How-to

Enroll with the Community Console

This guide shows you how to enroll the kup6s LAPI instance with the CrowdSec Community Console after a clean Phase 2 block-mode observation period.

Prerequisites

Block-mode must be active and stable for at least three days. See phase-2-block-mode-rollout.

You need a CrowdSec.net account. Sign up at https://app.crowdsec.net — the account is free.

Step 1: Generate an enrollment token

Log in to app.crowdsec.net. In the left sidebar, select “Security Engines” then “Add Engine”. Copy the displayed enrollment key.

Step 2: Enroll the LAPI instance

Run the enrollment command:

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli console enroll <ENROLLMENT_KEY>

Expected output:

INFO Enrolled instance kup6s-lapi
INFO Watcher creation done
INFO Successfully enrolled. Please visit https://app.crowdsec.net to accept enrollment.

Step 3: Accept enrollment in the web UI

Return to app.crowdsec.net. Click the notifications bell at the top right and select “Pending engines”. Click “Accept” on the newly appeared engine.

Step 4: Verify enrollment

Check the console connection status:

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli console status

Expected output includes Connected and your account email.

List available blocklists (initially none are active):

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli blocklists list

The list now shows curated premium blocklists. Proceed to install-blocklists to enable them selectively.

What is shared with CrowdSec

Enrollment opts your engine into telemetry to the CrowdSec cloud.

  • Engine version and uptime

  • Bouncer statistics (pull counts, decisions served)

  • Aggregated decision counts — not individual IPs

  • No customer data, no backend logs

This trade-off was accepted as part of the Phase 2 spec.

Disenroll if needed

If you ever want to disconnect from the Community Console:

kubectl exec -n crowdsec deploy/crowdsec-lapi -- cscli console disenroll

Premium blocklists stop updating after disenrollment. The default CAPI feed remains active.