diff --git a/security/crowdsec-firewall-bouncer/Makefile b/security/crowdsec-firewall-bouncer/Makefile
index 6f9b4c3b9649..a52441bcfc53 100644
--- a/security/crowdsec-firewall-bouncer/Makefile
+++ b/security/crowdsec-firewall-bouncer/Makefile
@@ -1,63 +1,64 @@
 PORTNAME=	crowdsec-firewall-bouncer
 PORTVERSION=	0.0.20  # NOTE: change BUILD_VERSION and BUILD_TAG as well
 DISTVERSIONPREFIX=	v
 CATEGORIES=	security
 
 MAINTAINER=	marco@crowdsec.net
 COMMENT=	CrowdSec bouncer written in golang for firewalls
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	git:devel/git@lite \
 		go:lang/go
 
 USES=		gmake
 
 RUN_DEPENDS=	crowdsec>0:security/crowdsec
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	crowdsecurity
 GH_PROJECT=	cs-firewall-bouncer
 GH_TAGNAME=	v0.0.20-freebsd
 #GH_TAGNAME is automatically set from DISTVERSION
 
 USE_RC_SUBR=	crowdsec_firewall
 
 SUB_FILES=	pkg-message \
+		pkg-install \
 		pkg-deinstall
 
 # BUILD_VERSION=$(git describe --tags $(git rev-list --tags --max-count=1))
 # BUILD_TAG=$(git rev-parse HEAD)
 MAKE_ENV=	BUILD_VERSION="v0.0.20" \
 		BUILD_TAG="a456a4debdf3d3551c89b8490bb942f626027310"
 
 ETCDIR=		${PREFIX}/etc/crowdsec/bouncers
 
 post-patch:
 	${REINPLACE_CMD} 's,$${BACKEND},pf,g' \
 		${WRKSRC}/config/crowdsec-firewall-bouncer.yaml
 
 do-install:
 	#
 	# Binaries
 	#
 
 	${INSTALL_PROGRAM} ${WRKSRC}/crowdsec-firewall-bouncer \
 		${STAGEDIR}${PREFIX}/bin/crowdsec-firewall-bouncer
 
 	#
 	# Configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${WRKSRC}/config/crowdsec-firewall-bouncer.yaml \
 		${STAGEDIR}${ETCDIR}/crowdsec-firewall-bouncer.yaml.sample
 
 	#
 	# Log rotation
 	#
 
 	${INSTALL_DATA} ${FILESDIR}/crowdsec-firewall-bouncer.conf-newsyslog ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d/crowdsec-firewall-bouncer.conf.sample
 
 .include <bsd.port.mk>
diff --git a/security/crowdsec-firewall-bouncer/files/pkg-deinstall.in b/security/crowdsec-firewall-bouncer/files/pkg-deinstall.in
index 0324401c6e19..8167b3f0167f 100644
--- a/security/crowdsec-firewall-bouncer/files/pkg-deinstall.in
+++ b/security/crowdsec-firewall-bouncer/files/pkg-deinstall.in
@@ -1,8 +1,9 @@
 #!/bin/sh
 
 case $2 in
-       DEINSTALL)
+       "DEINSTALL")
+               service crowdsec_firewall status && touch /var/run/crowdsec_firewall.running
                service crowdsec_firewall stop || :
                ;;
 esac
 
diff --git a/security/crowdsec-firewall-bouncer/files/pkg-install.in b/security/crowdsec-firewall-bouncer/files/pkg-install.in
new file mode 100644
index 000000000000..f75e58ce4685
--- /dev/null
+++ b/security/crowdsec-firewall-bouncer/files/pkg-install.in
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+case $2 in
+        "POST-INSTALL")
+                if [ -e /var/run/crowdsec_firewall.running ]; then
+                        service crowdsec_firewall start
+                        rm -f /var/run/crowdsec_firewall.running
+                fi
+                ;;
+esac
diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile
index dbc74172642a..6fad13f10378 100644
--- a/security/crowdsec/Makefile
+++ b/security/crowdsec/Makefile
@@ -1,133 +1,135 @@
 PORTNAME=	crowdsec
 PORTVERSION=	1.2.3	# NOTE: change BUILD_VERSION and BUILD_TAG as well
+PORTREVISION=	1
 DISTVERSIONPREFIX=	v
 CATEGORIES=	security
 
 MAINTAINER=	marco@crowdsec.net
 COMMENT=	CrowdSec lightweight and collaborative security engine
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	git:devel/git@lite \
 		go:lang/go \
 		jq:textproc/jq
 
