Secure Your Coolify Server & Websites with CrowdSec and Traefik

This guide shows you how to fully secure your Coolify server and all your hosted websites using CrowdSec. We’ll install CrowdSec on the host Ubuntu server, then connect it with a firewall bouncer, and protect all traffic globally via the CrowdSec Traefik plugin.

Why secure Coolify with CrowdSec as a firewall?

• CrowdSec Host Agent — protects your whole server (SSH, system-level)
• Firewall-Bouncer (nftables) — automatically blocks attackers at the network level
• CrowdSec Bouncer Plugin for Traefik — blocks bad IPs on the HTTP/HTTPS application layer
• Traefik Middleware Rule — applies to all domains without setting labels per website
• Lightweight & efficient — minimal resource usage, big security impact

If you want to apply CrowdSec protection only to your websites without protecting the whole server, follow the Protect Your Coolify Websites with CrowdSec Firewall guide instead.

Note: if you’re new to this, it’s best to test it on a development server before deploying to production.

What is CrowdSec?

CrowdSec is a community-powered, open-source intrusion prevention system (IPS). It analyzes server logs in real time, detects suspicious behaviour, and automatically blocks malicious IPs — all while learning from a global network of users.

Through the CrowdSec dashboard, you can:

• View attacker IPs and their origin
• Monitor attack patterns (XSS, SQLi, SSH brute-force, etc.)
• See risk scores and history
• Share decisions across servers

Here’s a visual to help you understand how everything fits together:

Step 1: Install CrowdSec on the Coolify host

To make your own Coolify firewall, install CrowdSec on your Coolify host server:

curl -s https://install.crowdsec.net | sudo bash
sudo apt install crowdsec

Check it’s running:

sudo systemctl status crowdsec

Make sure port 8080 is available on your host and not already used by any other containers like Traefik. You can change the port in /etc/crowdsec/config.yaml.

Change the listen URI:

sudo nano /etc/crowdsec/config.yaml

From:

listen_uri: 127.0.0.1:8080

To:

listen_uri: 0.0.0.0:8080

Don’t forget to restart the CrowdSec service:

sudo systemctl restart crowdsec

Step 2: Install the firewall bouncer (nftables)

sudo apt install crowdsec-firewall-bouncer-nftables -y
sudo systemctl enable crowdsec-firewall-bouncer-nftables --now

Check metrics:

sudo cscli metrics

Look for cs-firewall-bouncer under Local API Bouncers Metrics.

Integrate CrowdSec community with your infrastructure (optional)

Enrolling your CrowdSec agent with CrowdSec.net is completely optional. Without it, CrowdSec still works perfectly, analysing logs locally and blocking malicious IPs using your bouncers.

Connecting to the global console gives you access to a powerful web dashboard, threat intelligence from the community, geolocation data, and shared blocklists. For production environments, enrolment is recommended — but for development or privacy-focused setups, staying local is just fine.

CrowdSec offers three main ways to monitor and manage your security setup:

• Local dashboards via Metabase (optional Docker container)
• CrowdSec Console at app.crowdsec.net for centralised visibility and management
• CLI — built-in and easy to manage

To get started, sign up at https://app.crowdsec.net/signup, then enrol your instance by copying the generated command from your CrowdSec Console, and execute it inside your host terminal:

sudo cscli console enroll XXXXX

You should get something similar to this:

After running the command, go back to the console and approve the enrolment to activate your dashboard view.

At this point our Coolify + CrowdSec firewall is running — but it’s not yet analysing Traefik logs, so it won’t make any blocking decisions yet. To do that we’ll add a Remediation Component + Traefik logs.

Remediation components are what CrowdSec uses to take action (like blocking bad IPs). These actions are triggered by CrowdSec’s decision engine (LAPI), based on logs it parses from your applications like Traefik.

Step 3: Get the bouncer API key for Traefik

sudo cscli bouncers add traefik-bouncer

Copy the key shown — you’ll use it in the next step.

