Secure Your Coolify Server & Websites with CrowdSec and Traefik

This guide shows you how to add a strong security layer to your Coolify server and all your hosted websites using CrowdSec. We’ll install CrowdSec on the host Ubuntu server, then connect it with a firewall bouncer, and protect all traffic globally via the CrowdSec Traefik plugin.

Updated and production-tested: September 2026

This is the setup I tested on my production server:

• Coolify 4.3.18
• CrowdSec 1.8.1
• crowdsec-firewall-bouncer-nftables 0.0.36
• Traefik 3.7.13
• CrowdSec Traefik plugin 1.7.1
• Ubuntu 24.04 LTS

CrowdSec analyses behaviour from logs, the nftables bouncer blocks decisions at server level, and the Traefik plugin blocks them for HTTP and HTTPS traffic. That lets one CrowdSec installation protect SSH, other server ports, and every website running through Coolify’s proxy. These are tested versions from my setup, not a claim that they are the latest releases.

If you are still configuring the server itself, start with configure Coolify and deploy your first project before adding this security layer.

Why secure Coolify with CrowdSec as a firewall?

• CrowdSec Host Agent — protects your whole server (SSH, system-level)
• Firewall-Bouncer (nftables) — automatically blocks attackers at the network level
• CrowdSec Bouncer Plugin for Traefik — blocks bad IPs on the HTTP/HTTPS application layer
• Traefik Middleware Rule — applies to all domains without setting labels per website
• Lightweight & efficient — minimal resource usage, big security impact

The basic setup detects suspicious behaviour, consumes CrowdSec decisions, and blocks malicious IPs. It is not automatically the same as a request-inspection WAF; that is what the optional AppSec section covers later.

If you want to apply CrowdSec protection only to your websites without protecting the whole server, follow the Protect Your Coolify Websites with CrowdSec Firewall guide instead.

Note: if you’re new to this, it’s best to test it on a development server before deploying to production.

What is CrowdSec?

CrowdSec is a community-powered, open-source intrusion prevention system (IPS). It analyses server logs in real time, detects suspicious behaviour, and automatically blocks malicious IPs — all while learning from a global network of users.

Through the CrowdSec dashboard, you can:

• View attacker IPs and their origin
• Monitor alerts, scenarios, malicious IP activity, and brute-force or probing behaviour
• See risk scores and history
• Share decisions across servers

Here’s a visual to help you understand how everything fits together:

Step 1: Install CrowdSec on the Coolify host

To make your own Coolify firewall, install CrowdSec on your Coolify host server:

curl -s https://install.crowdsec.net | sudo bash
sudo apt install crowdsec

Check it’s running:

sudo systemctl status crowdsec

Make sure port 8080 is available on your host and not already used by any other containers like Traefik. You can change the port in /etc/crowdsec/config.yaml.

Change the listen URI:

sudo nano /etc/crowdsec/config.yaml

From:

listen_uri: 127.0.0.1:8080

To:

listen_uri: 0.0.0.0:8080

The old 8080 example is kept here because it shows what the original setup needed. Do not leave the CrowdSec LAPI open to the public Internet just so Traefik can reach it from Docker.

On my production server, I use a dedicated LAPI port instead:

listen_uri: 0.0.0.0:18101

Traefik reaches the host through host.docker.internal:18101. If your LAPI listener needs to bind outside localhost for Docker connectivity, your cloud-provider firewall and host firewall must still block public access to TCP port 18101. Only the Docker-to-host path needed by your setup should be able to reach it.

Don’t forget to restart the CrowdSec service:

sudo systemctl restart crowdsec
sudo systemctl is-active crowdsec

Step 2: Install the firewall bouncer (nftables)

sudo apt install crowdsec-firewall-bouncer-nftables -y
sudo systemctl enable --now crowdsec-firewall-bouncer

Check metrics:

sudo cscli metrics
sudo cscli bouncers list
sudo systemctl is-active crowdsec-firewall-bouncer

Look for cs-firewall-bouncer under Local API Bouncers Metrics.

Integrate CrowdSec community with your infrastructure (optional)

Enrolling your CrowdSec agent with CrowdSec.net is completely optional. CrowdSec continues to work locally without Console enrolment, analysing logs locally and blocking malicious IPs using your bouncers.

Connecting to the global console gives you access to a powerful web dashboard, threat intelligence from the community, geolocation data, and shared blocklists. For production environments, enrolment is recommended — but for development or privacy-focused setups, staying local is just fine.

