Reference

Configuration reference¶

Lookup reference for CrowdSec configuration values in kup6s. Each table documents the live cluster state as of Phase 2.

Code sources¶

The configuration is split across three repositories.

What	Path
Engine helm values	`dp-infra/crowdsec/charts/constructs/engine.ts`
Middleware CRDs (plugin config)	`dp-infra/crowdsec/charts/constructs/middlewares.ts`
Traefik plugin loader	`kube-hetzner/clusters/kup6s/traefik_overrides.yaml`
Secret bridges (ESO)	`dp-infra/crowdsec/charts/constructs/traefik-secret-bridge.ts` and `secret-store.ts`
Config defaults	`dp-infra/crowdsec/config.yaml`

The crowdsec-bouncer Middleware CRD passes these keys to the plugin runtime.

Key	Value in `kup6s`	Description
`Enabled`	`"true"`	Plugin active
`CrowdsecMode`	`"stream"`	Pull decisions every 60 s, maintain local cache
`CrowdsecLapiScheme`	`"http"`	Unencrypted within the cluster network
`CrowdsecLapiHost`	`crowdsec-service.crowdsec.svc.cluster.local:8080`	LAPI ClusterIP service
`CrowdsecLapiKeyFile`	`/etc/traefik/crowdsec/key`	Bouncer API key file path inside Traefik pods
`CrowdsecAppsecEnabled`	`"false"`	AppSec not active (Phase 3)
`DefaultDecisionSeconds`	`"60"`	TTL for default decisions
`HTTPTimeoutSeconds`	`"10"`	Plugin → LAPI timeout
`UpdateIntervalSeconds`	`"60"`	Plugin poll interval
`ForwardedHeadersTrustedIPs`	`10.0.0.0/8,127.0.0.1/32`	PROXY-protocol source trust
`ClientTrustedIPs`	`127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16`	Phase 2 client allowlist, RFC1918 only
`CrowdsecAppsecUnreachableBlock`	`"false"`	(For appsec middleware) fail-open on AppSec unavailability

These file paths inside cluster pods are referenced by other configuration.

Path	What
`/etc/traefik/crowdsec/key`	Bouncer API key mounted into Traefik pods
`/etc/crowdsec/config.yaml`	Engine config in the LAPI pod (chart-managed)
`/etc/crowdsec/config.yaml.local`	Engine config overlay (`db_config` + `auto_registration`)

Service	Namespace	Ports	Purpose
`crowdsec-service`	crowdsec	6060 (metrics), 8080 (lapi)	LAPI HTTP API
`crowdsec-appsec-service`	crowdsec	6060 (metrics), 7422 (appsec)	AppSec component
`crowdsec-db-rw`	crowdsec	5432	Postgres primary (CNPG)
`crowdsec-db-ro`	crowdsec	5432	Postgres replica (CNPG)

ArgoCD applies resources in this order:

Wave	Resource
0	Namespace
1	ClusterSecretStore × 2 (crowdsec ns + traefik ns), CNPG cluster
2	ExternalSecret × 2
3	HelmChart (engine)
4	Middleware × 2 (bouncer + appsec)
5	Grafana dashboard ConfigMaps