Install CrowdSec on your VPS
Infraa installs the CrowdSec engine on your VPS from CrowdSec's own apt repository, enrolls it in CAPI (the free community blocklist) so it both contributes to and benefits from attack intel shared across everyone running it, and installs the nftables firewall bouncer that automatically registers against the local engine and drops banned IPs. SSH brute-force detection is on the moment it's installed. You can optionally feed your app access logs in too, so CrowdSec's HTTP-attack scenarios watch your apps as well as SSH.
- Versions
- CrowdSec 1.6, from CrowdSec's own apt repository
- Works on
- Ubuntu 22.04, Ubuntu 24.04, and Debian 12
- Package source
- CrowdSec's official apt repository (packagecloud)
What does the CrowdSec install do?
- Adds CrowdSec's apt repository with its signing key and installs the crowdsec engine from it.
- The engine's own postinst installs the Linux collection (SSH brute-force and other common scenarios on by default), sets up log acquisition, and auto-enrolls in CAPI, the community blocklist.
- Installs and enables crowdsec-firewall-bouncer-nftables, which self-registers an API key against the local engine and drops banned IPs at the nftables layer.
- Optionally (off by default): writes an acquisition + parser drop-in that feeds your Infraa-managed app vhosts' access logs into CrowdSec too, so its HTTP scenarios cover your apps as well as SSH — this needs the CrowdSec nginx analytics, which the package only installs automatically if nginx was already running when CrowdSec was installed.
How do I install CrowdSec with Infraa?
Connect your server
Run the Infraa install one-liner (curl install.infraa.sh | sh) on your VPS. The agent registers over an outbound connection in about 30 seconds — no inbound ports, no SSH keys to share.
Pick the service
Choose it from the one-click catalog in the dashboard, or just ask in chat. Infraa turns your request into a concrete, reviewable plan.
Review and approve
Read exactly what will run, then approve. The agent executes only the approved, cryptographically signed steps and streams progress live.
What happens after the install?
Infraa checks both the crowdsec engine and the firewall bouncer every 60 seconds and flags either in your dashboard if it stops running.
CrowdSec on Infraa — common questions
01Does this enroll me in the CrowdSec console or dashboard?
No. This module wires up the local engine and the free CAPI community blocklist only — it does not create or link a crowdsec.net console account.
02Does CrowdSec challenge suspicious requests instead of blocking them outright?
Not with this module. The firewall bouncer works at the network layer — a ban blocks the IP outright at nftables. There's no L7 nginx bouncer or per-request challenge (CAPTCHA/JS check) in v1.
03What does turning on app-log analysis actually need?
It depends on the CrowdSec nginx analytics, which the crowdsec package only installs automatically when nginx is already running at install time. If nginx wasn't up yet, install nginx first, then reinstall or reconfigure CrowdSec.
04What happens if I uninstall the CrowdSec module?
Infraa removes the crowdsec and crowdsec-firewall-bouncer-nftables packages (apt remove, not purge) plus its own acquisition and parser drop-ins. apt remove leaves /etc/crowdsec config and the bouncer's already-registered API key on disk — a full config purge is a manual step.
Connect a server in 30 seconds, then install CrowdSec from the catalog or just ask in chat.
