here's my compose. I'm using Crowdsec in conjunction with Traefik


services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    restart: unless-stopped
    container_name: crowdsec-engine
    ports:
    - 8080:8080
    - 7422:7422
    environment:
      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"
      GID: "${GID-1000}"
    depends_on:
    - 'traefik'
    volumes:
    - /etc/docker/crowdsec/config/acquis.yaml:/etc/crowdsec/acquis.yaml
    - ./appsec.yaml:/etc/crowdsec/acquis.d/appsec.yaml
    - traefik-logs:/var/log/traefik:ro
    - crowdsec-db:/var/lib/crowdsec/data/
    - crowdsec-config:/etc/crowdsec/

  bouncer-traefik:
    image: fbonalair/traefik-crowdsec-bouncer:latest
    restart: unless-stopped
    container_name: bouncer-traefik
    environment:
      CROWDSEC_BOUNCER_API_KEY: ****
      CROWDSEC_AGENT_HOST: crowdsec:8080
    depends_on:
    - 'crowdsec'

  traefik:
    image: traefik:latest
    restart: unless-stopped
    command:
    - "--api.insecure=true"
    - "--providers.docker=true"
    - "--entrypoints.web.address=:80"
    - "--metrics.otlp=true"
    ports:
    - target: 80
      published: 80
      protocol: tcp
      mode: host
    - target: 443
      published: 443
      protocol: tcp
      mode: host
    - "8088:8080"
    volumes:
    - ./traefik/traefik.yml:/etc/traefik/traefik.yml
    - ./traefik/config.yml:/etc/traefik/config.yml
    - /var/run/docker.sock:/var/run/docker.sock
    - traefik-logs:/var/log/traefik
    labels:
      - "traefik.http.middlewares.add-forwarded-headers.headers.customrequestheaders.X-Forwarded-For=${remote_ip}"
      - "traefik.http.middlewares.add-forwarded-headers.headers.customrequestheaders.X-Real-Ip=${remote_ip}"

  whoami:
    image: traefik/whoami:latest
    restart: unless-stopped
    labels:
    - "traefik.http.routers.whoami.rule=Host(`whoami.localhost`)"

volumes:
  crowdsec-db:
  crowdsec-config:
  traefik_traefik-logs:
  traefik-logs: