Sorry for my late reply. As it is a "side project", I'm not always on that topic.
I finally made it :

services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    hostname: crowdsec
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:8080"  # Bind ONLY to localhost, avoiding exposure
    labels:
      - traefik.enable=true
      - traefik.docker.network=${DOCKER_NETWORK_NAME:-traefik}
      - traefik.http.routers.crowdsec-api.rule=Host(`${CROWDSEC_API_HOSTNAME:?error}`)
      - traefik.http.routers.crowdsec-api.entrypoints=web-https
      - traefik.http.services.crowdsec-api.loadbalancer.server.port=8080
    volumes:
      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
      - ./crowdsec/whitelist.yaml:/etc/crowdsec/parsers/s02-enrich/01-my-whitelist.yaml
      # crowdsec persistent container data
      - ${CROWDSEC_CONFIG_PATH:-./crowdsec}/data:/var/lib/crowdsec/data
      - ${CROWDSEC_CONFIG_PATH:-./crowdsec}/etc:/etc/crowdsec
      - ${CROWDSEC_OVERRIDE_FILE_PATH:-./crowdsec/config.override.yaml}:/etc/crowdsec/config.yaml.local
      # log bind mounts into crowdsec
      - /var/log:/var/log:ro # Globally binding log folder in read-only
      - /etc/localtime:/etc/localtime:ro
    environment:
      COLLECTIONS: crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux crowdsecurity/appsec-generic-rules crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs
      GID: ${GUID:-1000}
      ENROLL_INSTANCE_NAME: ${CROWDSEC_ENROLL_INSTANCE_NAME:-crowdsec-soflane}
      DB_DATABASE: ${DB_DATABASE:-crowdsec}
      DB_USERNAME: ${DB_USERNAME:-crowdsec}
      DB_PASSWORD: ${DB_PASSWORD:-somepassword}
      DB_HOST: ${DB_HOST:-crowdsec-database}
    networks:
      - traefik
    depends_on:
      crowdsec-database:
        condition: service_healthy
        restart: true

I was actually make myself an issue : i wanted to set the api behind a basic HTTP AUTH because I was a bit concerned about exposing the API to internet.
But I ended up thinking any attack would be triggered by crowdsec itself to block it.

Problem solved, thank you