Document CrowdSec AppSec request inspection for the reverse proxy by lixmal · Pull Request #889 · netbirdio/docs

lixmal · 2026-07-27T12:22:13Z

Documents CrowdSec AppSec (WAF) request inspection for the reverse proxy: a per-service mode that mirrors each HTTP request to the Security Engine and blocks or logs what its rules flag.

Add an AppSec section to the access-control page covering the three per-service modes, what is mirrored, and how credentials are kept out of the engine
Document the new appsec_* deny reasons and the appsec_body_bypass metadata in the access-logs reference
Add engine setup to the self-hosted CrowdSec guide: acquisition file, required rule collections, proxy env vars, custom rules, and testing
Add inline steps to the enable-reverse-proxy migration guide for turning inspection on in an existing deployment
Note that one listener carries one rule set, so services on a cluster share it

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

Documentation
- Added guidance for enabling CrowdSec AppSec (WAF) request inspection for reverse-proxy services.
- Documented Off/Enforce/Observe modes, including fail-closed behavior, synchronous inspection flow, default timeouts, and HTTP/WebSocket handling.
- Updated deny-reason and verdict explanations to include AppSec-specific reasons, body-inspection bypass recording, and how “clean” results relate to inspection.
- Extended self-hosted setup, migration (optional AppSec step), configuration, verification/testing, and rollout order (placing AppSec before authentication and noting mode recommendations).

vercel · 2026-07-27T12:22:19Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 28, 2026 11:06am

coderabbitai · 2026-07-27T12:22:21Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 08aa9294-17c0-40e0-99b2-132a4ca0e7ca

📥 Commits

Reviewing files that changed from the base of the PR and between d2c7e49 and db69df4.

📒 Files selected for processing (4)

src/pages/manage/reverse-proxy/access-logs.mdx
src/pages/manage/reverse-proxy/authentication.mdx
src/pages/selfhosted/maintenance/crowdsec.mdx
src/pages/selfhosted/migration/enable-reverse-proxy.mdx

🚧 Files skipped from review as they are similar to previous changes (4)

src/pages/selfhosted/migration/enable-reverse-proxy.mdx
src/pages/manage/reverse-proxy/access-logs.mdx
src/pages/selfhosted/maintenance/crowdsec.mdx
src/pages/manage/reverse-proxy/authentication.mdx

📝 Walkthrough

Walkthrough

The documentation adds CrowdSec AppSec (WAF) guidance for reverse-proxy access restrictions, access logs, self-hosted configuration, and migration setup, including inspection limits and enforce/observe behavior.

Changes

CrowdSec AppSec integration

Layer / File(s)	Summary
AppSec inspection and access-log behavior `src/pages/manage/reverse-proxy/authentication.mdx`, `src/pages/manage/reverse-proxy/access-logs.mdx`	Documents AppSec modes, evaluation order, request inspection details, verdicts, deny reasons, and body-inspection metadata.
Self-hosted AppSec configuration `src/pages/selfhosted/maintenance/crowdsec.mdx`	Adds engine acquisition, proxy endpoint, tuning, custom rules, testing, and service configuration guidance.
Migration setup instructions `src/pages/selfhosted/migration/enable-reverse-proxy.mdx`	Adds an optional AppSec setup step, verification commands, and updated step references.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

netbirdio/docs#863: Clarifies reverse-proxy restriction combination behavior.

Suggested reviewers: techhuttv

Poem

A rabbit checks requests with care,
AppSec findings fill the air.
Observe records, enforce denies,
New setup steps help docs arise.
With verdicts neatly tucked away,
The burrow ships guidance today!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: documenting CrowdSec AppSec request inspection for the reverse proxy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch docs-reverse-proxy-appsec

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

src/pages/manage/reverse-proxy/access-logs.mdx

Oops! Something went wrong! :(

ESLint: 9.39.2

TypeError: Converting circular structure to JSON
--> starting at object with constructor 'Object'
| property 'configs' -> object with constructor 'Object'
| property 'flat' -> object with constructor 'Object'
| ...
| property 'plugins' -> object with constructor 'Object'
--- property 'react' closes the circle
Referenced from:
at JSON.stringify ()
at file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:308:45
at Array.map ()
at ConfigValidator.formatErrors (file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:299:23)
at ConfigValidator.validateConfigSchema (file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:330:84)
at ConfigArrayFactory._normalizeConfigData (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:676:19)
at ConfigArrayFactory._loadConfigData (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:641:21)
at ConfigArrayFactory._loadExtendedShareableConfig (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:946:21)
at ConfigArrayFactory._loadExtends (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:814:25)
at ConfigArrayFactory._normalizeObjectConfigDataBody (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:752:25)

src/pages/manage/reverse-proxy/authentication.mdx

Oops! Something went wrong! :(

ESLint: 9.39.2

TypeError: Converting circular structure to JSON
--> starting at object with constructor 'Object'
| property 'configs' -> object with constructor 'Object'
| property 'flat' -> object with constructor 'Object'
| ...
| property 'plugins' -> object with constructor 'Object'
--- property 'react' closes the circle
Referenced from:
at JSON.stringify ()
at file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:308:45
at Array.map ()
at ConfigValidator.formatErrors (file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:299:23)
at ConfigValidator.validateConfigSchema (file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:330:84)
at ConfigArrayFactory._normalizeConfigData (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:676:19)
at ConfigArrayFactory._loadConfigData (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:641:21)
at ConfigArrayFactory._loadExtendedShareableConfig (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:946:21)
at ConfigArrayFactory._loadExtends (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:814:25)
at ConfigArrayFactory._normalizeObjectConfigDataBody (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:752:25)

