WIUNIX ACADEMY
CrowdSec and Nginx: trustworthy logs, private LAPI and reversible IP bans
Page 5 of 5. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment7 editable values
Revoke one compromised bouncer identity
Recovery command, only when revocation is required; it is not part of the ordinary successful test.
sudo '/srv/academy-crowdsec/crowdsec-v1.8.1/cmd/crowdsec-cli/cscli' -c '/srv/academy-crowdsec/config/engine.yaml' bouncers delete 'academy_nginx'
Promote only after a real detection and recovery rehearsal
Before protecting a real site, review service supervision/nonroot permissions, a recoverable configuration snapshot and current release advisories. Rehearse synthetic public-IP scenario replay in an isolated environment: explain alone does not generate a scenario decision. Verify actual acquisition, parser fields, thresholds, alerts, profile decisions, bouncer enforcement, false-positive recovery and API outages. Record that acceptance separately from this loopback pilot.
For a CDN/proxy, restrict the origin to the reviewed immediate proxy networks and configure set_real_ip_from only for those exact current CIDRs. Choose its authenticated/overwritten header contract and real_ip_recursive behavior for the real chain; never trust0.0.0.0/0 or arbitrary X-Forwarded-For. Verify both direct-origin and forged-header requests before enabling enforcement. Log the validated remote_addr, not untrusted header text. Do not paste an illustrative proxy CIDR as a production trust list.
This guide does not enable a WAF, virtual patching, CAPTCHA, community blocklists, TLS, distributed LAPI, HA or reboot persistence. Community availability is not an SLA. Test the exact OS/package/runtime combination you will deploy, define log retention and patch review, and promote through your normal change/recovery process.
What was actually checked
Isolated review used engine1.8.1, bouncer1.2.3 and Ubuntu24.04 distribution Nginx/Lua inside a temporary container without published host ports. Real HTTP ban/unban/expiry, spoofed-header separation, API outage/restart, private registration and no-clobber refusals were checked. A separate18-line synthetic404 replay produced a real crowdsecurity/http-probing scenario/profile/LAPI decision, then removed only that synthetic source’s decision. No public target was contacted and no CAPI registration occurred.
The raw-release recipe explicitly installs syslog-logs (which also contains the non-syslog input stage) and dateparse-enrich before the Nginx collection; skipping these can leave raw nginx logs unparsed even when manual bans work. Hub content is mutable: record actual revisions and review changes before upgrading. Every OS path remains documented rather than fully installed/tested. Production services, firewall rules, credentials and real user logs were untouched. Reboot, HA, public TLS, CAPI, AppSec, CAPTCHA, stream mode and a production rollout were not tested.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
KEEP LEARNING