CrowdSec-Threat-Map

CrowdSec-Threat-Map

apps.detail.types.app from Railloune's Repository

apps.detail.sections.overview

CrowdSec Threat Map displays local CrowdSec alerts on an interactive world map with a live feed, English/French UI, larger readable text, optional violet-to-cyan firewall drops, CSV export, themes, optional unban support and optional dynamic whitelist support. Mount your CrowdSec database read-only for a safe dashboard-only setup. The live drops panel is optional and requires a JSONL file generated by your firewall or bouncer integration.

Readme

View on GitHub

CrowdSec Threat Map

CrowdSec Threat Map displays local CrowdSec alerts on an interactive world map with a live feed, search, filters and optional dashboard actions.

This Railline fork adds:

  • English and French UI (LANGUAGE=en or LANGUAGE=fr)
  • Larger dashboard text for readability
  • Optional live firewall drops panel with violet-to-cyan styling
  • Optional /drops JSON API for firewall/bouncer integrations
  • Unraid-friendly template defaults

Safe Default

For a dashboard-only setup:

  • Mount /crowdsec/data read-only.
  • Leave Docker socket empty.
  • Leave WHITELIST_ENABLED=false.
  • Leave DROPS_ENABLED=false unless you provide a drops JSONL file.

The Docker socket is only needed for dashboard unban or dynamic whitelist restart actions.

Live Drops

The live drops feature is optional. Enable it only when your firewall or bouncer integration writes JSONL events.

Example JSONL line:

{"ts":"2026-06-19T12:30:00Z","ip":"203.0.113.10","country":"FR","packets":12,"bytes":3456,"chain":"DOCKER-USER","rule":"crowdsec-ban"}

Required fields:

  • ip
  • packets is optional and defaults to 1
  • bytes, country, city, lat, lon, chain and rule are optional

If GeoLite2-City.mmdb is available in the CrowdSec data folder, the app can enrich missing country/city/coordinates.

Links

apps.marketingCta.appInstallTitle

apps.marketingCta.appInstallDescription

apps.installHelp.stepOpen apps.installHelp.stepSearchApp apps.installHelp.stepReview apps.installHelp.stepInstall
apps.marketingCta.secondary

apps.detail.sections.requirements

CrowdSec Docker Container

apps.detail.sections.categories

Tools > Network > Security

apps.detail.sections.related

apps.detail.related.exploreCategories

apps.detail.related.exploreAll
apps.detail.related.categoryApps

apps.detail.sections.links

apps.detail.links.projectgithub.comapps.detail.links.supportgithub.comapps.detail.repositorySources.registrygithub.comapps.detail.links.templateraw.githubusercontent.com

apps.detail.sections.details

apps.detail.details.repository
ghcr.io/railline/crowdsec-threat-map-docker:latest
apps.detail.details.registry
https://github.com/Railline/crowdsec-threat-map-docker/pkgs/container/crowdsec-threat-map-docker
apps.detail.details.lastUpdated2026-08-11
apps.detail.details.firstSeen2026-06-19

apps.detail.sections.runtime

apps.detail.details.webui
http://[IP]:[PORT:8080]/
apps.detail.details.network
bridge
apps.detail.details.shell
sh
apps.detail.details.privileged
false
apps.detail.details.extraParams
--security-opt=no-new-privileges:true

apps.detail.sections.configuration

WebUI - HTTP host portPorttcp

Host port for the CrowdSec Threat Map web dashboard.

apps.detail.config.target
8080
apps.detail.config.default
8095
apps.detail.config.value
8095
Paths - CrowdSec dataPathro

CrowdSec data directory containing crowdsec.db and optionally GeoLite2-City.mmdb. Keep read-only for dashboard-only deployments.

apps.detail.config.target
/crowdsec/data
apps.detail.config.default
/mnt/user/appdata/crowdsec/data
apps.detail.config.value
/mnt/user/appdata/crowdsec/data
Paths - CrowdSec postoverflowsPathrw

Optional CrowdSec postoverflows directory. Required only if WHITELIST_ENABLED=true.

apps.detail.config.target
/crowdsec/postoverflows
apps.detail.config.default
/mnt/user/appdata/crowdsec/postoverflows
Paths - Docker socketPathro

Optional Docker socket. Required only for dashboard unban or dynamic whitelist CrowdSec restart actions.

apps.detail.config.target
/var/run/docker.sock
apps.detail.config.default
/var/run/docker.sock
Paths - Optional drops log directoryPathro

