automated-crowdsec-kamal

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

automated-crowdsec-kamal

★ 13 Open GitHub ↗

Automated CrowdSec intrusion detection and security monitoring for Kamal-deployed production VPS, with Telegram alerts.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CrowdSec for Kamal based Production VPS
[![Discord](https://img.shields.io/badge/AgentNexus-join%20the%20community-5865F2?logo=discord&logoColor=white)](https://discord.gg/V9C2kvHC8D)

Automated security monitoring and intrusion detection for your VPS using CrowdSec.

## What This Does

Protects your VPS from:
- SSH brute-force attacks
- HTTP path probing (`/.env`, `/wp-admin`, etc.)
- Automated scanning and reconnaissance
- Framework-specific attacks

All bans are **temporary** (4 hours by default) and you get **Telegram notifications** in real-time.

## Prerequisites

- **Task**: `brew install go-task`
- A VPS with SSH access
- (Optional) Telegram bot for notifications

## Quick Start

### 1. Copy and configure environment file

```bash
cp .env.sample .env
```

Edit `.env` with your values:

**Required:**
- `HOST_NAME`: Your VPS IP address
- `USER_NAME`: SSH username (usually `root`)
- `SSH_PRIVATE_KEY_PATH`: Path to SSH key (e.g., `~/.ssh/id_rsa`)
- `SSH_PORT`: SSH port (default `22`)
- `VPS_SETUP_DIR`: Where to install on VPS (default `/root/setup`)

**Optional (but recommended):**
- `TELEGRAM_API_KEY`: Get from [@BotFather](https://t.me/BotFather)
- `TELEGRAM_CHAT_ID`: Get from your group (see [telegram guide](telegram/telegram.md))

### 2. Deploy CrowdSec

```bash
task crowdsec:setup
```

This will:
- ✅ Install CrowdSec and firewall bouncer
- ✅ Install HTTP and SSH attack scenarios
- ✅ Deploy custom Docker log parsers
- ✅ Configure Telegram notifications (if keys provided)
- ✅ Run verification tests

### 3. Verify it's working

```bash
task crowdsec:verify
```

## What's Happening on Your VPS Right Now

Check if you're being attacked:

**SSH brute-force attempts:**
```bash
ssh $USER_NAME@$HOST_NAME "grep 'Failed password' /var/log/auth.log | tail -20"
```

**HTTP path probing:**
```bash
ssh $USER_NAME@$HOST_NAME "grep -E '\.env|wp-admin|phpMyAdmin' \$(docker inspect kamal-proxy --format '{{.LogPath}}')"
```

If you see results, **you're already being scanned**. You just weren't watching.

### Check CrowdSec Service Status

```bash
ssh $USER_NAME@$HOST_NAME "systemctl status crowdsec"
```

## Available Tasks

- `task crowdsec:setup` - Full installation and configuration
- `task crowdsec:verify` - Run verification checks
- `task crowdsec:upload` - Upload config changes to VPS
- `task crowdsec:clean` - Remove CrowdSec (for testing)

## How It Works

CrowdSec watches your logs and detects **behavioral patterns**:

1. **Logs** flow from SSH, Docker containers, web servers
2. **Parsers** extract structured data (IP, path, method, etc.)
3. **Scenarios** detect suspicious behavior (4+ sensitive paths in 5 seconds)
4. **Decisions** are created (ban for 4 hours)
5. **Bouncers** enforce bans (iptables, Cloudflare, etc.)

## Custom Parser Example

This repo includes custom parsers for **Kamal proxy** (Docker container logs in slog JSON format).

Parser chain:
- `s00-raw`: Docker log extraction
- `s01-parse`: Docker traffic tagging
- `s02-enrich`: Kamal proxy JSON parsing

See [setup/config/parsers/](setup/config/parsers/) for examples.

## Telegram Setup Guide

Detailed instructions in [telegram/telegram.md](telegram/telegram.md):

1. Create bot with @BotFather
2. Get chat ID from your group
3. Add to `.env`
4. Run `task crowdsec:setup`

## Security Note

- Never commit `.env` to version control
- Bans are **temporary by default** (4 hours)
- False positives auto-expire
- Everything is inspectable with `cscli` commands

## More Resources

- [CrowdSec docs](https://docs.crowdsec.net/)
- [CrowdSec Hub](https://hub.crowdsec.net/) (scenarios & parsers)

## Community

Questions, ideas, or built something with this? Join **[AgentNexus](https://discord.gg/V9C2kvHC8D)** — a Discord
for people building with AI agents and open tools. This project lives in **#other-tools**.

automated-crowdsec-kamal

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README