CrowdSec Troubleshooting

Incident runbook for CrowdSec and nftables.

Am I banned?

Command to check your IP:

$sudo cscli decisions list

Command to unban yourself:

$sudo cscli decisions delete --ip <YOUR_IP>

Note: Use Hetzner web console if SSH is also blocked.

Why was I banned?

Known triggers:

• Ente Photos bulk API calls → triggers http-crawl-non-statics scenario
• Aggressive Navidrome/Subsonic client polling

Check logs to see what caused it:

$sudo tail -100 /var/log/caddy/access.log | grep <YOUR_IP>

$sudo cscli alerts list

Permanent Whitelist

Edit the whitelist file:

$sudo nano /etc/crowdsec/parsers/s02-enrich/my-whitelist.yaml

Structure:

name: my/whitelist
description: "Whitelist home IPs"
whitelist:
  reason: "home IP"
  ip:
    - "1.2.3.4"
  cidr:
    - "1.2.3.0/24"

After editing, reload CrowdSec:

$sudo systemctl reload crowdsec

Whitelist via allowlist (mynetworks)

Command to add an IP or CIDR to the allowlist:

$sudo cscli allowlists add mynetworks <IP_OR_CIDR> --reason "home IP"

Command to list:

$sudo cscli allowlists list mynetworks

Hetzner Web Console Emergency Access

• URL: console.hetzner.cloud
• Select VPS → Console tab
• Login: user thomas, system password (stored in Bitwarden SSH vault)

Common Scenarios