Optional directory containing drops.jsonl for the live firewall drops panel. Leave empty if you only want the translated threat map.

apps.detail.config.target
/crowdsec/drops
apps.detail.config.default
/mnt/user/appdata/crowdsec-threat-map/drops
Core - SERVER_LATVariable

Server marker latitude. Example for Paris: 48.8566.

apps.detail.config.target
SERVER_LAT
apps.detail.config.default
0.0
apps.detail.config.value
0.0
Core - SERVER_LONVariable

Server marker longitude. Example for Paris: 2.3522.

apps.detail.config.target
SERVER_LON
apps.detail.config.default
0.0
apps.detail.config.value
0.0
Core - SERVER_NAMEVariable

Display name for the server marker.

apps.detail.config.target
SERVER_NAME
apps.detail.config.default
MyServer
apps.detail.config.value
MyServer
Core - TZVariable

Container timezone.

apps.detail.config.target
TZ
apps.detail.config.default
Europe/Paris
apps.detail.config.value
Europe/Paris
Core - LANGUAGEVariable

Dashboard language: en or fr.

apps.detail.config.target
LANGUAGE
apps.detail.config.default
en
apps.detail.config.value
en
CrowdSec - Container nameVariable

CrowdSec Docker container name. Used only when Docker socket access is mounted for unban/whitelist actions.

apps.detail.config.target
CROWDSEC_CONTAINER
apps.detail.config.default
crowdsec
apps.detail.config.value
crowdsec
CrowdSec - Dynamic whitelist enabledVariable

Enable only if the postoverflows path is mounted read-write and Docker socket access is intentionally enabled.

apps.detail.config.target
WHITELIST_ENABLED
apps.detail.config.default
false
apps.detail.config.value
false
CrowdSec - Whitelist fileVariable

Whitelist YAML path inside the container.

apps.detail.config.target
WHITELIST_FILE
apps.detail.config.default
/crowdsec/postoverflows/s01-whitelist/my-whitelist.yaml
apps.detail.config.value
/crowdsec/postoverflows/s01-whitelist/my-whitelist.yaml
CrowdSec - Whitelist intervalVariable

How often the public IP is checked for dynamic whitelist updates, in seconds.

apps.detail.config.target
WHITELIST_INTERVAL
apps.detail.config.default
900
apps.detail.config.value
900
CrowdSec - Restart waitVariable

Wait time after restarting CrowdSec for whitelist updates.

apps.detail.config.target
CROWDSEC_RESTART_WAIT
apps.detail.config.default
15
apps.detail.config.value
15
CrowdSec - Restart cooldownVariable

Minimum time between automatic CrowdSec restarts for whitelist updates.

apps.detail.config.target
CROWDSEC_RESTART_COOLDOWN
apps.detail.config.default
300
apps.detail.config.value
300
CrowdSec - Unban API tokenVariable

Recommended when /unban is enabled. Generate with: openssl rand -hex 32. Leave empty only on trusted LAN deployments.

apps.detail.config.target
UNBAN_API_TOKEN
Data - Cache TTLVariable

Metric cache time in seconds.

apps.detail.config.target
CACHE_TTL
apps.detail.config.default
60
apps.detail.config.value
60
Data - Days backVariable

How many days of CrowdSec alert history to display.

apps.detail.config.target
DAYS_BACK
apps.detail.config.default
365
apps.detail.config.value
365
Drops - Enable live drops APIVariable

Enable the optional /drops API. Requires a JSONL file mounted at DROPS_LOG_PATH.

apps.detail.config.target
DROPS_ENABLED
apps.detail.config.default
false
apps.detail.config.value
false
Drops - JSONL pathVariable

Path inside the container to the optional firewall drops JSONL file.

apps.detail.config.target
DROPS_LOG_PATH
apps.detail.config.default
/crowdsec/drops/drops.jsonl
apps.detail.config.value
/crowdsec/drops/drops.jsonl
Drops - Max eventsVariable

Maximum number of live drop events returned by /drops.

apps.detail.config.target
DROPS_MAX_EVENTS
apps.detail.config.default
200
apps.detail.config.value
200
Drops - Max age secondsVariable

Only keep drop events newer than this age. Use 0 to disable age filtering.

apps.detail.config.target
DROPS_MAX_AGE_SECONDS
apps.detail.config.default
3600
apps.detail.config.value
3600