#
# =============================================================================
# GENERAL CONFIGURATION
# =============================================================================
# APP_NAME = name of application for use in scripts
# HOST_INSTALL = true means apt + systemd install on the host, not Docker
# HOST_PACKAGE = dpkg package name; drives the "installed" badge
# HOST_SERVICES = all units; feeds the Services + Logs tabs
# HOST_LOG_FILES = <unit>|<path>,... mapping for the log viewer
# BACKUP = include in backup operations
# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed; ships the official CrowdSec Grafana dashboards)
# PROMETHEUS_LISTEN = address CrowdSec's metrics endpoint binds to; must be reachable from the Prometheus container (default: all interfaces, port 6060 — keep the :6060 port)
#
CFG_CROWDSEC_APP_NAME=crowdsec
# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
# apps whose compose identity (container_name, Traefik routers, backup labels)
# is instance-safe — see scripts/instance/instance_create.sh.
# Not instanced by design. CrowdSec ships no docker-compose.yml at all — it is a
# host-level security agent plus Traefik bouncer, not a composed app, so there is
# no service identity for `instance create` to clone. It is also a singleton by
# nature: one decision engine watching the whole box is the point.
CFG_CROWDSEC_MULTI_INSTANCE=false
CFG_CROWDSEC_HOST_INSTALL=true
CFG_CROWDSEC_HOST_PACKAGE=crowdsec
CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
CFG_CROWDSEC_HOST_LOG_FILES="crowdsec.service|/var/log/crowdsec.log,crowdsec-firewall-bouncer.service|/var/log/crowdsec-firewall-bouncer.log"
CFG_CROWDSEC_BACKUP=true
CFG_CROWDSEC_BACKUP_STRATEGY=auto
CFG_CROWDSEC_UPDATE_TYPE=auto
CFG_CROWDSEC_MONITORING=false
CFG_CROWDSEC_PROMETHEUS_LISTEN=0.0.0.0:6060
#
# =============================================================================
# BEHAVIOUR
# =============================================================================
# ENABLED = master switch; false disables services (package stays)
# AUTO_UPDATE = pull hub parser/scenario updates from hub.crowdsec.net
# COMMUNITY_BLOCKLIST = subscribe to the free pooled blocklist (CAPI)
# CONSOLE_ENROLL = enroll this agent with the hosted SaaS at app.crowdsec.net (NOT the local dashboard)
# CONSOLE_TOKEN = enrollment token from app.crowdsec.net (only used when CONSOLE_ENROLL=true)
# BOUNCER = attach the Traefik bouncer middleware to every public route
#
CFG_CROWDSEC_ENABLED=true
CFG_CROWDSEC_COMMUNITY_BLOCKLIST=true
CFG_CROWDSEC_CONSOLE_ENROLL=false
CFG_CROWDSEC_CONSOLE_TOKEN=
CFG_CROWDSEC_BOUNCER=true
#
# =============================================================================
# METADATA
# =============================================================================
# CATEGORY = grouping in the app grid
# TITLE = display name
# DESCRIPTION = one-liner
# LONG_DESCRIPTION = card body text
# URL = source / docs link
# ACTIONS = available lifecycle verbs
#
CFG_CROWDSEC_CATEGORY="security,recommended"
CFG_CROWDSEC_TITLE="CrowdSec"
CFG_CROWDSEC_DESCRIPTION="Intrusion Prevention"
CFG_CROWDSEC_LONG_DESCRIPTION="An open-source intrusion prevention system: it spots brute-force, scans and web exploits in your logs and blocks the offending IPs at the firewall"
CFG_CROWDSEC_URL="https://www.crowdsec.net"
CFG_CROWDSEC_ACTIONS="configure|install|restart|shutdown|uninstall|tools"
#
# =============================================================================
# ADVANCED
# =============================================================================
# LAPI_HOST = LAPI bind address; 0.0.0.0 so Traefik can reach via host.docker.internal
# TRAEFIK_LAPI_KEY = auto-generated on install; use the "Rotate Traefik Bouncer Key" tool to replace it (editing this value does not re-register the bouncer)
#
CFG_CROWDSEC_LAPI_HOST=0.0.0.0:8080
CFG_CROWDSEC_TRAEFIK_LAPI_KEY=