WIUNIX ACADEMY
CrowdSec and Nginx: trustworthy logs, private LAPI and reversible IP bans
Page 2 of 5. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment7 editable values
LET’S BUILD
Download the reviewed upstream releases
The latest-release APIs checked2026-10-21 report engine1.8.1 and bouncer1.2.3; both repositories are not archived. These fixed hashes are the bytes independently downloaded for this review, not a vendor signature or a promise of future support. Inspect the upstream release and security notes before a later upgrade. Do not run either archive’s installer: the lab copies no service configuration into system directories.
Dedicated disposable VM · terminal
set -eu
sudo curl --fail --location --proto '=https' --tlsv1.2 --output '/srv/academy-crowdsec/downloads/engine.tgz' https://github.com/crowdsecurity/crowdsec/releases/download/v1.8.1/crowdsec-release.tgz
sudo curl --fail --location --proto '=https' --tlsv1.2 --output '/srv/academy-crowdsec/downloads/bouncer.tgz' https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/v1.2.3/crowdsec-nginx-bouncer.tgz
printf '%s\n' 'ae64cdab8ee49534d6c36eab4ce40b5478842a4b4abfe83f7796aace569821eb /srv/academy-crowdsec/downloads/engine.tgz' '8cb0c176f01bda3a5fc5493d20bcd7261630c7dfbd60c00b2bff8eefc8fe84d5 /srv/academy-crowdsec/downloads/bouncer.tgz' | sudo sha256sum --check
sudo tar --extract --gzip --no-same-owner --file '/srv/academy-crowdsec/downloads/engine.tgz' --directory '/srv/academy-crowdsec'
sudo tar --extract --gzip --no-same-owner --file '/srv/academy-crowdsec/downloads/bouncer.tgz' --directory '/srv/academy-crowdsec'
sudo cp -r '/srv/academy-crowdsec/crowdsec-v1.8.1/config/patterns' '/srv/academy-crowdsec/config/patterns'
sudo luarocks --tree '/srv/academy-crowdsec/rocks' install lua-resty-http 0.17.1-0
sudo '/srv/academy-crowdsec/crowdsec-v1.8.1/cmd/crowdsec/crowdsec' -version
Both SHA256 checks say OK, private release directories exist and engine reports1.8.1.
LET’S BUILD
Edit the isolated engine files
Open each reserved file in the following panels. Save the exact YAML; the intentionally absent online_client section and -no-capi prevent community-API communication. LAPI is loopback-only; local machine credentials authenticate the log processor, while a separate API key authenticates the bouncer.
Dedicated disposable VM · terminal
sudo nano '/srv/academy-crowdsec/config/engine.yaml' '/srv/academy-crowdsec/config/acquis.yaml' '/srv/academy-crowdsec/config/profiles.yaml' '/srv/academy-crowdsec/config/simulation.yaml'
Four dedicated files saved; no system CrowdSec configuration changed.
Engine and local API
File content, not a shell command.
common:
daemonize: false
log_media: file
log_level: info
log_dir: /srv/academy-crowdsec/logs
config_paths:
config_dir: /srv/academy-crowdsec/config
data_dir: /srv/academy-crowdsec/data
simulation_path: /srv/academy-crowdsec/config/simulation.yaml
hub_dir: /srv/academy-crowdsec/hub
index_path: /srv/academy-crowdsec/hub/.index.json
notification_dir: /srv/academy-crowdsec/notifications
plugin_dir: /srv/academy-crowdsec/plugins
crowdsec_service:
acquisition_path: /srv/academy-crowdsec/config/acquis.yaml
parser_routines: 1
cscli:
output: human
db_config:
type: sqlite
db_path: /srv/academy-crowdsec/data/crowdsec.db
use_wal: false
api:
client:
credentials_path: /srv/academy-crowdsec/config/local-api.yaml
server:
listen_uri: 127.0.0.1:18081
profiles_path: /srv/academy-crowdsec/config/profiles.yaml
trusted_ips:
- 127.0.0.1
prometheus:
enabled: true
level: full
listen_addr: 127.0.0.1
listen_port: 18082
Acquire only this Nginx access log
File content, not a shell command.
filenames:
- /srv/academy-crowdsec/logs/access.log
labels:
type: nginx
Short decisions for local IP alerts
File content, not a shell command.
name: local_ip_ban
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
- type: ban
duration: 2m
on_success: break
Explicit lab simulation setting
File content, not a shell command.
simulation: false