developingchet/cs-abuseipdb-bouncer repository overview

⁠cs-abuseipdb-bouncer

A production-ready, security-hardened CrowdSec bouncer that reports malicious IPs to AbuseIPDB in real-time. Single static Go binary, distroless container, Prometheus metrics.

⁠Features

⁠Quick Start

# docker-compose.yml (minimal)
services:
  abuseipdb-bouncer:
    image: developingchet/cs-abuseipdb-bouncer:latest
    restart: unless-stopped
    environment:
      - CROWDSEC_LAPI_URL=http://crowdsec:8080
      - CROWDSEC_LAPI_KEY=${CROWDSEC_LAPI_KEY}
      - ABUSEIPDB_API_KEY=${ABUSEIPDB_API_KEY}
      - DATA_DIR=/data
      - METRICS_ADDR=:9090
    volumes:
      - bouncer-state:/data
    ports:
      - "127.0.0.1:9090:9090"
    tmpfs:
      - /tmp:size=10M,uid=65532,gid=65532,mode=1777
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    networks:
      - crowdsec-net

volumes:
  bouncer-state:

networks:
  crowdsec-net:
    external: true

Get your LAPI key: docker exec crowdsec cscli bouncers add abuseipdb-bouncer

⁠Environment Variables

⁠Required

⁠Optional

⁠Observability

⁠Endpoints

⁠Prometheus Metrics

Scrape example:

curl http://localhost:9090/metrics | grep cs_abuseipdb

⁠Security

⁠Distroless Runtime

The container image is built FROM gcr.io/distroless/static-debian12:nonroot. This means:

• No shell — eliminates RCE via shell injection
• No package manager — no apt, apk, or pip to install tools post-compromise
• Minimal CVE surface — only the Go binary and CA certificates

⁠Seccomp Profile

The repository ships security/seccomp-bouncer.json, a minimal OCI seccomp profile that allows only the syscalls the binary actually needs.

If you cloned the repo, ./security/seccomp-bouncer.json is already present. Otherwise, download it first:

mkdir -p security
curl -fsSL \
  https://raw.githubusercontent.com/developingchet/cs-abuseipdb-bouncer/main/security/seccomp-bouncer.json \
  -o security/seccomp-bouncer.json

Then apply it in your compose file:

security_opt:
  - no-new-privileges:true
  - "seccomp:./security/seccomp-bouncer.json"

If you prefer not to download the file, simply omit that line — cap_drop: ALL, read_only: true, and the distroless nonroot image still provide strong isolation without it.

⁠Log Redaction

API keys and Bearer tokens are automatically redacted from all log output before they reach stderr. The regex patterns match 80-character hex strings (AbuseIPDB / CrowdSec key format) and Bearer <token> values.

⁠Supply-Chain Verification

Verify the image signature with Cosign:

cosign verify developingchet/cs-abuseipdb-bouncer:latest \
  --certificate-identity-regexp="https://github.com/developingchet/cs-abuseipdb-bouncer/.github/workflows/release.yml@refs/tags/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

A CycloneDX SBOM is available as a GitHub Release asset and embedded as a Cosign attestation on the image.

⁠Migration from v1.x

No migration script is needed. On first start, v2.0 creates a fresh state.db. The quota counter resets at UTC midnight anyway, and cooldowns rebuild within one 15-minute window.

Update your compose file:

1. Change STATE_DIR=/tmp/cs-abuseipdb → DATA_DIR=/data
2. Change - bouncer-state:/tmp/cs-abuseipdb → - bouncer-state:/data
3. Optionally add METRICS_ADDR=:9090 and expose port 9090

⁠Links

• GitHub Repository: https://github.com/developingchet/cs-abuseipdb-bouncer⁠
• Setup Guide: https://github.com/developingchet/cs-abuseipdb-bouncer/blob/main/docs/SETUP.md⁠
• Configuration Reference: https://github.com/developingchet/cs-abuseipdb-bouncer/blob/main/docs/CONFIGURATION.md⁠
• Troubleshooting: https://github.com/developingchet/cs-abuseipdb-bouncer/blob/main/docs/TROUBLESHOOTING.md⁠
• Issues / Bug Reports: https://github.com/developingchet/cs-abuseipdb-bouncer/issues⁠