CrowdSec offers two main ways to monitor and manage your security setup:

• CrowdSec Console at app.crowdsec.net for centralised visibility and management
• CLI — built-in and easy to manage

Older CrowdSec installations may have used a local Metabase dashboard, but the CrowdSec Console is the current graphical interface.

To get started, sign up at https://app.crowdsec.net/signup, then enrol your instance by copying the generated command from your CrowdSec Console, and execute it inside your host terminal:

sudo cscli console enroll XXXXX

You should get something similar to this:

After running the command, go back to the console and approve the enrolment to activate your dashboard view.

At this point our Coolify + CrowdSec firewall is running — but it’s not yet analysing Traefik logs, so it cannot make HTTP decisions based on your websites’ Traefik traffic yet. To do that we’ll add a Remediation Component + Traefik logs.

Remediation components are what CrowdSec uses to take action (like blocking bad IPs). These actions are triggered by CrowdSec’s decision engine (LAPI), based on logs it parses from your applications like Traefik.

Step 3: Get the bouncer API key for Traefik

sudo cscli bouncers add traefik-bouncer

Copy the key shown — you’ll use it in the next step.

Step 4: Get Traefik ready for CrowdSec

Let’s start by setting up the Traefik Proxy with the CrowdSec plugin. This plugin acts as the Remediation Component, enabling Traefik to interact with CrowdSec. Traefik writes its JSON access log inside the proxy at /traefik/access.log. Coolify’s proxy volume makes that file available on the host as /data/coolify/proxy/access.log, which CrowdSec reads through /etc/crowdsec/acquis.yaml. This lets CrowdSec analyse traffic and apply real-time protection.

In the current Coolify layout, the main proxy configuration is /data/coolify/proxy/docker-compose.yml, and reusable file-provider configuration belongs in /data/coolify/proxy/dynamic/. Coolify manages Traefik and generated application routing, so make the smallest changes necessary.

Create crowdsec-plugin.yaml inside Traefik

http:
  middlewares:
    crowdsec:
      plugin:
        crowdsec-bouncer:
          crowdsecMode: live
          crowdsecLapiHost: 'host.docker.internal:18101'
          crowdsecLapiKey: 'PASTE_YOUR_KEY_HERE'
          enabled: true

Update the Traefik docker-compose.yml

CrowdSec + Traefik integration. These make CrowdSec work as the middleware in front of Traefik:

- '--entrypoints.http.http.middlewares=crowdsec@file'
- '--entrypoints.https.http.middlewares=crowdsec@file'

If your websites are actually proxied through Cloudflare, not merely using Cloudflare for DNS, Traefik and the CrowdSec plugin need to trust only Cloudflare’s proxy IP ranges. Configure Traefik’s forwardedHeaders.trustedIPs and the plugin’s forwardedHeadersTrustedIPs using the current ranges from Cloudflare’s official IP-range documentation.

Then add the plugin config:

- '--experimental.plugins.crowdsec-bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin'
- '--experimental.plugins.crowdsec-bouncer.version=v1.7.1'

The plugin version above is the version tested during my September 2026 upgrade, not necessarily the latest release.

For Traefik 3.7, I also used these entrypoint options:

- '--entrypoints.http.http.aliasHeadersStrategy=delete'
- '--entrypoints.https.http.aliasHeadersStrategy=delete'

This removes alias-style request headers before they reach the backend. Check that your applications do not intentionally rely on unusual header names before enabling it, because legitimate non-standard headers can also be removed.

See Traefik’s entrypoint documentation for the current option details.

Make sure to enable the access log for Traefik by adding this:

- '--accesslog=true'
- '--accesslog.format=json'
- '--accesslog.bufferingsize=0'
- '--accesslog.fields.headers.defaultmode=drop'
- '--accesslog.fields.headers.names.User-Agent=keep'
- '--accesslog.filepath=/traefik/access.log'

For more detailed logs from Traefik, add:

- '--log.level=INFO'

Then restart the Traefik container:

docker restart coolify-proxy

Last step: secure the Coolify server

We need to enable the parser for Traefik logs so the CrowdSec + Traefik integration works fully. Run:

sudo cscli collections install crowdsecurity/traefik
sudo systemctl reload crowdsec

Add the Traefik logs to CrowdSec configs:

sudo nano /etc/crowdsec/acquis.yaml

Then add the Traefik log path:

filenames:
  - /data/coolify/proxy/access.log
labels:
  type: traefik
  log_type: http_access-log

Then restart CrowdSec and Traefik:

docker restart coolify-proxy
sudo systemctl restart crowdsec

After restarting, check the services again:

sudo systemctl is-active crowdsec
sudo systemctl is-active crowdsec-firewall-bouncer
sudo cscli bouncers list

Optional: Add CrowdSec AppSec WAF

The setup above detects suspicious behaviour, uses CrowdSec decisions, and blocks malicious IPs. It is not automatically a request-inspection WAF.