 USES=		gmake
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	crowdsecurity
 GH_PROJECT=	crowdsec
 GH_TAGNAME=	v1.2.3-freebsd
 #GH_TAGNAME is automatically set from DISTVERSION
 
 USE_RC_SUBR=	crowdsec
 
 SUB_FILES=	pkg-message \
+		pkg-install \
 		pkg-deinstall
 
 # BUILD_VERSION=$(git describe --tags $(git rev-list --tags --max-count=1))
 # BUILD_TAG=$(git rev-parse HEAD)
 MAKE_ENV=	BUILD_VERSION="v1.2.3" \
 		BUILD_TAG="fc4be1e0ffc5888f2824358464cb2426cd4472e1"
 
 PLUGIN_DIR=	${PREFIX}/lib/crowdsec/plugins
 STAGE_PLUGINS=	${STAGEDIR}${PLUGIN_DIR}
 STAGE_BIN=	${STAGEDIR}${PREFIX}/bin
 
 post-patch:
 	@${REINPLACE_CMD} 's,/etc/crowdsec/,${ETCDIR}/,g' \
 		${WRKSRC}/pkg/csconfig/config.go \
 		${WRKSRC}/pkg/cstest/hubtest_item.go \
 		${WRKSRC}/cmd/crowdsec-cli/machines.go \
 		${WRKSRC}/cmd/crowdsec-cli/main.go \
 		${WRKSRC}/cmd/crowdsec/main.go \
 		${WRKSRC}/config/config.yaml \
 		${WRKSRC}/config/profiles.yaml
 
 	@${REINPLACE_CMD} 's,/var/lib/,/var/db/,g' \
 		${WRKSRC}/pkg/csconfig/config.go \
 		${WRKSRC}/pkg/metabase/database.go \
 		${WRKSRC}/config/config.yaml \
 		${WRKSRC}/config/profiles.yaml
 
 do-install:
 	#
 	# Binaries
 	#
 
 	${INSTALL_PROGRAM} ${WRKSRC}/cmd/crowdsec/crowdsec ${STAGE_BIN}/
 	${INSTALL_PROGRAM} ${WRKSRC}/cmd/crowdsec-cli/cscli ${STAGE_BIN}/
 	${LN} -s cscli ${STAGE_BIN}/crowdsec-cli
 
 	@${MKDIR} ${STAGE_PLUGINS}
 	${INSTALL_PROGRAM} ${WRKSRC}/plugins/notifications/email/notification-email ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKSRC}/plugins/notifications/http/notification-http ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKSRC}/plugins/notifications/slack/notification-slack ${STAGE_PLUGINS}/
 	${INSTALL_PROGRAM} ${WRKSRC}/plugins/notifications/splunk/notification-splunk ${STAGE_PLUGINS}/
 
 	#
 	# Configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	@(cd ${WRKSRC}/config && ${COPYTREE_SHARE} . ${STAGEDIR}${ETCDIR})
 
 	@${MV} ${STAGEDIR}${ETCDIR}/acquis.yaml \
 		${STAGEDIR}${ETCDIR}/acquis.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/config.yaml \
 		${STAGEDIR}${ETCDIR}/config.yaml.sample
 
 	@${MV} ${STAGEDIR}${ETCDIR}/profiles.yaml \
 		${STAGEDIR}${ETCDIR}/profiles.yaml.sample
 
 	# managed by "cscli simulation"
 	@${MV} ${STAGEDIR}${ETCDIR}/simulation.yaml \
 		${STAGEDIR}${ETCDIR}/simulation.yaml.sample
 
 	#
 	# Plugin configuration
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/email
 	@${MV} ${WRKSRC}/plugins/notifications/email/email.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/email/email.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/http
 	@${MV} ${WRKSRC}/plugins/notifications/http/http.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/http/http.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/slack
 	@${MV} ${WRKSRC}/plugins/notifications/slack/slack.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/slack/slack.yaml.sample
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/notifications/splunk
 	@${MV} ${WRKSRC}/plugins/notifications/splunk/splunk.yaml \
 		${STAGEDIR}${ETCDIR}/notifications/splunk/splunk.yaml.sample
 
 	# updated by "cscli machines" at first service start
 	@${MV} ${STAGEDIR}${ETCDIR}/local_api_credentials.yaml \
 		${STAGEDIR}${ETCDIR}/local_api_credentials.yaml.sample
 
