Add Crowdsec integration to Traefik

Configuration changes:
- Enable Traefik experimental plugins support
- Add Crowdsec bouncer plugin (maxlerebourg v1.3.3)
- Configure Crowdsec middleware in config.yml
- Connect Traefik to Crowdsec network
- Add IP whitelist middleware for internal network
- Update .gitignore to exclude crowdsec directory

Security enhancements:
- All routes now protected by Crowdsec threat intelligence
- Internal network IP whitelist for Traefik dashboard
- Crowdsec monitors all Traefik access logs
- Real-time blocking of malicious IPs

Protected services:
- Mealie (recipes.pkartchner.com)
- Gogs (git.pkartchner.com)
- Traefik Dashboard (internal network only)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

docker-compose.yml

@@ -9,6 +9,7 @@ services:
       - no-new-privileges:true
     networks:
       - traefik
+      - crowdsec
     ports:
       - "80:80"      # HTTP
       - "443:443"    # HTTPS
@@ -21,6 +22,7 @@ services:
       - ./traefik.yml:/traefik.yml:ro
       - ./acme.json:/acme.json
       - ./config.yml:/config.yml:ro
+      - ./logs:/var/log/traefik
     labels:
       - "traefik.enable=true"
       # Dashboard
@@ -28,10 +30,10 @@ services:
       - "traefik.http.routers.traefik.entrypoints=https"
       - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
       - "traefik.http.routers.traefik.service=api@internal"
-      - "traefik.http.routers.traefik.middlewares=traefik-auth"
-      # Dashboard auth (username: admin, password: change-this-password)
+      - "traefik.http.routers.traefik.middlewares=traefik-auth,internal-whitelist@file"
+      # Dashboard auth (username: admin, password: IdCTOFygYRqyDPSTOkUgMg==)
       # Generate new password: echo $(htpasswd -nb admin yourpassword) | sed -e s/\\$/\\$\\$/g
-      - "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$8evjlb96$$v8Y6gLV8KLVhqGB1N9NKQR/"
+      - "traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$GF9aEQUw$$iEUiC8oacwqPDqd4yPBnn/"
       # Global redirect to HTTPS
       - "traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)"
       - "traefik.http.routers.http-catchall.entrypoints=http"
@@ -42,3 +44,6 @@ networks:
   traefik:
     name: traefik
     driver: bridge
+  crowdsec:
+    name: crowdsec
+    external: true