sksec puts behavioral intrusion detection and crowd-sourced reputation in front of every service behind the fleet's Traefik edge, with a bouncer that fails closed and a dashboard that stays behind single sign-on. It does not guess whether a request is human or machine. It watches what the request does.
sksec is the core deployment role (core/sksec) inside SKStacks, SKWorld's Ansible + Docker Swarm sovereign infrastructure framework. It runs CrowdSec, an open-source behavioral detection engine with a crowd-sourced reputation feed, alongside a Traefik forwardAuth bouncer, so every router in the cluster can be put behind the same decision with one middleware line.
CrowdSec tails the edge's own access logs and scores behavior against its scenario collections (crowdsecurity/linux, crowdsecurity/traefik by default), not just a static IP list.
CrowdSec's community blocklist (CAPI) shares attacker reputation across every participating CrowdSec deployment worldwide, so one site's detection can protect every other site before an attacker ever reaches it.
The Traefik bouncer answers 403 when it cannot reach CrowdSec's LAPI, rather than quietly letting every request through. Run a canary router first, widen only after it checks out.
Your own ranges (LAN, VPN, CI runners, the cluster's own public address) are enforced at both the local parser and CrowdSec's own LAPI, so a community or manual ban can never catch you.
Optional bouncer replicas (one per node) mean one node going down never takes the gate down with it. The bouncer itself is stateless.
CrowdSec's hot-path database can now pin to local disk on one node instead of shared network storage, removing the slow-lookup-to-fail-closed failure mode entirely (see below).
A bouncer that fails closed is only trustworthy if the thing it depends on cannot quietly become the slowest part of the request path. sksec was built, and then fixed, around exactly that failure mode.
sksec-web, below) reads and shows the same alerts and decisions an operator would otherwise read through a command-line tool, but it sits behind the fleet's own single sign-on and starts read-only, so adding visibility never widens who can change what.The honest version of the pitch is not that sksec can tell an AI agent from a person. It cannot, and no network control honestly can. What changed is the speed and reach of what is on the other end of the connection, and that is the part a behavior-and-reputation-based gate was already built to answer.
This month alone, two chained disclosures moved from public CVE to active in-the-wild exploitation fast enough that a fleet checking patch status by tag name, not by actually running the binary, would have missed it: a PHP runtime remote-code-execution chain (PHP2Shell) and a related chain against a popular media server (Plex2Shell). Automated scanners and agentic tooling can probe thousands of endpoints for a fresh exploit signature far faster than a human operator can patch everything by hand, and they do not get tired, take weekends, or stop at the first failed attempt.
crowdsecurity/http-cve collection for known CVE exploitation signatures and crowdsecurity/traefik for the edge's own access logs. It does not need to know who, or what, is driving the request.What sksec does not claim: it is not "AI-proof," it does not block all automated traffic, and it does not replace patching. It is one honest layer: slow down and catch what behaves badly at the edge, keep the operator's own addresses safe from false positives, and keep the admin tools that manage all of it behind single sign-on.
The optional sksec-web role adds crowdsec-web-ui, a browser dashboard for the cluster's existing CrowdSec instance: investigate alerts, review decisions, watch runtime metrics, without SSHing into a node and running cscli by hand. It deploys after core/sksec and talks to that stack's own LAPI; it ships no CrowdSec engine or bouncer of its own.
| Property | Detail |
|---|---|
| Credential | Its own registered CrowdSec machine account, separate from the Traefik bouncer's key. Rotating one never touches the other. |
| Default access | Read-only at two independent layers: the dashboard's own read-only setting, and CrowdSec's own server-side rule on which machine accounts may delete a decision. Deleting is an explicit, separate, manual opt-in. |
| Sign-in | Authentik forward auth (SSO) in front by default, the same double-gate pattern used for every other admin-grade tool in the stack. A no-SSO mode exists only behind an explicit, named risk flag. |
| Portal visibility | Its tile is bound to the instance's admin group, not every signed-in user, the same convention the fleet already uses for its other admin dashboards. |
sksec is one layer in a stack built so no single piece has to be perfect on its own.
The HA Traefik edge that terminates every request. sksec's bouncer is a middleware on skfenceha's routers, not a separate network hop.
Authentik-based single sign-on. Gates every admin-grade tool in the stack, sksec-web included, with the same double-gate pattern.
Daily, unattended inventory of every running service's real pinned image and runtime version, cross-referenced against a tracked CVE register, flagging what is unreviewed instead of silently dropping it.
New sksec and sksec-web capability is proven end to end on a disposable test cluster before it ships, the same release discipline the rest of the framework's services use.
sksec deploys through a standard Ansible playbook per environment (dev, staging, prod), every setting coming from a per-environment vault file, never hardcoded. The bouncer fails closed, so the framework's own README walks through activation order: set the operator allowlist first, deploy, confirm log acquisition and a test ban, canary one low-value router, then widen.
sksec guards the gate every other sovereign service sits behind. skhub holds the files, skwrit publishes the paperwork, and every one of them routes through the same Traefik edge sksec protects. All part of SKWorld, the sovereign AI ecosystem where you own the whole stack, from silicon to soul.