Security status
Read the server's security state, CrowdSec first, as one JSON document, from the command line or over the read-only API.
Before another tool changes anything about the server's defences, it should look. LibrePortal gives you one document that says whether CrowdSec is installed and running, which firewall bouncers are connected, how many bans are active and which log sources are being read.
Ask for it#
sudo -u libreportal libreportal security status --json
prints one document, with no root-only parsing, and exits 0 even when CrowdSec is not installed (then installed is false). The same document is served read-only at GET /api/v1/system/security to an access key with the system:read scope. If LibrePortal has not written the document yet (just after a start), the API answers 503; try again in a minute.
{
"schema": "libreportal.security/1",
"schema_version": 1,
"generated_at": "2026-10-25T09:00:00Z",
"crowdsec": {
"managed_by_libreportal": true,
"installed": true,
"running": true,
"version": "1.8.1",
"bouncers": [
{ "name": "cs-firewall-bouncer", "type": "nftables", "connected": true, "last_pull": "2026-10-25T08:59:30Z" }
],
"decisions_active": { "total": 1234, "local": 12, "community": 1200, "lists": 22 },
"alerts_24h": 7,
"collections": ["crowdsecurity/linux", "crowdsecurity/sshd"],
"acquisitions": [
{ "owner": "libreportal", "type": "traefik", "source": "file", "target": "/libreportal-containers/traefik/log/access.log" }
]
}
}
Field names stay. New fields get added; schema_version only changes if one is removed or changes meaning. The document also carries the secure admin access fields it always had, and crowdsec keeps its old available and allowlist keys next to the new ones. connected means the bouncer asked for decisions in the last five minutes. decisions_active.community counts CrowdSec's shared blocklist, lists the blocklists you subscribed to, and local what this server decided.
To change anything, see CrowdSec for other software. Nothing here can be changed over the API; it only reads.