer with native Lua integration.
• envoy-proxy-crowdsec-bouncer - Lightweight remediation component for Envoy proxy.
• traefik-crowdsec-bouncer - Standalone HTTP verification service for Traefik forward auth.

Cloud & CDN

• cs-aws-waf-bouncer - Official bouncer that manages AWS WAF IP sets across regions.
• cs-cloudflare-bouncer - Syncs decisions to Cloudflare IP lists with multi-account and multi-zone support.
• cs-cloudflare-worker-bouncer - Edge-based bouncer using Cloudflare Workers for multi-zone setups.

CMS & Applications

• cs-standalone-php-bouncer - Drop-in PHP bouncer for any PHP application without framework dependencies.
• cs-wordpress-bouncer - WordPress plugin that blocks attackers or presents them with a captcha.
• php-cs-bouncer - PHP library for building custom bouncers in PHP applications.

Other Bouncers

• cs-custom-bouncer - Executes custom scripts on new or deleted CrowdSec decisions.

Firewall Integrations

• opnsense-plugin-crowdsec - OPNsense plugin for CrowdSec management via the web UI (archived).
• pfSense-pkg-crowdsec - Native pfSense package with dashboard widget and firewall integration.

Web UIs & Management

• crowdsec-web-ui - Responsive web interface for browsing alerts, decisions, and machine status.
• crowdsec_manager - Full-featured management dashboard built with Go and React, with Pangolin integration.

Blocklist & Threat Intelligence

• crowdsec-abuseipdb-blocklist - Imports AbuseIPDB blocklists as CrowdSec decisions.
• crowdsec-blocklist-import - Imports 120k+ IPs from 36 free threat feeds into CrowdSec decisions.

Docker Stacks & Examples

• caddy-docker-proxy-crowdsec - Caddy reverse proxy with automatic Docker service discovery and CrowdSec.
• Docker-Traefik - Production-ready media and home server stack with Traefik, CrowdSec, and OAuth2.
• example-docker-compose - Official reference Docker Compose configurations for common setups.
• mediastack - Comprehensive Docker media stack with automated downloads and CrowdSec protection.
• NPM-Crowdsec-Authentik-Stack - Nginx Proxy Manager with CrowdSec and Authentik SSO integration guide.
• ServerSecurityStack - Home server security stack combining Authelia, CrowdSec, Traefik, and Portainer.
• Single-Stack - All-in-one stack with Traefik, Authentik, CrowdSec, and Netbird VPN.
• traefik-crowdsec-stack - Step-by-step guide for deploying a Traefik and CrowdSec stack.

Dashboards & Monitoring

• grafana-dashboards - Official Grafana dashboards for visualizing CrowdSec metrics via Prometheus.

SIEM & Security Operations

• crowdsec-sentinel-playbook - Microsoft Sentinel playbook for automated IP reputation enrichment.
• crowdsec-splunk-app - Splunk app for ingesting and visualizing CrowdSec alerts and decisions.

API Clients & SDKs

• go-cs-bouncer - Go library for building custom bouncers against the CrowdSec Local API.
• nodejs-cs-bouncer - Node.js SDK for building bouncers and remediation components.

Developer Tools

• cs-log-replay-gui - Desktop GUI for replaying log files through CrowdSec scenarios for testing.

Integrations

• helm-charts - Official Helm charts for deploying CrowdSec on Kubernetes.
• home-assistant-addons - Home Assistant add-ons for running CrowdSec alongside home automation.
• spksrc-crowdsec - Native Synology NAS package built with SynoCommunity spksrc.
• crowdsec-unifi-parser - CrowdSec parsers and iptables LOG rules for UniFi Dream Machines — clean, parseable firewall logs from your UDM/UDR.
• crowdsec-unifi-suite - One-command installer for CrowdSec + UniFi security stack (bouncer + parser + blocklist-import).

Contributing

Contributions welcome! Read the contribution guidelines first.