traefik: add CrowdSec bouncer plugin + global fail-open middleware #77

2026-06-27T11:05:29Z

k.renner commented

2026-06-27 11:05:29 +00:00

Tier 4, part 2 of 2 — enforcement (the higher-risk half). Pairs with #76 (detection).

Closes the CrowdSec gap: the LAPI has had no registered bouncer acting on its decisions since the ingress-nginx Lua bouncer was retired (2026-05-17).

helmrelease: loads the Yaegi plugin github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin@v1.6.0 via experimental.plugins, and attaches it to the websecure entrypoint so it applies to every router (global enforcement, like the old ingress-nginx bouncer).
crowdsec-middleware.yaml: the Middleware, querying the LAPI at crowdsec-service.crowdsec.svc.cluster.local:8080 (verified service name) with the pre-registered bouncer key (already in the ingress ns Secret + committed plaintext).

Fail-open by design (updateMaxFailure: -1, streamStartupBlock: false): Traefik is the only ingress, so a CrowdSec/LAPI outage must never black-hole every app. Tradeoff: during a LAPI outage, banned IPs briefly get through. Tighten later if wanted.

⚠️ Outage risk on apply. Merging restarts Traefik via Flux, and Traefik downloads the plugin from GitHub at startup. Egress from the ingress namespace is unrestricted (verified — ingress-default-deny is ingress-only), so the download should succeed and the plugin pin is a known-good release. But a failed plugin load = Traefik won't start = ingress outage. Watch the Traefik rollout after merge; if it doesn't go Ready, revert this PR. Recommend merging during a window where you can watch it.

Verified beforehand: LAPI reachable from Traefik (netpol crowdsec-ns already allows ingress/traefik → crowdsec:8080); bouncer key pre-registered (BOUNCER_KEY_ingress); plugin v1.6.0 supports Traefik v3.

🤖 Generated with Claude Code

Tier 4, part 2 of 2 — **enforcement** (the higher-risk half). Pairs with #76 (detection). Closes the CrowdSec gap: the LAPI has had no registered bouncer acting on its decisions since the ingress-nginx Lua bouncer was retired (2026-05-17). - **helmrelease**: loads the Yaegi plugin `github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin@v1.6.0` via `experimental.plugins`, and attaches it to the `websecure` entrypoint so it applies to **every** router (global enforcement, like the old ingress-nginx bouncer). - **crowdsec-middleware.yaml**: the `Middleware`, querying the LAPI at `crowdsec-service.crowdsec.svc.cluster.local:8080` (verified service name) with the pre-registered bouncer key (already in the `ingress` ns Secret + committed plaintext). **Fail-open by design** (`updateMaxFailure: -1`, `streamStartupBlock: false`): Traefik is the only ingress, so a CrowdSec/LAPI outage must never black-hole every app. Tradeoff: during a LAPI outage, banned IPs briefly get through. Tighten later if wanted. > ⚠️ **Outage risk on apply.** Merging restarts Traefik via Flux, and Traefik **downloads the plugin from GitHub at startup**. Egress from the `ingress` namespace is unrestricted (verified — `ingress-default-deny` is ingress-only), so the download should succeed and the plugin pin is a known-good release. But a failed plugin load = Traefik won't start = ingress outage. **Watch the Traefik rollout after merge; if it doesn't go Ready, revert this PR.** Recommend merging during a window where you can watch it. Verified beforehand: LAPI reachable from Traefik (netpol `crowdsec-ns` already allows `ingress/traefik → crowdsec:8080`); bouncer key pre-registered (`BOUNCER_KEY_ingress`); plugin v1.6.0 supports Traefik v3. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-27 11:05:30 +00:00

traefik: add CrowdSec bouncer plugin + global fail-open middleware b43e641f64

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 5aa5e158b7 into master

2026-06-27 11:06:15 +00:00

k.renner referenced this issue from a commit

2026-06-27 11:06:16 +00:00

Merge pull request 'traefik: add CrowdSec bouncer plugin + global fail-open middleware' (#77) from traefik-crowdsec-bouncer into master

k.renner referenced this issue from a commit

2026-06-27 11:10:15 +00:00

traefik: fix bouncer middleware attachment (schema-invalid key)

k.renner referenced this pull request

2026-06-27 11:10:29 +00:00

fix(traefik): bouncer middleware attachment used a schema-invalid key #78

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#77