If you need protection against application-layer attacks, CrowdSec AppSec can inspect requests and use virtual-patching rules for known CVEs, SQL injection patterns, XSS patterns, and other attacks. It is an optional extra configuration, so follow the official CrowdSec Traefik AppSec documentation and test it with your application before enabling blocking.

How I safely update this Coolify security stack

This is how I update it safely on my production server:

1. Create an external VPS snapshot or backup.
2. Check Coolify backups and preserve the Coolify APP_KEY.
3. Update Ubuntu and the base packages.
4. Update Coolify and verify that it is working.
5. Update CrowdSec and the firewall bouncer, then check both services.
6. Update the CrowdSec Traefik plugin.
7. Update Traefik and inspect its startup warnings.
8. Update Docker separately instead of mixing every major component into one operation.
9. Test the websites, SSH, CrowdSec decisions, and logs.

These are the checks I use after an upgrade:

sudo crowdsec -version
systemctl is-active crowdsec
systemctl is-active crowdsec-firewall-bouncer
sudo cscli bouncers list
sudo cscli metrics
docker ps

If dpkg reports a package left partially configured, I diagnose that before rebooting. I don’t blindly reinstall the whole stack to hide an unresolved package or service error.

Test that your secure Coolify server works

Use a disposable test address for a few minutes. <TEST_PUBLIC_IP> must be the public IP of a connection you control, and it must not be the IP of your active SSH connection.

sudo cscli decisions add -i <TEST_PUBLIC_IP> -d 10m

Try to visit any site from that IP and try to access SSH. The firewall bouncer should enforce the decision at server level, and the Traefik middleware should block the HTTP/HTTPS request.

Remove the test decision afterwards:

sudo cscli decisions delete -i <TEST_PUBLIC_IP>

Also check that the Traefik access log is receiving requests, sudo cscli metrics shows the Traefik acquisition, and TCP port 18101 is not reachable from the public Internet.

What about Fail2Ban? Do I still need it with CrowdSec on Coolify? Not automatically. CrowdSec can handle SSH scenarios itself. Fail2Ban is still useful if you want a simple, local SSH brute-force layer, but you don’t automatically need both. If you prefer that approach, see the guide to secure Coolify SSH with Fail2Ban.

Final tips & summary

• CrowdSec Traefik bouncer protects all HTTP/HTTPS traffic.
• Firewall bouncer protects SSH & server ports.
• The host log is stored at /data/coolify/proxy/access.log and is mounted as /traefik/access.log inside the proxy container.
• Use host.docker.internal:18101 to connect Traefik to the CrowdSec LAPI.

Result

You now have:

• Global HTTP + HTTPS protection for unlimited Coolify websites.
• System-level protection for SSH & critical server ports.
• Clean & scalable setup — no need to add per-project labels.
• Fully extensible — ready to add CrowdSec AppSec WAF if needed.

Bonus: next steps

Want even stronger protection? CrowdSec AppSec can add request inspection and virtual patching for advanced web attacks, but it needs its own configuration and testing. Don’t treat the basic firewall and Traefik setup as a WAF.

CrowdSec and Coolify FAQ

Is CrowdSec a firewall for Coolify?

CrowdSec is the security engine that analyses logs and makes decisions. In this setup, the nftables firewall bouncer enforces those decisions on the server, while the Traefik plugin enforces them for HTTP and HTTPS traffic.

Does CrowdSec protect SSH and Coolify websites?

Yes, when both bouncers are configured. The firewall bouncer protects SSH and other server ports, while the Traefik plugin protects websites routed through Coolify.

Do I need Fail2Ban if I use CrowdSec?

Not automatically. CrowdSec can handle SSH scenarios itself, while Fail2Ban remains useful if you want a simple local SSH brute-force layer. Running both is optional and should be based on what you actually need to monitor and block.

Does CrowdSec protect against SQL injection and XSS?

The basic setup here is not a request-inspection WAF, so it should not be described as protection against SQL injection or XSS. Those application-layer checks require the optional CrowdSec AppSec component and its compatible Traefik configuration.

Does Coolify use Traefik?

Yes. Traefik is the reverse proxy Coolify uses in this setup, handling the application routes and HTTPS traffic for the websites you deploy.