- Add Traefik plugin via HelmChartConfig (crowdsec-bouncer-traefik-plugin) - Create bouncer Middleware in stream mode - Apply bouncer to all public ingresses - IPs flagged by CrowdSec will now be blocked at Traefik level
- signupsAllowed: false - prevents public registration - invitationsAllowed: false - prevents invitation abuse - adminToken from Secret for /admin panel access
GitOps manifests for security stack Wave 1: - Vaultwarden (vault.davidepiu.xyz) - password manager - Uptime Kuma (status.davidepiu.xyz) - uptime monitoring - Trivy Operator - vulnerability scanning - Authelia (auth.davidepiu.xyz) - SSO + 2FA All with NetworkPolicies for Traefik ingress.
