CrowdSec-Threat-Map

CrowdSec-Threat-Map

Docker app from Railloune's Repository

Overview

CrowdSec Threat Map displays local CrowdSec alerts on an interactive world map with a live feed, English/French UI, larger readable text, CSV export, themes, optional unban support and optional dynamic whitelist support. Mount your CrowdSec database read-only for a safe dashboard-only setup.

Readme

View on GitHub

CrowdSec Threat Map

CrowdSec Threat Map displays local CrowdSec alerts on an interactive world map with a live feed, search, filters and optional dashboard actions.

This Railline fork adds:

  • English and French UI (LANGUAGE=en or LANGUAGE=fr)
  • Larger dashboard text for readability
  • Unraid-friendly template defaults

Safe Default

For a dashboard-only setup:

  • Mount /crowdsec/data read-only.
  • Leave Docker socket empty.
  • Leave WHITELIST_ENABLED=false.

The Docker socket is only needed for dashboard unban or dynamic whitelist restart actions.

Links

Install CrowdSec-Threat-Map on Unraid in a few clicks.

Find CrowdSec-Threat-Map in Community Apps on your Unraid server, review the template, and click Install. Unraid handles the Docker app or plugin setup from the published template.

Open the Apps tab on your Unraid server Search Community Apps for CrowdSec-Threat-Map Review the template variables and paths Click Install
Explore Unraid OS

Requirements

CrowdSec Docker Container

Categories

Tools > Network > Security

Related apps

Explore more like this

Explore all
Security apps

Links

Projectgithub.comSupportgithub.comRegistrygithub.comTemplateraw.githubusercontent.com

Details

Repository
ghcr.io/railline/crowdsec-threat-map-docker:latest
Registry
https://github.com/Railline/crowdsec-threat-map-docker/pkgs/container/crowdsec-threat-map-docker
Last Updated2026-08-23
First Seen2026-06-19

Runtime arguments

Web UI
http://[IP]:[PORT:8080]/
Network
bridge
Shell
sh
Privileged
false
Extra Params
--security-opt=no-new-privileges:true

Template configuration

WebUI - HTTP host portPorttcp

Host port for the CrowdSec Threat Map web dashboard.

Target
8080
Default
8095
Value
8095
Paths - CrowdSec dataPathro

CrowdSec data directory containing crowdsec.db and optionally GeoLite2-City.mmdb. Keep read-only for dashboard-only deployments.

Target
/crowdsec/data
Default
/mnt/user/appdata/crowdsec/data
Value
/mnt/user/appdata/crowdsec/data
Paths - CrowdSec postoverflowsPathrw

Optional CrowdSec postoverflows directory. Required only if WHITELIST_ENABLED=true.

Target
/crowdsec/postoverflows
Default
/mnt/user/appdata/crowdsec/postoverflows
Paths - Docker socketPathro

Optional Docker socket. Required only for dashboard unban or dynamic whitelist CrowdSec restart actions.

Target
/var/run/docker.sock
Default
/var/run/docker.sock
Core - SERVER_LATVariable

Server marker latitude. Example for Paris: 48.8566.

Target
SERVER_LAT
Default
0.0
Value
0.0
Core - SERVER_LONVariable

Server marker longitude. Example for Paris: 2.3522.

Target
SERVER_LON
Default
0.0
Value
0.0
Core - SERVER_NAMEVariable

Display name for the server marker.

Target
SERVER_NAME
Default
MyServer
Value
MyServer
Core - TZVariable

Container timezone.

Target
TZ
Default
Europe/Paris
Value
Europe/Paris
Core - LANGUAGEVariable

Dashboard language: en or fr.

Target
LANGUAGE
Default
en
Value
en
CrowdSec - Container nameVariable

CrowdSec Docker container name. Used only when Docker socket access is mounted for unban/whitelist actions.

Target
CROWDSEC_CONTAINER
Default
crowdsec
Value
crowdsec
CrowdSec - Dynamic whitelist enabledVariable

Enable only if the postoverflows path is mounted read-write and Docker socket access is intentionally enabled.

Target
WHITELIST_ENABLED
Default
false
Value
false
CrowdSec - Whitelist fileVariable

Whitelist YAML path inside the container.

Target
WHITELIST_FILE
Default
/crowdsec/postoverflows/s01-whitelist/my-whitelist.yaml
Value
/crowdsec/postoverflows/s01-whitelist/my-whitelist.yaml
CrowdSec - Whitelist intervalVariable

How often the public IP is checked for dynamic whitelist updates, in seconds.

Target
WHITELIST_INTERVAL
Default
900
Value
900
CrowdSec - Restart waitVariable

Wait time after restarting CrowdSec for whitelist updates.

Target
CROWDSEC_RESTART_WAIT
Default
15
Value
15
CrowdSec - Restart cooldownVariable

Minimum time between automatic CrowdSec restarts for whitelist updates.

Target
CROWDSEC_RESTART_COOLDOWN
Default
300
Value
300
CrowdSec - Unban API tokenVariable

Recommended when /unban is enabled. Generate with: openssl rand -hex 32. Leave empty only on trusted LAN deployments.

Target
UNBAN_API_TOKEN
Data - Cache TTLVariable

Metric cache time in seconds.

Target
CACHE_TTL
Default
60
Value
60
Data - Days backVariable

How many days of CrowdSec alert history to display.

Target
DAYS_BACK
Default
365
Value
365