# Help needed for setting up CrowdSec on Proxmox LXCs

**URL:** <https://discourse.crowdsec.net/t/help-needed-for-setting-up-crowdsec-on-proxmox-lxcs/2162>\
**Category:** crowdsec\
**Created:** [November 28, 2024, 10:26am UTC](https://discourse.crowdsec.net/t/help-needed-for-setting-up-crowdsec-on-proxmox-lxcs/2162 "2024-11-28T10:26:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nodea](https://avatars.discourse-cdn.com/v4/letter/n/d78d45/32.png) [@nodea](https://discourse.crowdsec.net/u/nodea)\
**Post date:** [November 28, 2024, 10:26am UTC](https://discourse.crowdsec.net/t/help-needed-for-setting-up-crowdsec-on-proxmox-lxcs/2162/1 "2024-11-28T10:26:50Z")

</div>

What I have are:

1. Nextcloud

Port 443 (https): router (firewalled) → opnsense (firewalled) → Caddy - Proxmox debian LXC no. 8167 - firewalled & ssl terminated /letsencrypt) → nextcloud (Proxmox debian LXC no. 8151 - firewalled & ssl terminated / custom root-CA)

The corresponding Caddyfile:

```auto
# NextCloud

nextloud.foo.tld {
        reverse_proxy https://192.168.8.151:443 {
        header_up Host {upstream_hostport}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        }
        log {
        format transform "{common_log}"
        output file /var/log/caddy/access-nextcloud.log
        }
}

```

1. Vaultwarden

Port 443 (https): router (firewalled) → opnsense (firewalled) → Caddy - Proxmox debian LXC no. 8167 - firewalled & ssl terminated / letsencrypt) → vaultwarden (Proxmox debian LXC no. 8158 - firewalled & ssl terminated / custom root-CA)

The corresponding Caddyfile:

```auto
# Vaultwarden

vaultwarden.foo.tld {
        reverse_proxy https://192.168.8.158:8000 {
        header_up Host {upstream_hostport}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        }
        log {
        format transform "{common_log}"
        output file /var/log/caddy/access-vaultwarden.log
        }
}

```

The auth-errors can only be seen in logs on Nextcloud and Vaultwarden LXCs.

The CrowdSec LAPI runs on a separate LXC.  
All LXCs are debian 12 based.

Will it work if I enable only collections on Nextcloud & Vaultwarden LXCs and a bouncer on Caddy LXC? Do I need collections on Caddy LXC enabled as well?

---

<div class="post-metadata">

**Author:** ![nodea](https://avatars.discourse-cdn.com/v4/letter/n/d78d45/32.png) [@nodea](https://discourse.crowdsec.net/u/nodea)\
**Post date:** [November 30, 2024, 8:43am UTC](https://discourse.crowdsec.net/t/help-needed-for-setting-up-crowdsec-on-proxmox-lxcs/2162/2 "2024-11-30T08:43:27Z")

</div>

Well it is working. I used that one: [Setting up A Multi-Server Security Engine Installation](https://www.crowdsec.net/blog/multi-server-setup)

First, there are missing commands:

```auto
sudo -u postgres psql -c 'GRANT all ON SCHEMA public TO db_user' db_name

```

at least on debian 12.8.

and this one:

```auto
mv /etc/crowdsec/local_api_credentials.yaml /etc/crowdsec/local_api_credentials.yaml.bak

```

before evoking:

```auto
cscli machines add -a --force

```

Second, it should be indeed

```auto
cscli machines add -a --force

```

and not

```auto
cscli machines add -a –force

```

I have now installed:

- LAPI (Proxmox LXC Container)
- Caddy parser and bouncer (Proxmox LXC Container)
- Vaultwarden parser (Proxmox LXC Container)
- NextcloudPi parser (Proxmox LXC Container)
- postfix parser and firewall bouncer (Proxmox LXC Container MTA)
- dovecot parcer and firewall bouncer (Proxmox LXC Container MTA)
- opnsense wireguard parser and opnsense bouncer on n100 native
- wordpress parser and bouncer (external VPS)

All native w/o docker or so. Now testing and evaluating…

BTW.  
Caddy compiled with:

```auto
xcaddy build \
    --with github.com/hslatman/caddy-crowdsec-bouncer/crowdsec

```