Improve CrowdSec hardening and reverse proxy troubleshooting - #917
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 33 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe documentation updates clarify reverse-proxy access-log fields and expand CrowdSec setup, verification, enforcement, allowlists, dashboard protection, recovery, and troubleshooting procedures for self-hosted deployments. ChangesCrowdSec and reverse-proxy documentation
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This PR improves CrowdSec and reverse proxy setup, verification, monitoring, and recovery guidance. No actionable merge-blocking risk remains after normal checks and review. Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/manage/reverse-proxy/access-logs.mdx`:
- Around line 79-83: Split the two top-level JSON examples in the access-log
documentation into separate json fences, keeping each object unchanged so every
fenced example is independently valid JSON.
- Line 12: Update the adjacent image alt text near the Access Logs description
to use the renamed “Access Logs” dashboard view instead of “Proxy Events table,”
while preserving the existing image and surrounding documentation.
- Line 62: Update the access-log field descriptions in the table around the
“Auth Method,” “Reason,” and “Denied requests” entries to match the HTTP API
contract: document that auth_method_used contains the restriction code, reason
contains “Authentication failed” for authentication failures and “Request
failed” for later request failures, and keep the descriptions consistent with
the existing HTTP note.
In `@src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx`:
- Around line 397-399: Update the CrowdSec troubleshooting documentation to
distinguish AppSec outage behavior from NetBird Proxy’s initial-sync fail-closed
behavior. Keep the statement that crowdsecAppsecUnreachableBlock=true denies
dashboard requests when AppSec is unreachable, but remove the broader claim that
every later LAPI outage denies all reverse-proxy traffic unless that post-sync
behavior is explicitly verified.
- Around line 316-332: Remove the optional Traefik API health-check
configuration, including --api.insecure=true and the internal API router checks,
from the maintenance documentation. Direct the monitoring guidance to use the
external /.env probe instead, treating HTTP 403 as the healthy response; do not
recommend exposing the unauthenticated API on the shared Docker network.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e86d2b90-877a-4f54-901c-d1367701d645
📒 Files selected for processing (4)
src/pages/manage/reverse-proxy/access-logs.mdxsrc/pages/selfhosted/maintenance/crowdsec-dashboard.mdxsrc/pages/selfhosted/maintenance/crowdsec.mdxsrc/pages/selfhosted/migration/enable-reverse-proxy.mdx
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx (1)
338-391: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winInclude Central API decisions in the lockout diagnosis.
cscli decisions listhides CAPI-sourced decisions by default. A community blocklist decision can therefore be mistaken for AppSec. Query the affected IP with--alland filter AppSec alerts by the same IP:ip="<your-ip>" docker compose exec -T crowdsec cscli decisions list --ip "$ip" --all docker compose exec -T crowdsec cscli alerts list --ip "$ip" --kind waf --limit 0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx` around lines 338 - 391, Update the lockout diagnosis section around “cscli decisions list” to include Central API decisions by querying the affected address with --all, and distinguish those results from AppSec matches. Add the corresponding AppSec alert query filtered by the same IP and kind waf, using the established shell variable pattern, before the allowlisting guidance.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/manage/reverse-proxy/access-logs.mdx`:
- Around line 40-42: Update the access-log field descriptions in the table
around “Auth Method,” “User,” and “Reason” to match the raw /api/events/proxy
fields: list auth methods as oidc, password, pin, and header; state that empty
auth_method_used values are omitted and credential failures retain only the
attempted method when available; clarify the exact reason values; and document
that denied L4 entries store the restriction code in auth_method_used while
omitting reason.
In `@src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx`:
- Around line 316-322: Update the external monitoring guidance around the
`https://<your-domain>/.env` probe to also cover the protected `/api` router by
adding `https://<your-domain>/api/.env`, or explicitly state that the existing
check covers only the dashboard router. Preserve the instruction to keep the
unauthenticated Traefik API disabled.
---
Outside diff comments:
In `@src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx`:
- Around line 338-391: Update the lockout diagnosis section around “cscli
decisions list” to include Central API decisions by querying the affected
address with --all, and distinguish those results from AppSec matches. Add the
corresponding AppSec alert query filtered by the same IP and kind waf, using the
established shell variable pattern, before the allowlisting guidance.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0ec487e1-2236-4ed4-87d3-dc8e22bd71c8
📒 Files selected for processing (2)
src/pages/manage/reverse-proxy/access-logs.mdxsrc/pages/selfhosted/maintenance/crowdsec-dashboard.mdx
640f2be to
8b67f29
Compare
2 participants
Description
This PR expands the self-hosted CrowdSec and reverse proxy documentation with clearer setup, verification, monitoring, and recovery guidance. It documents observed CrowdSec behavior across access logs, community decisions, AppSec protection, and dashboard lockouts so operators can validate their deployment and recover safely when enforcement behaves unexpectedly.
Changes
NB_PROXY_PRIVATE.Summary by CodeRabbit