same package are removed

[vahidalvandi]

I found you through this tutorial and my goal is to control ddos for crowdsec but some of the packages introduced give 404 error. Please explain is it enough to use only this repo?

https://www.crowdsec.net/blog/secure-caddy-crowdsec-remediation-waf-guide

[hslatman]

Hey @vahidalvandi,

Can you be more specific about what returns a 404?

[vahidalvandi]

Hey @vahidalvandi,

Can you be more specific about what returns a 404?

xcaddy build
--with github.com/mholt/caddy-l4
--with github.com/caddyserver/transform-encoder
--with github.com/hslatman/caddy-crowdsec-bouncer/http@main
--with github.com/hslatman/caddy-crowdsec-bouncer/appsec@main
--with github.com/hslatman/caddy-crowdsec-bouncer/layer4@main

this line repo 404

--with github.com/hslatman/caddy-crowdsec-bouncer/http@main \
--with github.com/hslatman/caddy-crowdsec-bouncer/appsec@main \
--with github.com/hslatman/caddy-crowdsec-bouncer/layer4@main

[hslatman]

I don't know why you would be getting a 404 on that. The repository is right here, and the paths haven't changed. Is your Go installation clean? Are you using a different GOPROXY or proxy in general?

[alex3305]

I have the 'same issue', but I noticed that caddy-l4 broke my build. Not caddy-crowdsec.

RUN xcaddy build \
    --with github.com/hslatman/caddy-crowdsec-bouncer/http \
    --with github.com/hslatman/caddy-crowdsec-bouncer/layer4 \
    --with github.com/hslatman/caddy-crowdsec-bouncer/appsec \
    --with github.com/mholt/caddy-l4

Yields a

go: downloading github.com/mholt/caddy-l4 v0.0.0-20250814163833-b0a5a508a938
go: accepting indirect upgrade from github.com/cloudflare/circl@v1.6.0 to v1.6.1
go: accepting indirect upgrade from github.com/quic-go/quic-go@v0.50.1 to v0.54.0
go: github.com/mholt/caddy-l4@v0.0.0-20250814163833-b0a5a508a938 requires
  github.com/caddyserver/caddy/v2@v2.10.1-0.20250720214045-8ba7eefd0767, but v2.10.0 is requested
go: github.com/mholt/caddy-l4@upgrade (v0.0.0-20250814163833-b0a5a508a938) requires github.com/caddyserver/caddy/v2@v2.10.1-0.20250720214045-8ba7eefd0767, not github.com/caddyserver/caddy/v2@v2.10.0 2025/08/19 11:05:36 [FATAL] exit status 1

But

RUN xcaddy build \
    --with github.com/hslatman/caddy-crowdsec-bouncer/http \
    --with github.com/hslatman/caddy-crowdsec-bouncer/layer4 \
    --with github.com/hslatman/caddy-crowdsec-bouncer/appsec

Builds just fine.

The issue was introduced in mholt/caddy-l4#316. A workaround would be to use the previous commit hash:

RUN xcaddy build \
    --with github.com/hslatman/caddy-crowdsec-bouncer/http \
    --with github.com/hslatman/caddy-crowdsec-bouncer/layer4 \
    --with github.com/hslatman/caddy-crowdsec-bouncer/appsec \
    --with github.com/mholt/caddy-l4@4d3c80e89c5f80438a3e048a410d5543ff5fb9f4

[hslatman]

Thank you, @alex3305!

So it seems there's a version conflict. Didn't expect that that would result in a 404.

I believe there's not much I can do on my side to get this to work, outside maybe updating examples to use that commit. The Matcher interface depends on the layer4.Connection type, so it's not possible to not depend on it when using the layer4 module. Maybe caddy-l4 can be amended to allow for a certain interface to be injected, so that there's no hard requirement on the module when implementing a matcher/handler, but haven't looked too much into that yet.

That said, you'll only need layer4 if blocking must be performed on TCP/UDP layer, so it is only required when Caddy is built with github.com/hslatman/caddy-crowdsec-bouncer/layer4.

[vahidalvandi]

Open this and same links

github.com/hslatman/caddy-crowdsec-bouncer/appsec@main

[hslatman]

Open this and same links

github.com/hslatman/caddy-crowdsec-bouncer/appsec@main

I don't get what you're trying to do. This is not a URL you open in a browser; it's how the module gets addressed by xcaddy, and in turn Go.

[vahidalvandi]

One question: Why should I use this plugin when Crowdsec itself has a scenario for scanning caddy access logs?

[alex3305]

@hslatman I'm not 100% sure, but I think your layer4 plugin should also include mholt/caddy-l4 as a dependency. So omitting that dependency should also probably work... Maybe? 🤔

As someone who uses Renovate a lot I despise not being able to pin versions of Caddy plugins. Recently I spent an hour trying to get it working with a custom Caddy build instead of xcaddy. But I got nowhere and gave up (for now). On the other hand I find breaking builds in this way and than calling it 'experimental' while the first version being released 5 years ago pretty stubborn and narrow minded 🤷.

The error thrown by xcaddy / Go are somewhat obtuse if you aren't used to them. So I understand @vahidalvandi's confusion. But understand @vahidalvandi that the URI's that @hslatman refers to are URI's referring to Go packages. They aren't human browsable like you would expect.

One question: Why should I use this plugin when Crowdsec itself has a scenario for scanning caddy access logs?

Because this plugin is a CrowdSec bouncer.

[LaurenceJJones]

One question: Why should I use this plugin when Crowdsec itself has a scenario for scanning caddy access logs?

Might be best to look at the introduction page on CrowdSec documentation to understand the different components and how they interact with each other.

tldr; CrowdSec detects bad behaviours (IDS), this plugin enforces the decisions made by CrowdSec (IPS)