I have a Crowdsec agent deployed in docker parsing Immich logs using the gauth-fr/immich Collection. I expose Immich via Caddy reverse proxy and a subdomain and I’m also using crowdsecurity/caddy.
I’ve just tried logging into Immich via the subdomain and a VPN to force a ban and can see the following in Immich logs (repeated 5-6 times):
WARN [Api:AuthService~mh0wh988] Failed login attempt for user test@google.com from ip address 2a00:23c8:1bc7:<redacted>
But in Crowdsec I get the following and no ban:
(I can’t see anything in Caddy log other than scheduled cert management)
level=warning msg="failed to run RunTimeValue : cannot fetch client_ip from <nil> (1:31)\n | evt.Unmarshaled.caddy.request.client_ip\n | ..............................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : cannot fetch proto from <nil> (1:31)\n | evt.Unmarshaled.caddy.request.proto != nil ? Split(evt.Unmarshaled.caddy.request.proto, '/')[1] : nil\n | ..............................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : cannot fetch remote_addr from <nil> (1:31)\n | evt.Unmarshaled.caddy.request.remote_addr != nil ? Split(evt.Unmarshaled.caddy.request.remote_addr, ':')[0] : nil\n | ..............................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : invalid operation: int(<nil>) (1:1)\n | int(evt.Unmarshaled.caddy.status)\n | ^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : cannot fetch uri from <nil> (1:31)\n | evt.Unmarshaled.caddy.request.uri\n | ..............................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : cannot fetch method from <nil> (1:31)\n | evt.Unmarshaled.caddy.request.method\n | ..............................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : cannot fetch headers from <nil> (1:35)\n | get(evt.Unmarshaled.caddy.request.headers, 'User-Agent') != nil ? evt.Unmarshaled.caddy.request.headers['User-Agent'][0] : nil\n | ..................................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=warning msg="failed to run RunTimeValue : cannot fetch host from <nil> (1:31)\n | evt.Unmarshaled.caddy.request.host\n | ..............................^" id=spring-hill name=crowdsecurity/caddy-logs stage=s01-parse
level=info msg="Ip 2a00:23c8:1bc7:e100:<redacted> performed 'gauth-fr/immich-bf' (6 events over 12.165237746s) at 2024-06-18 12:22:28.818085527 +0000 UTC"
level=info msg="Bucket overflow" bucket_id=wild-smoke cfg=cool-feather name=crowdsecurity/CVE-2017-9841 partition=fd971bdc790ac13bf2ac45f7b256d6b8425e3d86
level=info msg="Ip 83.97.73.245 performed 'crowdsecurity/CVE-2017-9841' (1 events over 61ns) at 2024-06-18 12:32:14.789901866 +0000 UTC"
level=info msg="capi metrics: sending"
Any ideas what’s going wrong?
