TheDuffman85/crowdsec-web-ui

What is it?

Key features

• 01Searchable alert history with CrowdSec context and IP, AS, and location details
• 02Active and expired decision management, including manual bans with custom durations
• 03Connection to multiple CrowdSec LAPIs with a Combined scope view
• 04Optional Prometheus metrics views for LAPI, bouncers, AppSec, and parsers
• 05Notification rules delivered through Email, Gotify, MQTT, ntfy, or webhooks
• 06Password, TOTP, passkey, and OIDC SSO login with group-based roles

Use cases

• Operators running CrowdSec across several servers who want one dashboard for all LAPIs
• Teams that need to review alerts and manually ban or unban IPs without using the command line
• Homelab or small-team admins who want push notifications for new alerts and decisions
• Organizations integrating CrowdSec access with an existing OIDC identity provider

Quick start

1. 1

   Generate a random password with openssl

   openssl rand -hex 32
2. 2

   Register the Web UI as a machine in your CrowdSec container

   docker exec crowdsec cscli machines add crowdsec-web-ui --password 'replace-with-generated-password' -f /dev/null
3. 3

   Start the Web UI with Docker Compose using the included docker-compose.yml

   docker compose up -d
4. 4

   Open http://localhost:3000 in your browser and create the initial administrator account

Things to know

• !You need a running CrowdSec LAPI to connect to.
• !Licensed under AGPL-3.0, a strong copyleft license.
• !Public deployments should sit behind HTTPS and a hardened reverse proxy, since TLS is not handled by the app.
• !Migrated installations that predate authentication stay unauthenticated until you enable it.

In collections

Topics

FAQ

What is crowdsec-web-ui?

A self-hosted web dashboard for CrowdSec to investigate alerts, manage decisions, view runtime metrics, and send notifications. CrowdSec Web UI is a self-hosted dashboard that connects to one or more CrowdSec Local APIs (LAPIs). It lets operators browse alert history with search and quick filters, inspect the CrowdSec context behind each alert, and view active and expired decisions. Manual bans with custom durations and reasons can be added, and cleanup actions are available from the same interface.

Is crowdsec-web-ui free to use? What license does it have?

crowdsec-web-ui is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.

Is crowdsec-web-ui still maintained?

Actively maintained. The last commit to crowdsec-web-ui was on Nov 6, 2026.

What can I use crowdsec-web-ui for?

Operators running CrowdSec across several servers who want one dashboard for all LAPIs Teams that need to review alerts and manually ban or unban IPs without using the command line Homelab or small-team admins who want push notifications for new alerts and decisions Organizations integrating CrowdSec access with an existing OIDC identity provider

How do I install crowdsec-web-ui?

Generate a random password with openssl: openssl rand -hex 32 Register the Web UI as a machine in your CrowdSec container: docker exec crowdsec cscli machines add crowdsec-web-ui --password 'replace-with-generated-password' -f /dev/null Start the Web UI with Docker Compose using the included docker-compose.yml: docker compose up -d Open http://localhost:3000 in your browser and create the initial administrator account

Where can I get crowdsec-web-ui?

The source code and installation instructions are on GitHub: https://github.com/TheDuffman85/crowdsec-web-ui