[BUG] crowdsec bouncer trying to send metrics to central crowdsec instance but failing

[bondskin]

Is there an existing issue for this?

• I have searched the existing issues

Name of mod

linuxserver/mods:swag-crowdsec

Name of base container

swag

Current Behavior

Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.feature_flags of type []string" func=UsageMetrics

swag 172.18.0.1 ✔️ 2025-06-27T06:28:16Z crowdsec-nginx-bouncer v1.1.1 api-key

It seems that the bouncer version in swag (1.1.1) is too old and central Crowdsec is expecting a newer version for handling the metrics

Expected Behavior

metrics successfully sending to central Crowdsec instance

Steps To Reproduce

running both swag + mod & crowdsec latest images, this error comes up regularly.
I cannot update the bouncer version inside the swag container/image.

Environment

- OS: Pi4 debian bookworm
- How docker service was installed: apt

CPU architecture

arm64

Docker creation

swag/crowdsec bouncer instance:
image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
      - URL=xxx
      - VALIDATION=http  # dns
      - SUBDOMAINS=xxx
      - ONLY_SUBDOMAINS=false
      - EMAIL=xxx

      - SWAG_AUTORELOAD=true  # optional
      - SWAG_AUTORELOAD_WATCHLIST=/config/nginx/site-confs,/config/nginx/proxy-confs,/config/keys,/config/nginx/ip-blocks,/config/fail2ban/filter.d  # optional
      - DOCKER_MODS=linuxserver/mods:swag-dashboard|linuxserver/mods:swag-maxmind|linuxserver/mods:swag-crowdsec|linuxserver/mods:swag-geoip2influx
      - MAXMINDDB_LICENSE_KEY=${MAXMINDDB_LICENSE_KEY}
      - MAXMINDDB_USER_ID=${MAXMINDDB_USER_ID}
      - INFLUX_DATABASE=geoip2influx
      - INFLUX_USER=unpoller
      - INFLUX_PASS=${INFLUX_PASS}
      - INFLUX_URL=http://192.168.2.66:8086
      - INFLUX_HOST=192.168.2.66
      - INFLUX_HOST_PORT=8086
      - INFLUX_RETENTION=7d
      - USE_INFLUXDB_V2=false
      - GEOIP2INFLUX_LOG_LEVEL=info
      - CROWDSEC_API_KEY=xxx
      - CROWDSEC_LAPI_URL=http://192.168.2.66:8484
      - CROWDSEC_F2B_DISABLE=false


central instance:
rowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    ports:
      - "8484:8080"  # LAPI
      - "6060:6060"  # Exponiere den Prometheus-Endpunkt
    volumes:
      - ./crowdsec/data:/var/lib/crowdsec/data
      - ./crowdsec/config:/etc/crowdsec
      - /home/pi/docker/swag/config/log:/var/log/swag:ro
      - /home/pi/docker/mailu/logs:/mailu_logs:ro
      - /var/log:/host_logs:ro
    environment:
      - TZ=Europe/Berlin
    restart: unless-stopped

Container logs

time="2025-06-27T08:46:26+02:00" level=info msg="Sent 1 usage metrics"
time="2025-06-27T08:47:07+02:00" level=info msg="flushed 1/243 alerts because they were created 168h0m0s ago or more"
time="2025-06-27T08:47:10+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.feature_flags of type []string" func=UsageMetrics
time="2025-06-27T08:47:10+02:00" level=info msg="172.18.0.1 - [Fri, 27 Jun 2025 08:47:10 CEST] \"POST /v1/usage-metrics HTTP/1.1 400 1.620495ms \"crowdsec-nginx-bouncer/v1.1.1\" \""
time="2025-06-27T08:47:11+02:00" level=info msg="127.0.0.1 - [Fri, 27 Jun 2025 08:47:11 CEST] \"GET /v1/heartbeat HTTP/1.1 200 52.709691ms \"crowdsec/v1.6.9-40b8cfe6-docker\" \""
time="2025-06-27T08:48:11+02:00" level=info msg="127.0.0.1 - [Fri, 27 Jun 2025 08:48:11 CEST] \"GET /v1/heartbeat HTTP/1.1 200 54.0445ms \"crowdsec/v1.6.9-40b8cfe6-docker\" \""
time="2025-06-27T08:49:11+02:00" level=info msg="127.0.0.1 - [Fri, 27 Jun 2025 08:49:11 CEST] \"GET /v1/heartbeat HTTP/1.1 200 51.205891ms \"crowdsec/v1.6.9-40b8cfe6-docker\" \""
time="2025-06-27T08:49:19+02:00" level=info msg="capi metrics: sending"

[Bidonh]

Hello, I don't have this problem sending metrics.

Linuxserver.io swag     version: 4.1.1-ls391
crowdsecurity/crowdsec  version: v1.6.9

but I know you can choose Crowdsec bouncer version in Swag with an environnement variable.

      # FIX for Invalid tarball, could not download crowdsec bouncer
      #- CROWDSEC_VERSION=v1.0.8

I used it before to fix the " Invalid tarball" error.

[bondskin]

Thanks @Bidonh,

This is what I see in the Crowdsec website

My Swag in a container is 4.1.1-ls392

[Bidonh]

This is what I see and the unknown version inactive is apparently not a bug.

The crowdsec nginx bouncer should be v1.1.2.

In my log, I don't see any reference to crowdsec-nginx-bouncer at all, I am on a Synology not a Pi4.

• time="2025-07-03T14:00:34+02:00" level=info msg="127.0.0.1 - [Thu, 03 Jul 2025 14:00:34 CEST] "POST /v1/usage-metrics HTTP/1.1 201 4.364876657s "crowdsec/v1.6.9-40b8cfe6-docker" ""
• time="2025-07-03T14:01:30+02:00" level=info msg="127.0.0.1 - [Thu, 03 Jul 2025 14:01:30 CEST] "GET /v1/heartbeat HTTP/1.1 200 66.693852ms "crowdsec/v1.6.9-40b8cfe6-docker" ""
• time="2025-07-03T14:01:30+02:00" level=info msg="127.0.0.1 - [Thu, 03 Jul 2025 14:01:30 CEST] "GET /v1/allowlists?with_content=true HTTP/1.1 200 79.05139ms "crowdsec/v1.6.9-40b8cfe6-docker" ""

In my docker compose I use:

• VALIDATION=dns
• CROWDSEC_LAPI_URL=http://crowdsec:8080

Have you tried to delete the docker images, pulling again them from the repositories and building the containers again ?

[bondskin]

thanks @Bidonh , my ngin-bouncer comes as a mod within SWAG and I cannot update it by my own.
I think I will open a new issue to clarify, when SWA will update the Crowdsec mod to include latest v 1.1.2

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.