projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(crowdsec): CrowdSec IDS/IPS Management — v1.2.61

Browse Source 
- Backend: internal/crowdsec/service.go — vollständige cscli-Wrapper
  (Decisions, Alerts, Bouncers, Machines, Collections, ServiceStatus)
- Handler: 12 REST-Endpoints mit Audit-Logging unter /crowdsec/*
- Migration 0036: crowdsec_settings-Tabelle
- postinst: CrowdSec-Auto-Install (crowdsec + crowdsec-firewall-bouncer-nftables)
  inkl. sudoers-Einträge für alle cscli-Operationen
- systemd: /var/lib/crowdsec in ReadWritePaths
- UI: CrowdSec-Page mit StatusStrip + 5 Tabs (Decisions, Alerts, Bouncers,
  Machines, Collections), Sidebar-Eintrag, i18n EN+DE
- firewall: flush ruleset → flush table inet edgeguard (CrowdSec-nftables-Table
  bleibt bei Firewall-Render erhalten)
- cluster: Firewall-Reload nur bei echter IP-Änderung, nicht bei jedem
  periodischen Secondary-Heartbeat (verhindert nftables-Counter-Reset)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-06-01 20:25:48 +02:00
parent e999eb68c2
commit 1740cb7ae2
15 changed files with 1561 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
packaging/debian/edgeguard-api/DEBIAN/postinst
View File

@@ -151,6 +151,20 @@ edgeguard ALL=(root) NOPASSWD: /usr/bin/systemctl reload-or-restart keepalived.s
edgeguard ALL=(root) NOPASSWD: /bin/systemctl reload-or-restart keepalived.service
# VIP-Schwenk-Test: dediziertes Script mit interner Input-Validierung.
edgeguard ALL=(root) NOPASSWD: /usr/lib/edgeguard/vip-cmd.sh
# CrowdSec management
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli decisions list -o json
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli decisions add *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli decisions delete *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli alerts list *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli alerts delete *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli bouncers list -o json
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli bouncers delete *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli machines list -o json
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli machines delete *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli collections list -o json
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli collections install *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli collections remove *
edgeguard ALL=(root) NOPASSWD: /usr/bin/cscli version
SUDOERS
# ── Distro-Conf-Includes für die per-Service Renderer ─────────
@@ -703,6 +717,30 @@ END;
$$;
EOSQL
# ── CrowdSec IDS installation ─────────────────────────────────────────
# Install CrowdSec if not present. We use the official CrowdSec APT repo.
# Only done on initial install (not on upgrade) to avoid overwriting
# user configuration.
if [ "$1" = "configure" ] && [ -z "$2" ]; then
if ! command -v cscli >/dev/null 2>&1; then
echo "postinst: installing CrowdSec..."
# Add CrowdSec repo key
install -d -m 0755 /etc/apt/keyrings
curl -s https://packagecloud.io/crowdsec/crowdsec/gpgkey | \
gpg --dearmor -o /etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg 2>/dev/null || true
# Add repo (bookworm compat for Trixie)
echo "deb [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/debian/ bookworm main" \
> /etc/apt/sources.list.d/crowdsec.list
apt-get update -qq 2>/dev/null || true
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq crowdsec crowdsec-firewall-bouncer-nftables 2>/dev/null || true
# Install default collections
if command -v cscli >/dev/null 2>&1; then
cscli collections install crowdsecurity/linux crowdsecurity/haproxy 2>/dev/null || true
fi
fi
fi
# ── Render initial service configs ───────────────────────────
# Writes /etc/edgeguard/haproxy/haproxy.cfg + nftables.d/
# ruleset.nft from the (just-migrated, empty) PG state.