[mathieuHa]

Follow-up to maxlerebourg/crowdsec-bouncer-traefik-plugin#188, where we agreed to help keep the Traefik plugin documentation up to date here.

The Traefik pages now cover the plugin's 1.8.x line, the first stable releases with bot detection, and say so. The examples pin v1.8.1. v1.8.1 only fixes the version the plugin reports to the LAPI: v1.8.0 shows up as v1.7.1 in cscli bouncers list.

Changes

unversioned/bouncers/traefik.mdx

• A note at the top: the page applies to every 1.8.x release, and the examples pin v1.8.1.
• Plugin version v1.4.5 → v1.8.1, in the new Docker Compose example and the three Helm values. botdetection is back in the features, which matches the bot detection intro listing Traefik as compatible.
• New Traefik with Docker Compose section, covering remediation and AppSec. Until now the page only covered Kubernetes.
• New Bot detection section, in the same shape as the HAProxy SPOA one: collections, acquisition, and the three settings that break the challenge with no error in the logs:
  • the router must also match /crowdsec-internal;
  • the CSP headers middleware must be listed after the plugin;
  • crowdsecAppsecBodyLimit must stay above 0 and be large enough for the proof.

appsec/quickstart/traefik.mdx (docs/ and version-v1.8)

• Plugin version bump to v1.8.1, and a sentence that the guide applies to every 1.8.x release.
• crowdsecAppsecFailureBlock: a 401 or any other unexpected status always blocks. crowdsecAppsecUnreachableBlock: 502, 503 and 504 count as unreachable.
• New crowdsecAppsecBodyLimit entry. A body the client aborted is answered 499 (client gone) or 400, and is neither banned nor counted as blocked (plugin Add Misp Feed Generator Docs #401).
• A note that an AppSec captcha action uses captchaProvider, and is banned without one.

These all match the plugin's README for the 1.8.x line. Nothing changed in behaviour between v1.8.0 and v1.8.1.

Tested

The Docker Compose example was copied from the page as written and run with CrowdSec v1.8.1, Traefik v3.7, and plugin v1.8.1 downloaded from the catalog:

• GET / returns 200, and GET /.env returns 403 (AppSec). No errors in the Traefik logs.
• cscli bouncers list shows the bouncer as v1.8.1. With v1.8.0 it shows v1.7.1.
• A decision for the IP read from the access log returns 403 within 60 s (45 s here).
• With the bot detection section applied, curl gets <title>CrowdSec Challenge</title>, and /crowdsec-internal/challenge/fpscanner.js is served through the plugin.

The same run passed on v1.8.0 earlier today. The Amplify preview build passes; I did not run the Docusaurus build locally.

🤖 Generated with Claude Code

[aws-amplify-eu-west-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-1198.d1to60jd2gb6y6.amplifyapp.com