Refactor Traefik and CrowdSec integration: remove CrowdSec configurations and update middleware settings for enhanced access control

docker-compose.yml

@@ -15,7 +15,6 @@ volumes:
   portainer_data:
   umami_db_data:
   authelia_data:
-  crowdsec_data:
   prometheus_data:
   grafana_data:
   uptime_kuma_data:
@@ -26,7 +25,7 @@ volumes:
 services:
 
   ## ─────────────────────────────────────────────
-  ## Traefik — edge router + ACME (HTTP-01) + CrowdSec plugin
+  ## Traefik — edge router + ACME (HTTP-01)
   ## ─────────────────────────────────────────────
   traefik:
     image: traefik:v3.1
@@ -70,10 +69,6 @@ services:
       - --accesslog.filepath=/var/log/traefik/access.log
       - --accesslog.bufferingsize=100
       - --log.level=INFO
-
-      # CrowdSec Traefik plugin (recommended vs sidecar)
-      - --experimental.plugins.crowdsecbouncer.moduleName=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-      - --experimental.plugins.crowdsecbouncer.version=v1.4.4
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - traefik_letsencrypt:/letsencrypt
@@ -95,18 +90,12 @@ services:
       - traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true
       - traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
 
-      # CrowdSec plugin middleware (reusable)
-      - traefik.http.middlewares.crowdsec-plugin.plugin.crowdsecbouncer.enabled=true
-      - traefik.http.middlewares.crowdsec-plugin.plugin.crowdsecbouncer.crowdseclapiurl=http://crowdsec:8080/
-      - traefik.http.middlewares.crowdsec-plugin.plugin.crowdsecbouncer.crowdseclapikey=${CROWDSEC_BOUNCER_KEY}
-      - traefik.http.middlewares.crowdsec-plugin.plugin.crowdsecbouncer.crowdsecmode=stream
-
       # Traefik dashboard (protected)
       - traefik.http.routers.traefik.rule=Host(`traefik.gate.${DOMAIN}`)
       - traefik.http.routers.traefik.entrypoints=websecure
       - traefik.http.routers.traefik.tls.certresolver=le
       - traefik.http.routers.traefik.service=api@internal
-      - traefik.http.routers.traefik.middlewares=crowdsec-plugin,security-headers
+      - traefik.http.routers.traefik.middlewares=authelia,security-headers
 
   ## ─────────────────────────────────────────────
   ## Portainer — Docker control plane
@@ -124,7 +113,7 @@ services:
       - traefik.http.routers.portainer.rule=Host(`portainer.gate.${DOMAIN}`)
       - traefik.http.routers.portainer.entrypoints=websecure
       - traefik.http.routers.portainer.tls.certresolver=le
-      - traefik.http.routers.portainer.middlewares=crowdsec-plugin,authelia,security-headers
+      - traefik.http.routers.portainer.middlewares=authelia,security-headers
       - traefik.http.services.portainer.loadbalancer.server.port=9000
 
   ## ─────────────────────────────────────────────
@@ -159,7 +148,7 @@ services:
       - traefik.http.routers.umami.rule=Host(`umami.gate.${DOMAIN}`)
       - traefik.http.routers.umami.entrypoints=websecure
       - traefik.http.routers.umami.tls.certresolver=le
-      - traefik.http.routers.umami.middlewares=crowdsec-plugin,authelia,security-headers
+      - traefik.http.routers.umami.middlewares=authelia,security-headers
       - traefik.http.services.umami.loadbalancer.server.port=3000
 
   ## ─────────────────────────────────────────────
@@ -174,7 +163,6 @@ services:
       TZ: "${TZ}"
     volumes:
       - ./authelia/configuration.yml:/config/configuration.yml:ro
-      - ./authelia/users_database.yml:/config/users_database.yml:ro
       - authelia_data:/config
     networks: [traefik_proxy, internal]
     labels:
@@ -192,33 +180,6 @@ services:
     restart: unless-stopped
     networks: [internal]
 
-  ## ─────────────────────────────────────────────
-  ## CrowdSec (LAPI) — with Traefik plugin
-  ## ─────────────────────────────────────────────
-  crowdsec:
-    image: crowdsecurity/crowdsec:latest
-    container_name: crowdsec
-    restart: unless-stopped
-    environment:
-      TZ: "${TZ}"
-      GID: "0"
-      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/linux"
-    volumes:
-      - crowdsec_data:/var/lib/crowdsec/data
-      - ./crowdsec/local_api_server.yaml:/etc/crowdsec/local_api_server.yaml:ro
-      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
-      - traefik_logs:/var/log/traefik:ro
-    networks: [traefik_proxy]
-
-  # Auto-register the API key used by the Traefik plugin
-  crowdsec-init:
-    image: crowdsecurity/crowdsec:latest
-    container_name: crowdsec-init
-    depends_on: [crowdsec]
-    entrypoint: sh -c "cscli bouncers add traefik-bouncer -k ${CROWDSEC_BOUNCER_KEY} || true && sleep 2"
-    networks: [traefik_proxy]
-    restart: "no"
-
   ## ─────────────────────────────────────────────
   ## Uptime Kuma — status page / checks
   ## ─────────────────────────────────────────────
@@ -234,7 +195,7 @@ services:
       - traefik.http.routers.kuma.rule=Host(`status.gate.${DOMAIN}`)
       - traefik.http.routers.kuma.entrypoints=websecure
       - traefik.http.routers.kuma.tls.certresolver=le
-      - traefik.http.routers.kuma.middlewares=crowdsec-plugin,authelia,security-headers
+      - traefik.http.routers.kuma.middlewares=authelia,security-headers
       - traefik.http.services.kuma.loadbalancer.server.port=3001
 
   ## ─────────────────────────────────────────────
@@ -253,7 +214,7 @@ services:
       - traefik.http.routers.prom.rule=Host(`prometheus.gate.${DOMAIN}`)
       - traefik.http.routers.prom.entrypoints=websecure
       - traefik.http.routers.prom.tls.certresolver=le
-      - traefik.http.routers.prom.middlewares=crowdsec-plugin,authelia,security-headers
+      - traefik.http.routers.prom.middlewares=authelia,security-headers
       - traefik.http.services.prom.loadbalancer.server.port=9090
 
   cadvisor:
@@ -298,5 +259,5 @@ services:
       - traefik.http.routers.grafana.rule=Host(`grafana.gate.${DOMAIN}`)
       - traefik.http.routers.grafana.entrypoints=websecure
       - traefik.http.routers.grafana.tls.certresolver=le
-      - traefik.http.routers.grafana.middlewares=crowdsec-plugin,authelia,security-headers
+      - traefik.http.routers.grafana.middlewares=authelia,security-headers
       - traefik.http.services.grafana.loadbalancer.server.port=3000