AppSec ignores X-Crowdsec-Appsec-Ip header from Caddy bouncer, uses connection source IP instead
hslatman/caddy-crowdsec-bouncer
, and ruled it out a plugin issue - https://github.com/hslatman/caddy-crowdsec-bouncer/issues/91
Let me know if anyone has a suggestion for where to dig next....Collection Not Banning
LePresidente/overseerr-logs
....
Same IP banned twice 2 hours apart?

Re: the 6 Aug announcement about updating
prevent notifications for manual add ip/range or use own custom blocklist
Helm chart add allowlist
Openresty bouncer disconnects from CrowdSec
Docker based log parser not connecting to Opnsense running LAPI
sudo cscli lapi register -u http://192.168.20.1:8080
command on my crowdsec docker it says its successful and saves the creds into local_api_credentials.yaml. I then stopped the docker and edit config.yaml in the docker server and disable the server api. On the Opnsense lapi i validate the machine. now whenever trying to start the crowdsec docker it will not start successfully. It gets stuck in a loop of crashing over and over. This can be found in the logs:
...
About Hub collections
cscli alerts list -i not showing all alerts
cscli alerts list -i
is not showing all alerts for the provided ip.
`cscli alerts list
ā ID ā value ā reason
[...] ...Ban immediately after scenario is triggered
LAPI whitelist
No target_host in AppsecAlerts
Viewing / deleting decisions with cscli
cscli decisions list
I see one decision, related to my earlier testing. If I cscli decisions delete <id>
it says the decision was deleted, then when i check the list again there's a new decision in the list with a decremented ID number. Seems like there were ~19 from one run with nikto
. Is it normal to not see all decisions in the list? Is there a way to view / delete them all?Remove allow list for local addresses?
Is my caddy setup missing anything?

Unmarshal JSON warnings
docker logs -f crowdsec
```
time="2025-08-02T19:12:53+10:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "traefik") in ["", nil]\n | ^" id=falling-water name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-08-02T19:12:53+10:00" level=error msg="UnmarshalJSON : invalid character 'u' looking for beginning of value" line="uestMethod":"POST","RequestPath":"/plugins/unassigned.devices.preclear/include/Preclear.php","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"apollo@file","ServiceAddr":"10.0.0.100:8088","ServiceName":"apollo@file","ServiceURL":"http://10.0.0.100:8088/\",\"StartLocal\":\"2025-08-02T19:12:53.673292055+10:00\",\"TLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"TLSVersion\":\"1.3\",\"entryPointName\":\"https\",\"level\":\"info\",\"msg\":\"\",\"time\":\"2025-08-02T19:12:53+10:00\"}"...2FA-Authentifizierung
Inconsistencies between web, cscli, and ipset
Console-connection gets stalled when container is restarted
/var/lib/crowdsec/data
to my host and I have no issues with crowdsec in generall surviging restarts of the container. It's just the console that resets and looses the connection to the conolse.
It doesn't tell me that it lost the connection when I run cscli console status
but when I log into the console I see it's complaining and that I have no updates in the console where the LAPI has updates.
From what I've read, the path above is the only one of interest to survivie restarts, thus I'm unsure why this happens....