(2025-04-08, 09:57 AM)InTrusta Wrote: Don't have a solution, just wanted to give an fyi for tailscale. You can only add 3 users to tailscale, but you can add a lot more users through direct access to your NAS/Server. I think its around 100 or so. And it's even better, because normally i don't want my friends to see all my machienes in my taislcale network. I only want to give them access to my NAS.

I had the same problem as you and was about to set up the whole duckydns/reverse proxy setup, but then i read i can just add way more friends directly to the machiene. And i prefer tailscale because it's just super secure.

(2025-04-08, 01:20 PM)Duvel Wrote: If you want to use a DNS module you should build your own caddy image that includes the stuff for your specific DNS provider.

All custom images for all supported DNS providers are there : https://github.com/orgs/caddy-dns/repositories?type=all

You can add any other module you'd like to build the image you need

For instance my DNS provider is Infomaniak, and I also use the Crowdsec bouncer module on my Caddy to detect and block known attacks scenarios and offenders IPs, and so I build my caddy image with this docker command :

Code:

  FROM caddy:builder AS builder
 
  RUN xcaddy build \
      --with github.com/caddy-dns/infomaniak \
      --with github.com/hslatman/caddy-crowdsec-bouncer/http
 
  FROM caddy:latest
 
  COPY --from=builder /usr/bin/caddy /usr/bin/caddy

But all this will be tedious if you hardly master docker. And you will have to learn the fundamentals.

Once your image done, you should also configure properly the DNS parameters using a tls{} in your Caddyfile, for instance this is mine for infomaniak

Code:

*.domain.tld, domain.tld {

    crowdsec # this executes the CrowdSec module; if an IP is denied, it won't get access to the reverse proxy

        tls {
                dns infomaniak my_very_long_api_key_provided_by_infomaniak
                propagation_delay 60s
                propagation_timeout -1
        }

The parameters for your DNS might be different than mine, and you should find how to configure yours by yourself. There's generally some explanations on the readme of each caddy-dns sub-github

(2025-04-10, 07:14 AM)Duvel Wrote: This thread is turning into a "how to protect Jellyfin with Crowdsec" :-)

First of all in your config, you need 2 different API keys, because you have 2 components locally:
The LAPI server
The Caddy Bouncer

1. Your LAPI server should be registered with Crowdesc central servers, and you use the API key provided on your crowdsec.org CP

2. Your Caddy Bouncer should be registered with your LAPI server. It looks like you are stuck on that one.

In order to register your bouncer to your LAPI, you need to use the crowdsec cscli ( https://docs.crowdsec.net/docs/cscli/ )

If you have a normal install, you just do:

Code:

sudo clsci <commands>

If you have a docker container, then you should do :

Code:

sudo docker exec crowdsec cscli <command>

Example : list the machines

Code:

tom@cerbere:/opt/caddy$ sudo docker exec crowdsec cscli machines list
[sudo] password for tom:
-------------------------------------------------------------------------------------------------------------------------------
Name      IP Address  Last Update          Status  Version          OS                            Auth Type  Last Heartbeat
-------------------------------------------------------------------------------------------------------------------------------
localhost  127.0.0.1  2025-04-10T06:38:05Z  ✔️      v1.6.8-f209766e  Alpine Linux (docker)/3.21.3  password  39s
-------------------------------------------------------------------------------------------------------------------------------

Next, list the bouncers:

Code:

tom@cerbere:/opt/caddy$ sudo docker exec crowdsec cscli bouncers list
---------------------------------------------------------------------------------------------------------
Name                      IP Address  Valid  Last API pull        Type              Version  Auth Type
---------------------------------------------------------------------------------------------------------
caddy-bouncer@172.21.0.1  172.21.0.1  ✔️    2025-04-10T06:49:58Z  caddy-cs-bouncer  v0.8.1  api-key
---------------------------------------------------------------------------------------------------------

I believe you are stuck there, and your list is probably empty. You have not added your caddy bouncer, which should have generated an API key for your bouncer to connect to the LAPI.

To register your caddy bouncer, use the <cscli bouncers add caddy-bouncer> command:

Code:

$ sudo docker exec crowdsec cscli bouncers add caddy-bouncer
API key for 'caddy-bouncer':

  Q8iKI+FuQc7SGG2vXQWx7WMpxKeGj2UA0Baw5lUf5Zc

Please keep this key since you will not be able to retrieve it!

This is the API key that you should specify in your CaddyFile, there:
SERVICE-KEY-API-FROM-CROWDSEC-CONSOLE-SETTINGS

Once Caddyfile is adapted, restart caddy.

And then recheck your bouncers list and status with cscli bouncers list
--> You should now see your caddy-bouncer connected

(2025-04-10, 12:34 PM)Balinus Wrote: Wow, THANKS! It worked! I'm very happy with it.

We should sticky your post really, it's mostly "Guide" ready imho.

On my bouncers list, there is another one listed, can't remember if I installed that or not. Is there a way to "test" this bouncer?

Code:

sudo cscli bouncers list
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Name                            IP Address  Valid  Last API pull        Type                      Version                                                                  Auth Type
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
cs-firewall-bouncer-1744226856  127.0.0.1  ✔️    2025-04-10T12:29:06Z  crowdsec-firewall-bouncer  v0.0.31-debian-pragmatic-amd64-4b99c161b2c1837d76c5fa89e1df83803dfbcc87  api-key
caddy-bouncer                  127.0.0.1  ✔️    2025-04-10T12:28:32Z  caddy-cs-bouncer          v0.8.1                                                                  api-key
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────