src/pages/selfhosted/maintenance/crowdsec.mdx

Oops! Something went wrong! :(

ESLint: 9.39.2

TypeError: Converting circular structure to JSON
--> starting at object with constructor 'Object'
| property 'configs' -> object with constructor 'Object'
| property 'flat' -> object with constructor 'Object'
| ...
| property 'plugins' -> object with constructor 'Object'
--- property 'react' closes the circle
Referenced from:
at JSON.stringify ()
at file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:308:45
at Array.map ()
at ConfigValidator.formatErrors (file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:299:23)
at ConfigValidator.validateConfigSchema (file:///node_modules/@eslint/eslintrc/lib/shared/config-validator.js:330:84)
at ConfigArrayFactory._normalizeConfigData (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:676:19)
at ConfigArrayFactory._loadConfigData (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:641:21)
at ConfigArrayFactory._loadExtendedShareableConfig (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:946:21)
at ConfigArrayFactory._loadExtends (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:814:25)
at ConfigArrayFactory._normalizeObjectConfigDataBody (file:///node_modules/@eslint/eslintrc/lib/config-array-factory.js:752:25)

1 others

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/pages/manage/reverse-proxy/access-logs.mdx`:
- Around line 73-75: Update the access-log reason documentation near the
`appsec_ban`, `appsec_captcha`, and `appsec_unavailable` rows to identify these
`appsec_*` reasons as HTTP-only. Adjust the surrounding service-availability
statement or split the table labeling so it no longer claims these reasons apply
to L4 services, while preserving the existing descriptions.

In `@src/pages/manage/reverse-proxy/authentication.mdx`:
- Around line 378-379: Update the ordered-list marker for the step following the
CrowdSec AppSec request inspection instructions so it uses 7 instead of 6,
preserving the existing step text and sequence.
- Around line 278-280: Update the CrowdSec setup link in
src/pages/manage/reverse-proxy/authentication.mdx:278-280 to use the decamelized
`#app-sec-waf-request-inspection` anchor. Update the corresponding links in
src/pages/selfhosted/maintenance/crowdsec.mdx:173-173 to
`#crowd-sec-ip-reputation` and
src/pages/selfhosted/migration/enable-reverse-proxy.mdx:411-411 to
`#app-sec-waf-request-inspection`.

In `@src/pages/selfhosted/maintenance/crowdsec.mdx`:
- Around line 95-96: Replace the exposed internal CrowdSec hostname with a
deployment-specific placeholder in src/pages/selfhosted/maintenance/crowdsec.mdx
lines 95-96 and lines 125-127, and in
src/pages/selfhosted/migration/enable-reverse-proxy.mdx lines 400-411. Update
the surrounding documentation to state that the placeholder must be replaced
with the deployment’s CrowdSec service hostname.
- Line 117: Close the currently open YAML code fence before the prose in the
CrowdSec maintenance documentation, ensuring the subsequent bash and text
examples render as separate examples. Preserve the explanatory prose and
existing content unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 70bdebc4-1f11-48d3-88b6-5a27b13d8ba1

📥 Commits

Reviewing files that changed from the base of the PR and between 302f76b and d2c7e49.

📒 Files selected for processing (4)

src/pages/manage/reverse-proxy/access-logs.mdx
src/pages/manage/reverse-proxy/authentication.mdx
src/pages/selfhosted/maintenance/crowdsec.mdx
src/pages/selfhosted/migration/enable-reverse-proxy.mdx

…eason scope

This was referenced Jul 27, 2026

[management, proxy, self-hosted] Add CrowdSec AppSec request inspection to the reverse proxy netbirdio/netbird#6917

Open

Add CrowdSec AppSec mode to reverse proxy access control netbirdio/dashboard#734

Open

lixmal force-pushed the docs-reverse-proxy-appsec branch from 7f695a7 to 8eb9c2b Compare July 27, 2026 14:28

lixmal changed the base branch from docs-reverse-proxy-allow-match to main July 27, 2026 14:28

vercel Bot deployed to Preview July 27, 2026 14:30 View deployment

lixmal force-pushed the docs-reverse-proxy-appsec branch from 8eb9c2b to ba1a479 Compare July 27, 2026 17:01

vercel Bot deployed to Preview July 27, 2026 17:03 View deployment

lixmal force-pushed the docs-reverse-proxy-appsec branch from ba1a479 to c8747b6 Compare July 27, 2026 17:13

vercel Bot deployed to Preview July 27, 2026 17:14 View deployment

Document CrowdSec AppSec request inspection for the reverse proxy

d2c7e49

lixmal force-pushed the docs-reverse-proxy-appsec branch from c8747b6 to d2c7e49 Compare July 28, 2026 09:23

vercel Bot deployed to Preview July 28, 2026 09:25 View deployment

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Fix unclosed fence, decamelized anchors, list numbering, and appsec r…

db69df4

…eason scope

vercel Bot deployed to Preview July 28, 2026 11:06 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Document CrowdSec AppSec request inspection for the reverse proxy - #889

Document CrowdSec AppSec request inspection for the reverse proxy#889
lixmal wants to merge 2 commits into
mainfrom
docs-reverse-proxy-appsec

lixmal commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

lixmal commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

vercel Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lixmal commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading