Please Fix: Crowdsec Health Check Config #2119
Replies: 18 comments 30 replies
-
|
Hello, |
Beta Was this translation helpful? Give feedback.
-
|
Wow, that was rough. I had to disable Crowdsec in the Pangolin/Traefik docker-compose.yml traefik-config.yml dynamic-config.yml to get Pangolin back up, just so I could use my password manager. So now I need to wait 24 hours to see if I'm no longer blocked by Crowdsec, in order to re-enable it? Ugh. |
Beta Was this translation helpful? Give feedback.
-
|
Have the Same Problem Cant reach my Site anymore |
Beta Was this translation helpful? Give feedback.
-
|
can this be resolved by removing crowdsec or something? |
Beta Was this translation helpful? Give feedback.
-
This did not fix it for me. Still getting the 403. |
Beta Was this translation helpful? Give feedback.
-
|
It is my understanding that fixing the health-check won't immediately whitelist your IP on crowdsec's AWS WAF blacklist, you still need to wait the full 24hrs cooldown - or contact them via email. On a different note, if you are in a hurry I found that adding the following env variables for the crowdsec's service will momentarily skip any authentication and let the container start: Again, this is a temp fix and you should be able to resume normal operation, removing the config above, after the ban on your IP gets lifted. Hopefully this helps someone. |
Beta Was this translation helpful? Give feedback.
-
|
I wonder what people should do in this case with a dynamic IP |
Beta Was this translation helpful? Give feedback.
-
|
If you're facing container start issues after updating your health checks, look at the logs, you may see a 403 indicating a ban on Crowdstrikes side. Solution is to wait, or do what I did and email the address listed here: crowdsecurity/crowdsec#4165 As someone else said, their support is incredibly fast. I emailed at 9:06pm and got a reply back confirming the addition to allowlist at 10:00pm. Incredible support! 👏 |
Beta Was this translation helpful? Give feedback.
-
|
can confirm all pangolin instances with crowdsec back up after 24 hours (if you'd rather not send your ips over):
heads up:
|
Beta Was this translation helpful? Give feedback.
-
|
Hey all, I followed the advice here and
At first everything worked, but after 3 hours of the services running without issue again, CrowdSec went down with the exact same errors discussed in this thread. downloading https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
Error: cscli hub upgrade: while downloading data for /etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml: while getting data: bad HTTP code 403 for https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
# ...
time="2025-12-21T05:52:04Z" level=info msg="Enabled feature flags: none"
time="2025-12-21T05:52:04Z" level=info msg="Crowdsec v1.7.4-db3efdbf"
time="2025-12-21T05:52:04Z" level=info msg="Loading CAPI manager"
time="2025-12-21T05:52:04Z" level=info msg="attempt 1 out of 2"
time="2025-12-21T05:52:04Z" level=info msg="attempt 2 out of 2"
time="2025-12-21T05:52:05Z" level=info msg="max attempts reached for status code 403"
time="2025-12-21T05:52:05Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (8d576a5ffd9f4907bfaf975cc3239529Q8SCIIoRK71s6VtO): API error: Forbidden"Does the stack re-fetch the CAPI data while running? Is anyone else having issues with this? I really want CrowdSec in front of my services but I can't deal with constant outages like this. |
Beta Was this translation helpful? Give feedback.
-
updated my healtcheck in docker-compose.yml |
Beta Was this translation helpful? Give feedback.
-
|
I have these logs |
Beta Was this translation helpful? Give feedback.
-
|
After this changes my Traefik won't start anymore. I need to comment out the crowedsec health check for pangolin, than everything is up and running.
|
Beta Was this translation helpful? Give feedback.
-
|
I got Pangolin running by adding these two entries to docker-compose. I'm waiting 24 hours to retry the CrowdSec health check. |
Beta Was this translation helpful? Give feedback.
-
|
I've updated the healthcheck, but I'm having the issue of receiving this error everytime I restart my Pangolin stack. It could be up for weeks, but if I change a config and |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I am having the same issue with crowdsec health check not letting pangolin stack start. |
Beta Was this translation helpful? Give feedback.
-
|
Yesterday I also had the same problem (403) upgrading Pangolin from 1.14 to 1.15, so I followed instruction above: Today I revert the above, and now everything is working as usual. Thanks for all the suggestions. |
Beta Was this translation helpful? Give feedback.
-
|
I was just starting my stack for a new install and I also get hit with this rate limit. Maybe it is only happening on grabbing a large amount at a time? Going to wait and try again and see if it is able to finish this time. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hey Everyone!
Due to a misconfiguration of the default Crowdsec install with the Pangolin installer we are hammering Crowdsec's API with health checks! If everyone could please update their installs as soon as possible that would really help out the team over there.
An update from Crowdsec: crowdsecurity/crowdsec#4165
Edit your
docker-compose.ymland update the health check section of the Crowdsec section to be the following:Then run
docker compose up -dto apply the changes.Note the change to
lapiand an increased interval.Beta Was this translation helpful? Give feedback.
All reactions