 	# updated by "cscli capi" at first service start
 	@${MV} ${STAGEDIR}${ETCDIR}/online_api_credentials.yaml \
 		${STAGEDIR}${ETCDIR}/online_api_credentials.yaml.sample
 
 	#
 	# Data
 	#
 
 	@${MKDIR} ${STAGEDIR}${ETCDIR}/hub
 	@${MKDIR} ${STAGEDIR}/var/db/crowdsec/data
 
 	#
 	# Log rotation
 	#
 
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
 	${INSTALL_DATA} ${FILESDIR}/crowdsec.conf-newsyslog ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d/crowdsec.conf.sample
-
+	
 .include <bsd.port.mk>
diff --git a/security/crowdsec/files/crowdsec.conf-newsyslog b/security/crowdsec/files/crowdsec.conf-newsyslog
index a32cf4d567d7..560519c5a99f 100644
--- a/security/crowdsec/files/crowdsec.conf-newsyslog
+++ b/security/crowdsec/files/crowdsec.conf-newsyslog
@@ -1,3 +1,3 @@
 # logfilename			[owner:group]	mode	count	size(kb)	when	flags	[/pid_file]				[sig_num]
-/var/log/crowdsec.log		root:wheel	644  	10	5120		*	JC	/var/run/crowdsec.pid
-/var/log/crowdsec_api.log	root:wheel	644  	10	5120		*	JC	/var/run/crowdsec.pid
+/var/log/crowdsec.log		root:wheel	644  	10	20480		*	JC	/var/run/crowdsec.pid
+/var/log/crowdsec_api.log	root:wheel	644  	10	20480		*	JC	/var/run/crowdsec.pid
diff --git a/security/crowdsec/files/crowdsec.in b/security/crowdsec/files/crowdsec.in
index ac0f384a9572..113d66aed599 100644
--- a/security/crowdsec/files/crowdsec.in
+++ b/security/crowdsec/files/crowdsec.in
@@ -1,84 +1,84 @@
 #!/bin/sh
 
 # PROVIDE: crowdsec
 # REQUIRE: LOGIN DAEMON NETWORKING
 # KEYWORD: shutdown
 #
 # Add the following lines to /etc/rc.conf.local or /etc/rc.conf
 # to enable this service:
 #
 # crowdsec_enable (bool):	Set it to YES to enable crowdsec agent.
 #				Default is "NO".
 # crowdsec_config (str):	Set the agent config path.
 #				Default is "%%PREFIX%%/etc/crowdsec/config.yaml".
 # crowdsec_flags (str):	Set the extra flags to run agent.
 #				Default is ""
 
 . /etc/rc.subr
 
 name=crowdsec
 desc="Crowdsec Agent"
 rcvar=crowdsec_enable
 
 load_rc_config $name
 
 : "${crowdsec_enable:=NO}"
 : "${crowdsec_config:=%%PREFIX%%/etc/crowdsec/config.yaml}"
 : "${crowdsec_flags:=}"
 
 pidfile=/var/run/${name}.pid
 required_files="$crowdsec_config"
 command="%%PREFIX%%/bin/${name}"
 start_cmd="${name}_start"
 start_precmd="${name}_precmd"
 configtest_cmd="${name}_configtest"
 extra_commands="configtest reload"
 
 crowdsec_precmd() {
     cs_cli() {
         "%%PREFIX%%/bin/cscli" -c "${crowdsec_config}" "$@"
     }
     Config() {
         cs_cli config show --key "Config.$1"
     }
 
     HUB_DIR=$(Config ConfigPaths.HubDir)
     if ! ls -1qA "$HUB_DIR"/* >/dev/null 2>&1; then
         echo "Fetching hub inventory"
         cs_cli hub update || :
     fi
 
     if [ "$(cs_cli machines list -o json)" = "[]" ]; then
         echo "Registering LAPI"
         cs_cli machines add --auto || :
     fi
 
     CONFIG_DIR=$(Config ConfigPaths.ConfigDir)
     if [ ! -s "${CONFIG_DIR}/online_api_credentials.yaml" ]; then
         echo "Registering CAPI"
         cs_cli capi register || :
     fi
 
     # This would work but takes 30secs to timeout while reading the metrics, because crowdsec is not running yet.
     #    cs_cli collections inspect crowdsecurity/freebsd 2>/dev/null | grep ^installed | grep -q true || \
     #        cs_cli collections install crowdsecurity/freebsd || :
 
