sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-20 20:49:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve self-hosted Traefik docs and CrowdSec observe-mode notes (#710)

Browse Source 
* Crowdsec Updates

* Improve Traefik docs
This commit is contained in:
Brandon Hopkins
2026-04-28 20:14:55 -07:00
committed by GitHub
parent 3062285c99
commit 9859e7d468
5 changed files with 109 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/manage/reverse-proxy/access-logs.mdx
+1 -1
View File
@@ -73,7 +73,7 @@ The following deny reasons can appear for both HTTP and L4 services:
All CrowdSec decision types (ban, captcha, throttle) result in a connection denial in enforce mode. The proxy does not serve captcha challenges or apply rate limiting: the decision type is recorded for informational purposes only.
When CrowdSec is in **observe** mode, the verdict appears in the log metadata but the deny reason field is empty (the connection is allowed). This lets you audit what CrowdSec would block without affecting traffic.
When CrowdSec is in **observe** mode, the verdict appears in the log metadata but the deny reason field is empty (the connection is allowed). In the dashboard, these entries render with an observe-mode badge on the reason cell and show the underlying decision type (ban, captcha, throttle, unavailable) on hover. This lets you audit what CrowdSec would block without affecting traffic. For a self-test workflow, see [Testing the integration](/selfhosted/maintenance/crowdsec#testing-the-integration).
## Use cases
src/pages/manage/reverse-proxy/authentication.mdx
+1 -1
View File
@@ -182,7 +182,7 @@ CrowdSec operates in one of three modes per service:
|------|----------|
| **Off** | CrowdSec checks are disabled for this service (default). |
| **Enforce** | Connections from flagged IPs are denied immediately. If the CrowdSec bouncer has not completed its initial sync, all connections are denied (fail-closed). |
| **Observe** | Connections from flagged IPs are logged in [access logs](/manage/reverse-proxy/access-logs) but not blocked. Use this to evaluate the impact before switching to enforce. |
| **Observe** | Connections from flagged IPs are logged in [access logs](/manage/reverse-proxy/access-logs) with an observe-mode badge but not blocked. Use this to evaluate the impact before switching to enforce. See [Reviewing observe-mode verdicts](/selfhosted/maintenance/crowdsec#reviewing-observe-mode-verdicts) for how to audit them. |
CrowdSec decisions include different remediation types (ban, captcha, throttle). The proxy treats all types as connection denials in enforce mode: there is no captcha challenge or rate limiting. The specific decision type is recorded in the [access logs](/manage/reverse-proxy/access-logs) so you can distinguish between them when reviewing traffic.