Has anyone been able to set up dockerized CrowdSec in front of
dockerized NPM using official images only?
reddit / selfhosted

----------------------------------------------------------------------
BillGoats · 2023-11-18 13:24

# Background

I recently made an effort to harden my network due to (technically)
exposing more of it with [FireZone](https://www.firezone.dev/)
(WireGuard). For the curious, I shared some details in a recent [comme
nt](https://reddit.com/r/selfhosted/comments/17x9zsm/exposing_selfhost
ed_services_to_internet_for/k9opm9l/?context=3). I didn't mention it
in the comment, but I also set up local DNS
([Technitium](https://technitium.com/dns)) with block lists.

I'm approaching a point where I'm comfortable with my setup security-
wise, but I'm missing a couple of things still: A solid firewall and
proper backups. In this post, I'm interested in discussing the former.

NPM serves as the primary entrypoint into my server. For a while I
considered looking into putting fail2ban in front of it, but then I
came across [CrowdSec](https://www.crowdsec.net) which seems like a
superior solution. And so I started looking into how to implement it
alongside NPM.

There's an [official guide](https://www.crowdsec.net/blog/crowdsec-
with-nginx-proxy-manager), but it relies on a fork of a fork ([Docker
Hub](https://hub.docker.com/r/lepresidente/nginx-proxy-manager)) of
NPM, which seems unsustainable. I also found [this guide](https://old.
reddit.com/r/selfhosted/comments/13xknsk/guide_crowdsec_nginx_proxy_ma
nager_cloudflare/) in a reddit post, which relies on a fork of the
official image. However, it looks like the image is no longer hosted
on Docker Hub.

[Here](https://github.com/NginxProxyManager/nginx-proxy-
manager/issues/1131) is the (NPM) GitHub issue where the "fork of a
fork" image came into existence (`lepresidente/nginx-proxy-manager`).
It has some interesting discussions about the challenges of having NPM
and CrowdSec coexist and cooperate.

## tl;dr
I can't find any documentet, successful attempt at having CrowdSec
function in front of Nginx Proxy Manager. The solutions that are
publicly documentet, even officially by CrowdSec, rely on forks of
NPM.

---

# Conclusions

I feel like it should be possible to have the two services work
together with the official images. Probably with a relatively complex
setup. If anyone has made this work somehow, I'd be very happy to look
at your docker-compose files.

Thanks for reading.

----------------------------------------------------------------------
TerminalFoo · 2023-11-18 13:54

The short answer is yes.

----------------------------------------------------------------------
BillGoats · 2023-11-18 14:05

Can you point me to a long answer?

----------------------------------------------------------------------
TerminalFoo · 2023-11-18 14:13

When I am behind a proper keyboard.

----------------------------------------------------------------------
BillGoats · 2023-11-18 14:16

Thanks. Looking forward to it!

----------------------------------------------------------------------
javijuji · 2023-11-18 18:45

If you are running proxmox then you can use tteks NPM lxc script and
add the crowdsec script on top of that. Took me about 2 minutes with
the downside of running something someone else set up instead of going
step by step.