     # So we just check for the file
     if [ ! -e "${CONFIG_DIR}/collections/freebsd.yaml" ]; then
         cs_cli collections install crowdsecurity/freebsd || :
     fi
 }
 
 crowdsec_start()
 {
     /usr/sbin/daemon -f -p ${pidfile} -t "${desc}" -- \
-        ${command} -c ${crowdsec_config} ${crowdsec_flags}
+        ${command} -c "${crowdsec_config}" ${crowdsec_flags}
 }
 
 crowdsec_configtest()
 {
     echo "Performing sanity check on ${name} configuration."
         eval ${command} -c ${crowdsec_config} -t
 }
 
 run_rc_command "$1"
diff --git a/security/crowdsec/files/pkg-deinstall.in b/security/crowdsec/files/pkg-deinstall.in
index 1f067c828536..4fdfd0b04d72 100644
--- a/security/crowdsec/files/pkg-deinstall.in
+++ b/security/crowdsec/files/pkg-deinstall.in
@@ -1,8 +1,9 @@
 #!/bin/sh
 
 case $2 in
-       DEINSTALL)
+       "DEINSTALL")
+               service crowdsec status && touch /var/run/crowdsec.running
                service crowdsec stop || :
                ;;
 esac
 
diff --git a/security/crowdsec/files/pkg-install.in b/security/crowdsec/files/pkg-install.in
new file mode 100644
index 000000000000..9c13af959b40
--- /dev/null
+++ b/security/crowdsec/files/pkg-install.in
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+case $2 in
+        "POST-INSTALL")
+                if [ -e /var/run/crowdsec.running ]; then
+                        service crowdsec start
+                        rm -f /var/run/crowdsec.running
+                fi
+                ;;
+esac
diff --git a/security/crowdsec/pkg-plist b/security/crowdsec/pkg-plist
index a8e54a73df13..635dcc3da591 100644
--- a/security/crowdsec/pkg-plist
+++ b/security/crowdsec/pkg-plist
@@ -1,53 +1,50 @@
 @mode 0755
 bin/crowdsec
 bin/cscli
 bin/crowdsec-cli
 @mode 0600
 @sample %%ETCDIR%%/local_api_credentials.yaml.sample
 @sample %%ETCDIR%%/online_api_credentials.yaml.sample
 @mode 0644
 @sample %%ETCDIR%%/acquis.yaml.sample
 @sample %%ETCDIR%%/config.yaml.sample
 @sample %%ETCDIR%%/profiles.yaml.sample
 @sample %%ETCDIR%%/simulation.yaml.sample
 @sample %%ETCDIR%%/notifications/email/email.yaml.sample
 @sample %%ETCDIR%%/notifications/http/http.yaml.sample
 @sample %%ETCDIR%%/notifications/slack/slack.yaml.sample
 @sample %%ETCDIR%%/notifications/splunk/splunk.yaml.sample
-%%ETCDIR%%/dev.yaml
-%%ETCDIR%%/user.yaml
-%%ETCDIR%%/crowdsec.service
 %%ETCDIR%%/patterns/aws
 %%ETCDIR%%/patterns/bacula
 %%ETCDIR%%/patterns/bro
 %%ETCDIR%%/patterns/cowrie_honeypot
 %%ETCDIR%%/patterns/exim
 %%ETCDIR%%/patterns/firewalls
 %%ETCDIR%%/patterns/haproxy
 %%ETCDIR%%/patterns/java
 %%ETCDIR%%/patterns/junos
 %%ETCDIR%%/patterns/linux-syslog
 %%ETCDIR%%/patterns/mcollective
 %%ETCDIR%%/patterns/modsecurity
 %%ETCDIR%%/patterns/mongodb
 %%ETCDIR%%/patterns/mysql
 %%ETCDIR%%/patterns/nagios
 %%ETCDIR%%/patterns/nginx
 %%ETCDIR%%/patterns/paths
 %%ETCDIR%%/patterns/postgresql
 %%ETCDIR%%/patterns/rails
 %%ETCDIR%%/patterns/redis
 %%ETCDIR%%/patterns/ruby
 %%ETCDIR%%/patterns/smb
 %%ETCDIR%%/patterns/ssh
 %%ETCDIR%%/patterns/tcpdump
 @sample etc/newsyslog.conf.d/crowdsec.conf.sample
 @mode 0755
 lib/crowdsec/plugins/notification-email
 lib/crowdsec/plugins/notification-http
 lib/crowdsec/plugins/notification-slack
 lib/crowdsec/plugins/notification-splunk
 @dir %%ETCDIR%%/hub
 @dir /var/db/crowdsec/data
 @dir /var/db/crowdsec
 @dir etc/newsyslog.conf.d