developingchet/cs-abuseipdb-bouncer repository overview

⁠cs-abuseipdb-bouncer

A production-ready, security-hardened CrowdSec bouncer that reports malicious IPs to AbuseIPDB in real-time. Single static Go binary, distroless container, Prometheus metrics.

⁠Features

⁠Quick Start

# docker-compose.yml (minimal)
services:
  abuseipdb-bouncer:
    image: developingchet/cs-abuseipdb-bouncer:latest
    restart: unless-stopped
    environment:
      - CROWDSEC_LAPI_URL=http://crowdsec:8080
      - CROWDSEC_LAPI_KEY=${CROWDSEC_LAPI_KEY}
      - ABUSEIPDB_API_KEY=${ABUSEIPDB_API_KEY}
      - DATA_DIR=/data
      - METRICS_ADDR=:9090
    volumes:
      - bouncer-state:/data
    ports:
      - "127.0.0.1:9090:9090"
    tmpfs:
      - /tmp:size=10M,uid=65532,gid=65532,mode=1777
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    networks:
      - crowdsec-net

volumes:
  bouncer-state:

networks:
  crowdsec-net:
    external: true

Get your LAPI key: docker exec crowdsec cscli bouncers add abuseipdb-bouncer

⁠Environment Variables

⁠Required

⁠Optional

⁠Observability

⁠Endpoints

⁠Prometheus Metrics

Scrape example:

curl http://localhost:9090/metrics | grep cs_abuseipdb

⁠Security

⁠Distroless Runtime

The container image is built FROM gcr.io/distroless/static-debian12:nonroot. This means:

• No shell — eliminates RCE via shell injection
• No package manager — no apt, apk, or pip to install tools post-compromise
• Minimal CVE surface — only the Go binary and CA certificates

⁠Seccomp Profile

The repository ships security/seccomp-bouncer.json, a minimal OCI seccomp profile that allows only the syscalls the binary actually needs.

If you cloned the repo, ./security/seccomp-bouncer.json is already present. Otherwise, download it first:

mkdir -p security
curl -fsSL \
  https://raw.githubusercontent.com/developingchet/cs-abuseipdb-bouncer/main/security/seccomp-bouncer.json \
  -o security/seccomp-bouncer.json

Then apply it in your compose file:

security_opt:
  - no-new-privileges:true
  - "seccomp:./security/seccomp-bouncer.json"

If you prefer not to download the file, simply omit that line — cap_drop: ALL, read_only: true, and the distroless nonroot image still provide strong isolation without it.

⁠Log Redaction

API keys and Bearer tokens are automatically redacted from all log output before they reach stderr. The regex patterns match runs of 80 or more hex characters (AbuseIPDB key format; the whole run is replaced so no part of a key leaks), Bearer <token> values and X-Api-Key: header values (CrowdSec LAPI key).

⁠Supply-Chain Verification

Verify the image signature with Cosign:

cosign verify developingchet/cs-abuseipdb-bouncer:latest \
  --certificate-identity-regexp="https://github.com/developingchet/cs-abuseipdb-bouncer/.github/workflows/release.yml@refs/tags/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

A CycloneDX SBOM is available as a GitHub Release asset and embedded as a Cosign attestation on the image.

⁠Migration from v1.x

No migration script is needed. On first start, v2.0 creates a fresh state.db. The quota counter resets at UTC midnight anyway, and cooldowns rebuild within one 15-minute window.

Update your compose file:

1. Change STATE_DIR=/tmp/cs-abuseipdb → DATA_DIR=/data
2. Change - bouncer-state:/tmp/cs-abuseipdb → - bouncer-state:/data
3. Optionally add METRICS_ADDR=:9090 and expose port 9090

⁠Links

• GitHub Repository: https://github.com/developingchet/cs-abuseipdb-bouncer⁠
• Setup Guide: https://github.com/developingchet/cs-abuseipdb-bouncer/blob/main/docs/SETUP.md⁠
• Configuration Reference: https://github.com/developingchet/cs-abuseipdb-bouncer/blob/main/docs/CONFIGURATION.md⁠
• Troubleshooting: https://github.com/developingchet/cs-abuseipdb-bouncer/blob/main/docs/TROUBLESHOOTING.md⁠
• Issues / Bug Reports: https://github.com/developingchet/cs-abuseipdb-bouncer/issues⁠