To pass through the correct IP, you will need to enable thereal-ipplugin for traefik.
Restart Containers
cd /opt/appdata/vaultwarden; sudo docker-compose up -d
cd /opt/appdata/crowdsec; sudo docker-compose up -d
Traefik Bouncer
The aim here is to implement a CrowdSec bouncer for the router Traefik to block malicious IP to access your services. For this, it leverages Traefik v2 ForwardAuth middleware and query CrowdSec with client IP. If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual.
Flow of information
What is a parser?
Parsers take log formats and breaks it into readable information for the CrowdSec app. We will be using the Traefik parser to take the Traefik access logs and pass that information over to the CrowdSec app to make decisions.
What is a bouncer?
Bouncers react to decision made by CrowdSec. In this case, the Traefik bouncer will take the decision made by CrowdSec and either allow or deny the traffic going through Traefik. CrowdSec on its own will just make the decisions to ban IP's. It will do this by connecting back to the mothership to get the information required to make the decisions locally.
A scenario is a behaviour, i.e. is it a brute force attack that is happening. You can choose which Scenarios you would like to check the traffic against. In this Traefik collection, we will be using the typical http behaviours.