Home

secwatch

The easy, all-in-one security monitor for your self-hosted server.

secwatch watches your reverse proxy's access log and your internal apps' logs, keeps an eye on host/process/container state, auto-bans hostile IPs at the edge, and serves a self-contained dashboard — one lightweight tool, one config file, one command to install.

This wiki is the how-to. If you just want to get running, start with Installation, then skim Configuration.

Guides

• Installation — install wizard, manual setup, systemd, upgrading.
• Configuration — how secwatch.yaml + SECWATCH_* env vars resolve, and the settings you'll actually touch.
• Log Sources — watch one log or many (edge proxy + internal apps); add or auto-scan sources from the dashboard.
• Detection and Bans — what secwatch flags, how auto-ban works, ban actuators, and keeping trusted networks narrow.
• Dashboard and Authentication — the built-in login, running behind an authenticating proxy.
• Alerting — Discord webhook setup, and quieting routine scanner noise so you're only pinged for what matters.
• CVE Scanning — image vulnerability scans + the CISA-KEV "actively exploited" flag.
• LLM Analysis — optional plain-language traffic analysis via any OpenAI-compatible endpoint.
• Crowd Intel — optional, self-hostable community blocklist (opt-in, attacker-IPs-only).
• Deployment — Docker, and the all / core / agent modes.
• Troubleshooting — common issues and how to diagnose them.

What it is (and isn't)

secwatch rolls the pieces most homelabbers actually want — edge bans, host/EDR-lite, FIM, CVE awareness — into one readable, low-dependency tool. It complements CrowdSec / Wazuh / Trivy rather than replacing them. It's a monitoring and mitigation aid, not a firewall or a patch manager. If you already run and love the heavyweight stack, keep it.

Requirements

Python 3.11+. Optional: Docker (CVE scan + container watch), an OpenAI-compatible LLM endpoint (AI analysis), nft/nginx for those ban actuators.