How-to

Enroll with the Community Console

This guide shows you how to enroll the kup6s LAPI instance with the CrowdSec Community Console after a clean Phase 2 block-mode observation period.

Prerequisites

Block-mode must be active and stable for at least three days. See phase-2-block-mode-rollout.

You need a CrowdSec.net account. Sign up at https://app.crowdsec.net — the account is free.

Step 1: Generate an enrollment token

Log in to app.crowdsec.net. In the left sidebar, select “Security Engines” then “Add Engine”. Copy the displayed enrollment key.

Step 2: Enroll the LAPI instance

Run the enrollment command:

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli console enroll <ENROLLMENT_KEY>

Expected output:

INFO Enrolled instance kup6s-lapi
INFO Watcher creation done
INFO Successfully enrolled. Please visit https://app.crowdsec.net to accept enrollment.

Step 3: Accept enrollment in the web UI

Return to app.crowdsec.net. Click the notifications bell at the top right and select “Pending engines”. Click “Accept” on the newly appeared engine.

Step 4: Verify enrollment

Check the console connection status:

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli console status

Expected output includes the enrolled instance name and the account email.

Browse the available blocklists in the CrowdSec web console (app.crowdsec.net → your engine → blocklists tab). CrowdSec v1.6.4 has no cscli blocklists subcommand — that family ships with CrowdSec v2.

Proceed to install-blocklists to enable curated premium blocklists selectively.

What is shared with CrowdSec

Enrollment opts your engine into telemetry to the CrowdSec cloud.

  • Engine version and uptime

  • Bouncer statistics (pull counts, decisions served)

  • Aggregated decision counts — not individual IPs

  • No customer data, no backend logs

This trade-off was accepted as part of the Phase 2 spec.

Disenroll if needed

CrowdSec v1.6.4 has no cscli console disenroll subcommand — cscli console only exposes enable, disable, enroll, and status. The disable verb toggles individual telemetry options (custom, manual, tainted, context, console_management), it does not disconnect the engine.

To fully disconnect from the Community Console on v1.6.4:

  1. In the CrowdSec web console (app.crowdsec.net), open the engine page for kup6s-lapi and use “Delete engine” (or the equivalent “Disenroll” action in the engine settings).

  2. On the LAPI pod, remove the console credentials so the engine stops pulling from PAPI:

    kubectl exec -n crowdsec deploy/crowdsec-lapi -- rm -f /etc/crowdsec/online_api_credentials.yaml
kubectl rollout restart -n crowdsec deploy/crowdsec-lapi

To stop forwarding telemetry without fully disconnecting, disable individual options:

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli console disable --all

After full disenrollment, premium blocklists stop updating. The default CAPI feed remains active and continues to provide community decisions.