selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 12/13: CrowdSec next to fail2ban, and an AppSec WAF in Caddy

Browse source 
Measured on the demo box against the same 24h of real traffic.

Episode 12 (detection, blocklist, firewall):
- crowdsec/ with install notes and the traps: port 8080 clash, empty first
  blocklist pull, replay forensic-mode dropping events (FIFO workaround),
  ssh-time-based-bf shipping remediation:false, the AppSec collections that
  refuse to start without extra rules.
- firewall bouncer in nftables mode (input + forward), which blocks
  Docker-published ports and survives ufw reload; iptables/DOCKER-USER does not.
- HARDENING.md episode 12 section with the numbers: fail2ban 4 banned IPs vs
  CrowdSec 23 detected / 1 blocked, blocklist overlap 50% of IPs but 19% of
  attempts, and the mode=normal blind spot for key-only root attempts.

Episode 13 (AppSec WAF):
- caddy/Dockerfile now builds the CrowdSec bouncer and AppSec handler alongside
  rate-limit, pinned to v0.14.1.
- Caddyfile imports a crowdsec snippet (bouncer + appsec) on every site except
  vpn; compose passes CROWDSEC_BOUNCER_KEY and host.docker.internal.
- Measured: virtual patching blocks known CVEs only (7 of 41 probes, near-zero
  false positives); OWASP CRS raises that to 27 of 41 but breaks git push and
  wiki editing at default paranoia. Default stays vpatch+generic.

fail2ban config unchanged. No secrets or real domains/IPs in tracked files.
This commit is contained in:
Maximilian Grimm 2026-09-16 20:34:18 +02:00
parent d147f21490
commit 88670f028f
11 changed files with 280 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
caddy/Dockerfile
View file

@ -1,9 +1,13 @@
# episode 10: the stock caddy:2-alpine image cannot rate limit. The directive
# lives in a plugin (github.com/mholt/caddy-ratelimit) that has to be compiled
# in with xcaddy - there is no runtime "enable" for it. Two stages so the final
# image stays the same small alpine, just with our own caddy binary.
# in with xcaddy - there is no runtime "enable" for it.
# episode 12: same trick for CrowdSec. The bouncer (http) and the AppSec
# handler (appsec) are plugins too, pinned to a release tag instead of @main.
FROM caddy:2-builder-alpine AS builder
RUN xcaddy build --with github.com/mholt/caddy-ratelimit
RUN xcaddy build \
--with github.com/mholt/caddy-ratelimit \
--with github.com/hslatman/caddy-crowdsec-bouncer/http@v0.14.1 \
--with github.com/hslatman/caddy-crowdsec-bouncer/appsec@v0.14.1
FROM caddy:2-alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy