Database Configuration

CrowdSec supports multiple database backends for the Local API.

Supported Backends

Backend	Type value	Best for
SQLite	`sqlite`	Single-instance, small to medium deployments
MySQL	`mysql`	Distributed setups, high-volume environments
PostgreSQL	`postgresql`	Distributed setups, enterprise requirements
PGX	`pgx`	PostgreSQL with pgx driver (enhanced PostgreSQL support)

SQLite (Default)

db_config:
  type: sqlite
  db_path: /var/lib/crowdsec/data/crowdsec.db
  use_wal: true            # Write-Ahead Logging for better concurrency
  max_open_conns: 100

WAL mode improves performance significantly. Enable it unless the database is on a network share. When WAL is unspecified, a startup warning is shown.

MySQL

db_config:
  type: mysql
  user: crowdsec
  password: "${DB_PASSWORD}"
  db_name: crowdsec
  host: 192.168.1.100
  port: 3306
  sslmode: require
  max_open_conns: 100

Socket connection:

db_config:
  type: mysql
  db_path: /var/run/mysqld/mysqld.sock
  user: crowdsec
  password: "${DB_PASSWORD}"
  db_name: crowdsec

PostgreSQL

db_config:
  type: postgresql
  user: crowdsec
  password: "${DB_PASSWORD}"
  db_name: crowdsec
  host: 192.168.1.100
  port: 5432
  sslmode: require
  ssl_ca_cert: "/path/to/ca.crt"
  ssl_client_cert: "/path/to/client.crt"
  ssl_client_key: "/path/to/client.key"
  max_open_conns: 100

PGX (Enhanced PostgreSQL)

Same as PostgreSQL but uses the pgx driver:

db_config:
  type: pgx
  user: crowdsec
  password: "${DB_PASSWORD}"
  db_name: crowdsec
  host: 192.168.1.100
  port: 5432

Flush Configuration

Controls alert/metrics retention:

db_config:
  flush:
    max_items: 50000        # Max alerts in DB (older ones are purged)
    max_age: "7d"            # Alert retention (s=seconds, m=minutes, h=hours, d=days)
    metrics_max_age: "90d"   # Metrics retention

    # Auto-delete stale bouncers
    bouncers_autodelete:
      cert: "720h"           # Delete TLS-authenticated bouncers after N hours without pull
      api_key: "720h"        # Delete API key bouncers after N hours without pull

    # Auto-delete stale agents
    agents_autodelete:
      cert: "720h"           # Delete TLS-agents after N hours without push
      login_password: "720h" # Delete login/password agents after N hours without push

Performance Notes

SQLite with WAL is suitable for most deployments up to hundreds of decisions/second
MySQL/PostgreSQL are recommended for distributed multi-instance setups
max_open_conns defaults to 100 — increase if you see too many connections errors
decision_bulk_size (default: 1000, max: 2000) controls how many decisions are inserted per query
On low-power devices (Raspberry Pi, SD cards), raise decision_bulk_size to 2000 and ensure WAL is enabled

2.9 KiB Raw Blame History