Step 4: Get Traefik ready for CrowdSec

Let’s start by setting up the Traefik Proxy with the CrowdSec plugin. This plugin acts as the Remediation Component, enabling Traefik to interact with CrowdSec. Then we’ll grant CrowdSec access to Traefik logs by mounting the appropriate access.log file into the Traefik container using a volume. This lets CrowdSec analyse traffic and apply real-time protection.

Create crowdsec-plugin.yaml inside Traefik

http:
  middlewares:
    crowdsec:
      plugin:
        crowdsec-bouncer:
          crowdsecMode: live
          crowdsecLapiHost: 'host.docker.internal:8080'
          crowdsecLapiKey: 'PASTE_YOUR_KEY_HERE'
          enabled: true

Update the Traefik docker-compose.yml

CrowdSec + Traefik integration. These make CrowdSec work as the middleware in front of Traefik:

- '--entrypoints.http.http.middlewares=crowdsec@file'
- '--entrypoints.https.http.middlewares=crowdsec@file'

If your websites use Cloudflare DNS, don’t forget to add these to Traefik:

- "--entryPoints.http.forwardedHeaders.insecure=true"
- "--entryPoints.https.forwardedHeaders.insecure=true"

Then add the plugin config:

- '--experimental.plugins.crowdsec-bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin'
- '--experimental.plugins.crowdsec-bouncer.version=v1.2.1'

Make sure to enable the access log for Traefik by adding this:

- '--accesslog=true'
- '--accesslog.format=json'
- '--accesslog.bufferingsize=0'
- '--accesslog.fields.headers.defaultmode=drop'
- '--accesslog.fields.headers.names.User-Agent=keep'
- '--accesslog.filepath=/traefik/access.log'

For more detailed logs from Traefik, add:

- '--log.level=INFO'

Then restart the Traefik container:

docker restart coolify-proxy

Last step: secure the Coolify server

We need to enable the parser for Traefik logs so the CrowdSec + Traefik integration works fully. Run:

cscli collections install crowdsecurity/traefik
sudo systemctl reload crowdsec

Add the Traefik logs to CrowdSec configs:

sudo nano /etc/crowdsec/acquis.yaml

Then add the Traefik log path:

filenames:
  - /data/coolify/proxy/access.log
labels:
  type: traefik
  log_type: http_access-log

Then restart CrowdSec and Traefik:

docker restart coolify-proxy
sudo systemctl restart crowdsec

Test that your secure Coolify server works

Use this to block an IP:

cscli decisions add -i 1.2.3.4 -d 10m

Try to visit any site from that IP and try to access SSH.

If you’re only interested in protecting your websites and not the rest of the server, check the other guide: Protect Your Coolify Websites with CrowdSec Firewall.

What about Fail2Ban? Do I still need it with CrowdSec on Coolify? Fail2Ban is a classic tool to block brute-force SSH and similar attacks. If you’re running CrowdSec with Traefik (as shown here), CrowdSec is already handling web-related attacks. For SSH protection, you can still use Fail2Ban or let CrowdSec handle it with an SSH scenario. A full Coolify + Fail2Ban guide is coming — stay tuned.

Final tips & summary

• CrowdSec Traefik bouncer protects all HTTP/HTTPS traffic.
• Firewall bouncer protects SSH & server ports.
• All logs are stored in /traefik/access.log.
• Use host.docker.internal to connect Traefik to the CrowdSec LAPI.

Result

You now have:

• Global HTTP + HTTPS protection for unlimited Coolify websites.
• System-level protection for SSH & critical server ports.
• Clean & scalable setup — no need to add per-project labels.
• Fully extensible — ready to add CrowdSec AppSec WAF if needed.

Bonus: next steps

Want even stronger protection? You can also enable Traefik AppSec WAF to block advanced web attacks (XSS, SQLi, CVEs). A full guide is coming — stay tuned.

Found this useful or inspiring? You can support my work — buy me a coffee. Every little bit helps keep the magic alive, and my brain awake.

Need help?

If you want a fully secured Coolify server, I offer consulting & setup services:

• CrowdSec Firewall + AppSec WAF
• Traefik optimisation
• Hardening SSH & system
• Monitoring & alerts
• Installing and managing Coolify

Reach out — happy to help you secure your server.