docs: Update docs for the correctness (#13)

services/docs/content/en/root/concepts/security-model.md

@@ -6,29 +6,62 @@ weight: 20
 
 Security in Root is achieved through strict privilege isolation and project-level "sandboxing" to mitigate the impact of service compromises.
 
-## The "No-Root" principle {#noroot}
+## The "No-Root" Principle {#noroot}
 
 Running applications as `root` inside containers is a significant security risk. The framework enforces isolation via the `tiers/useradd` and `tiers/chown` actions.
 
 ### Project-specific users
 
-Every project (e.g., `traefik`, `synapse`) is assigned a dedicated system user on the host. 
+Every project located at `{repository root}/{node}/{project}` is assigned a dedicated system user on the host. 
 
 - **Isolation**: If a container is compromised, the attacker only gains the privileges of that specific low-privileged user.
 - **Filesystem safety**: Projects can only read/write to their own directories within the [Tiers](/root/glossary#tier).
 
 ## Docker socket protection {#socket-protection}
 
-Direct access to `/var/run/docker.sock` is equivalent to root access on the host. To prevent services from abusing this access, the framework utilizes a **Socket Proxy**.
+Direct access to `/var/run/docker.sock` is equivalent to root access on the host. As a best practice, it is highly recommended to protect the Docker socket. One way to achieve this is by utilizing a **Socket Proxy** (e.g., based on `tecnativa/docker-socket-proxy`) to filter and restrict access to the Docker API.
 
-- **Restricted API**: The proxy filters Docker API calls, allowing only necessary operations (e.g., `GET containers`) and blocking dangerous ones (e.g., `POST containers/create`).
+```yaml filename="docker-socket-proxy-example.yml"
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy:0
+    container_name: root-socket-proxy
+    user: "0:0"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      CONTAINERS: 1
+      SERVICES: 1
+      TASKS: 1
+    networks:
+      socket: {}
+    restart: unless-stopped
+
+  traefik:
+    # ...
+    depends_on:
+      - socket-proxy
+    command:
+      # Use the proxy instead of the local socket
+      - "--providers.docker.endpoint=tcp://root-socket-proxy:2375"
+    networks:
+      socket: {}
+```
+
+## Security Monitoring (CrowdSec) {#crowdsec}
+
+The framework integrates **CrowdSec** for behavioral detection and automated response.
+
+- **Intrusion detection**: CrowdSec monitors logs from [Traefik](https://traefik.io/) and SSH for suspicious patterns (e.g., brute-force attacks, port scanning).
+- **Automated blocking**: When a threat is detected, the **CrowdSec Firewall Bouncer** automatically updates [UFW](https://help.ubuntu.com/community/UFW) rules to block the malicious IP at the host level.
+- **Shared threat intelligence**: CrowdSec shares anonymized threat data with its community, providing preemptive protection against known bad actors.
 
 ## Network hardening {#networking}
 
 Root uses `configure/ufw` to implement a "Default Deny" policy.
 
-- **Internal routing**: Services communicate over a dedicated `root-direct` bridge network.
-- **TProxy integration**: Outgoing traffic is routed through Xray for enclave-like isolation and granular routing rules.
+- **Internal routing**: Services communicate over a dedicated `root-proxy` bridge network, which is often configured as `internal: true`.
+- **Enclave isolation**: Outgoing traffic can be routed through a dedicated egress node for granular control.
 
 ---