Protect your Coolify websites with CrowdSec Firewall

Self-hosting apps with Coolify and Traefik v3? Want a firewall to protect your apps from bad bots, abuse, and attacks? This guide shows how to install and configure CrowdSec on Coolify with Traefik v3 using the CrowdSec bouncer plugin — the easy way.

Perfect for people hosting many websites with Docker and Traefik on a Coolify server.

Note: this setup is to protect your websites only. It does not work as a firewall to protect your full server (SSH, other ports, system-level attacks). If you want to protect your entire Coolify server as a firewall, check the Strong firewall to secure your Coolify server & websites with CrowdSec and Traefik guide.

What is CrowdSec?

CrowdSec is a free, open-source security engine that protects your servers from malicious traffic. It works like Fail2Ban but smarter — it analyzes logs, blocks bad IPs, and shares threat intelligence with the community.

What you’ll need

• Coolify self-hosted on a Linux server
• Traefik v3 running as your reverse proxy (already installed by Coolify)
• Docker + Docker Compose (already installed by Coolify)
• Root access (or sudo)

Step 1: Deploy CrowdSec via Docker Compose

Create a container for CrowdSec and make sure it is connected to the Coolify network:

version: '3.8'
services:
  crowdsec:
    image: 'crowdsecurity/crowdsec:latest'
    container_name: crowdsec
    expose:
      - "8080"
    environment:
      GID: '${GID-1000}'
      COLLECTIONS: 'crowdsecurity/linux crowdsecurity/traefik'
    volumes:
      - 'crowdsec-db:/var/lib/crowdsec/data'
      - './crowdsec/config:/etc/crowdsec/'
      - './crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml'
      - '/data/coolify/proxy:/traefik'
    networks:
      - coolify
    security_opt:
      - 'no-new-privileges:true'
    restart: unless-stopped

volumes:
  crowdsec-db: null
networks:
  coolify:
    external: true

The /etc/crowdsec/acquis.yaml file should contain:

filenames:
  - /traefik/access.log
labels:
  type: traefik

Step 2: Configure Traefik

In your docker-compose.yml for Traefik, add these under command:

• Add the CrowdSec Traefik plugin:

  - '--experimental.plugins.crowdsec-bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin'
  - '--experimental.plugins.crowdsec-bouncer.version=v1.2.1'

• Enable the access log for Traefik as a file:

  - '--accesslog=true'
  - '--accesslog.filepath=/traefik/access.log'

• To watch the Traefik live logs you might also need to add this:

  - '--accesslog=true'

• And apply the CrowdSec middleware globally:

  - '--entrypoints.http.http.middlewares=crowdsec@file'
  - '--entrypoints.https.http.middlewares=crowdsec@file'

This applies protection to all your websites without needing labels per app.

Step 3: Create the CrowdSec middleware

Create a file /data/coolify/proxy/dynamic/crowdsec-plugin.yaml:

http:
  middlewares:
    crowdsec:
      plugin:
        crowdsec-bouncer:
          crowdsecMode: live
          crowdsecLapiHost: 'crowdsec:8080'
          crowdsecLapiKey: your_lapi_key_here
          enabled: true

You can generate the LAPI key inside the container using:

docker exec -it crowdsec cscli bouncers add traefik-bouncer

Step 4: Protect all sites automatically

CrowdSec is now applied globally via middleware. You don’t need to add labels to every website anymore.

Optional: you can still use a HostRegexp('.+') router if you want extra filtering or to block specific paths.

Now block yourself to test:

docker exec -it crowdsec cscli decisions add -i 1.2.3.4 -d 30m

Unblock yourself:

docker exec -it crowdsec cscli decisions delete -i YOUR.IP.ADDRESS

And that’s it — all good now. You’re ready to leave your server alone ;)

What about Fail2Ban? Do I still need it with CrowdSec on Coolify? Fail2Ban is a classic tool for blocking brute-force SSH and similar attacks. If you’re running CrowdSec with Traefik (as shown here), CrowdSec is already handling web-related attacks. For SSH protection, you can still use Fail2Ban or let CrowdSec handle it with an SSH scenario. A full Coolify + Fail2Ban guide is coming — stay tuned.

Final thoughts

With this setup, your Coolify-hosted websites now have an extra layer of protection powered by CrowdSec. You are automatically protected from common web attacks such as:

• WordPress or any website with admin probes
• Sensitive file scanning
• CVE-based attacks
• XSS, SQLi, and more

And the beauty is: the protection is applied globally — no need to configure each site manually.

What’s next?

If you want to protect your entire Coolify server (including SSH and non-HTTP services), check the full guide: Secure Your Coolify Server & Websites with CrowdSec and Traefik.

Need help?

Need help setting up CrowdSec, installing or securing your Coolify server, or optimising your infrastructure? I offer personal consulting and setup services:

• CrowdSec & Fail2Ban setup
• Traefik hardening
• Coolify hosting setup and security
• Performance tuning & monitoring

Bonus: I can also review your current setup and suggest improvements — even if you already have CrowdSec installed.

Reach out — happy to help you secure your server.