Installer should not expose Crowdsec metrics endpoint by default #1656

New Issue

MrUnknownDE · 2026-04-05T19:38:38+02:00

MrUnknownDE commented

2026-04-05 19:38:38 +02:00

Originally created by @narbux on 3/31/2025

The Crowdsec integration defaults to the exposing and binding of port :6060 in the compose file (https://{server-ip}:6060/metrics). While this is not necessarily a security vulnerability, it is a bad practice. Especially because the metrics are not used by anything (at least not as of yet).

The option to expose the metrics should either be asked in the installer script or excluded all together. A user who needs it can always add it afterwards.

*Originally created by @narbux on 3/31/2025* The Crowdsec integration defaults to the exposing and binding of port :6060 in the compose file (https://{server-ip}:6060/metrics). While this is not necessarily a security vulnerability, it is a bad practice. Especially because the metrics are not used by anything (at least not as of yet). The option to expose the metrics should either be asked in the installer script or excluded all together. A user who needs it can always add it afterwards.

MrUnknownDE closed this issue

2026-04-05 19:38:38 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1656