This briefing has not refreshed recently, so what you see may be out of date.
✓Healthy
Everything is operating normally.
7 of 7 services are healthy and mirrored; 8 of 8 fleet nodes are reporting; 3 of 3 backups are on schedule. 2 items to watch.
A self-hosted, multi-node platform with mirrored public services, automatic DNS failover, and FluxCD-managed configuration. CrowdSec distributes threat decisions, nftables enforces them, and each node automatically repairs firewall drift. A decision engine escalates repeat offenders across the fleet.
This briefing pulls together the platform's own APIs to show what's healthy, what changed, and what needs attention.
All 7 are up on both their primary and mirror, and served from the primary. Each service runs on a primary and a mirror; DNS moves to the mirror automatically if the primary fails.
Threat picture
The 25 most recent distinct threats from CrowdSec, reaching back 3.2 h, seen by 6 nodes. 21 went for live services and are broken down below; 4 were caught only by the SSH honeypot and banned across the fleet. Severity reflects the techniques a source attempted.
By severity
Critical3
High7
Low11
By technique (MITRE ATT&CK)
Active scanning T159514
Exploit public-facing application T119010
Bans per day, last 30 days
The line marks the median day (218). The pale bar is today, still in progress.
View daily values
Oct 22321 so far
Oct 21295
Oct 20295
Oct 19229
Oct 18148
Oct 17100
Oct 16346
Oct 15330
Oct 14333
Oct 13313
Oct 12410
Oct 11147
Oct 10233
Oct 9183
Oct 8385
Oct 7179
Oct 6208
Oct 5235
Oct 4220
Oct 3122
Oct 2253
Oct 1260
Sep 30193
Sep 29203
Sep 28147
Sep 27188
Sep 26158
Sep 25217
Sep 24110
Sep 23409
Decision engine, active now
14-day ban199
24-hour ban30
Watching378
New in the last 24 hours: 11 14-day bans, 30 24-hour bans, 81 watching.
Each node continuously compares its nftables firewall with CrowdSec's ban decisions and repairs any mismatch: 14 mismatches were detected and 13 repaired in the last 24 hours.
Backups and recovery
Node
Last backup
Verification
Restore test
Triton
✓1.8 h ago5.43 GB, about every 8 h
✓Verified 17 h agofull data check 8 d ago
✓Passed 22 d ago11 passed
Ares
✓5.8 h ago1.23 GB, about every 8 h
–
–
Zephyrus
✓12 h ago594 MB, about every 12 h
✓Verified 17 h agofull data check 8 d ago
✓Passed 22 d ago11 passed
Verification checks repository integrity. A restore test restores a backup and checks its hashes and contents. A dash means that check is not set up for the node yet.
A second node holds a live copy of Gitea and takes over through a manual failover. Work at risk is how far the older of its database and file copies is behind (last report ).
Software updates
2updates availableplus 6 held back, waiting on upstream
2patch and minoroldest released 9.6 h ago
0major, breakingneed a planned migration
Renovate checks container and chart versions against upstream releases (last scan ). Updates are reviewed and merged by hand. Package names are deliberately not published.
Change delivery
GitOps
✓ Healthy3 of 3 clusters reconciled
0failing now
15 minsince the last change
✓Ares✓Triton✓Zephyrus
Flux reconciles each cluster from its Git repository. Failing now counts resources that were not ready at the last check (last check ).
CI
✓ Green9 of 9 repos green on main
98%pass rate, 527 runs in 7 days
9 smedian run on main
Pushes and pull requests across my private repositories. The pass rate leaves out cancelled runs, and only the default branch decides whether CI is failing. Last run .
Engineering activity
30of 30 days active
Commits across my repositories, last 30 days. The pale bar is today so far, as of 1:50 PM. Over the last year: 262 of 364 days.