How to Set Up CrowdSec Dashboard with Docker Compose: A Step-by-Step Guide

X (Twitter) Facebook Pinterest LinkedIn

CrowdSec is an open-source and collaborative security suite designed to protect servers, virtual machines, services, and containers by analyzing behavior and responding to attacks. It uses crowd-sourced threat intelligence to identify and block potential threats. The CrowdSec dashboard is an essential component that provides a comprehensive overview of your security posture. It makes monitoring and managing threats more manageable. This article is a guide to help you set up the CrowdSec dashboard using Docker Compose. It simplifies deployment and enhances your cybersecurity infrastructure.

Table of Contents

Prerequisites

Before starting, ensure you have:

Docker installed on your system.
Docker Compose installed on your system.
Basic familiarity with Docker concepts and the YAML syntax used in Docker Compose files.

Step 1: Prepare Your Environment

Create a directory dedicated to your CrowdSec setup. This directory will contain your Docker Compose file (docker-compose.yml) and any additional configuration files or directories you might need.

mkdir crowdsec-docker && cd crowdsec-docker

Step 2: Create a Docker Compose File

Create the docker-compose.yml file:

touch docker-compose.yml

Open this file in a text editor and insert the following configuration:

version: '3.8'
services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    environment:
      GID: "1000"
      UID: "1000"
    volumes:
      - ./crowdsec_data:/var/lib/crowdsec/data
      - ./crowdsec_config:/etc/crowdsec
    ports:
      - "8080:8080"
    restart: unless-stopped

  cs-dashboard:
    image: crowdsecurity/cs-dashboard:latest
    container_name: cs-dashboard
    depends_on:
      - crowdsec
    ports:
      - "3000:80"
    environment:
      DASHBOARD_LISTEN_PORT: "80"
      DASHBOARD_LISTEN_IP: "0.0.0.0"
      API_URL: "http://crowdsec:8080/"
    restart: unless-stopped

  cs-nginx:
    image: crowdsecurity/cs-nginx-bouncer:latest
    container_name: cs-nginx
    depends_on:
      - crowdsec
    environment:
      COLLECTIONS: crowdsecurity/nginx
      KAFKA_ADVERTISE_ADDR: "crowdsec:9092"
      API_KEY: "<your_crowdsec_bouncer_api_key>"
      API_URL: "http://crowdsec:8080/"
    restart: unless-stopped

Configuration Explained:

crowdsec: Configures the CrowdSec container, specifying user/group IDs for file permissions and mapping volumes for persistent data and configuration.
cs-dashboard: Sets up the CrowdSec dashboard container, linking it to the CrowdSec service for data access and configuring it to listen on port 3000.
cs-nginx: Deploys an instance of CrowdSec’s Nginx bouncer to protect web applications by filtering traffic based on CrowdSec decisions.
volumes: Declares named volumes for data persistence and configuration storage.
ports: Exposes ports for accessing the CrowdSec API (8080), dashboard (3000), and Nginx bouncer.

Step 3: Launch CrowdSec and Dashboard

With your docker-compose.yml file ready, start the CrowdSec services by running:

docker compose up -d

This command will download the necessary Docker images (if not already present) and start the CrowdSec, dashboard, and Nginx bouncer containers in detached mode.

Step 4: Access CrowdSec Dashboard

Once the containers are up and running, you can access the CrowdSec dashboard by navigating to http://localhost:3000 in your web browser. The dashboard provides a real-time view of security events, alerts, and system status, allowing you to monitor and respond to threats effectively.

Step 5: Configure and Monitor Security

After accessing the dashboard, you can further configure CrowdSec according to your security needs. This involves setting up additional bouncers, fine-tuning security policies, and integrating with other tools for enhanced protection. Regularly check the dashboard to stay informed about potential security incidents and ensure your infrastructure remains secure.

Conclusion

By deploying the CrowdSec dashboard using Docker Compose, you can significantly improve your cybersecurity posture in a streamlined manner. This guide will enable you to set up a robust security monitoring solution that leverages crowd-sourced intelligence to protect you against threats. Docker Compose simplifies the management of CrowdSec services, making it easy to deploy, scale, and maintain your security infrastructure. Whether you need to secure a single server or an entire cloud environment, CrowdSec provides the necessary tools and insights to effectively safeguard your digital assets.

Author
Recent Posts

Follow me

Anastasios Antoniadis

Anastasios Antoniadis is the founder and editor-in-chief of BORDERPOLAR... He is a software engineer, blogger, and avid gamer covering tech, gaming, and coding guides for over 4 years. He is a 2014 graduate of the Department of Informatics and Telecommunications of the University of Athens, an M.Sc. holder in Computer Science, and a Ph.D. student in Program Analysis.