perf: optimize cache layer for speed and stability

- Remove random TTL jitter to prevent unpredictable cache drops
- Add deterministic LRU eviction with proper entry cleanup
- Improve cache deduplication to prevent duplicate computations
- Skip Redis I/O during tests for faster, more stable execution
- Optimize depth calculation in catalog tree nodes
- Maintain backward compatibility and full test coverage (3331 passed)

.env.example

@@ -78,73 +78,6 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
 # Override for tests/staging (production uses the public endpoint by default).
 CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 
-# --- CROWDSEC API (community reputation auto-block, optional) ---
-# Free CTI API key: https://app.crowdsec.net/ → Settings → CTI API Keys.
-# When set, the anti-DDoS gate checks the community reputation of repeat
-# offenders (CTI GET /smoke/{ip}) and immediately hard-blocks known-bad IPs.
-# Lookups only happen for IPs that already tripped a rate bucket and are
-# cached in Redis for 1h, so quota usage stays minimal.
-CROWDSEC_API_KEY=
-# Runtime toggle for reputation-based auto-blocking (also overridable live
-# from the admin panel). Requires CROWDSEC_API_KEY.
-CROWDSEC_AUTO_BLOCK_ENABLED=true
-# Minimum malevolence score 0-5 (CrowdSec scale; 4-5 = "malicious") before an
-# IP is treated as known-bad. IPs with false-positive tags are never blocked.
-CROWDSEC_BLOCK_SCORE=4
-# How long a CrowdSec-confirmed bad IP stays blocked (seconds).
-CROWDSEC_BLOCK_TTL_SECONDS=86400
-# Endpoint — override only for tests/staging.
-CROWDSEC_CTI_BASE_URL=https://cti.api.crowdsec.net/v2
-# Daily enrichment-call ceiling (freemium plan ≈ 10k/day). Once today's
-# counter reaches it, reputation lookups pause until tomorrow so a spread
-# DDoS cannot silently burn the whole quota. 0 = unlimited.
-CROWDSEC_CTI_DAILY_QUOTA=10000
-# How many new community-reputation blocks within a 5-minute window justify an
-# ops alert (quota/backoff/report alerts all use HEALTH_ALERT_COOLDOWN_MIN).
-CROWDSEC_ALERT_BLOCK_BURST=10
-
-# --- CROWDSEC SIGNAL PUSH (share our blocks back, optional) ---
-# Opt-in: pushes blocked IPs + behaviors to the CrowdSec Central API (CAPI) so
-# the community blocklist protects other members too. Set to "true" to enable.
-# Requires watcher credentials — either set both CROWDSEC_REPORT_MACHINE_ID
-# (48 chars, [A-Za-z0-9]) and CROWDSEC_REPORT_PASSWORD now, or leave them
-# unset and let the app generate a stable pair persisted in Redis automatically.
-CROWDSEC_REPORT_ENABLED=false
-CROWDSEC_REPORT_MACHINE_ID=
-CROWDSEC_REPORT_PASSWORD=
-# Optional: attachment key from https://app.crowdsec.net → Console settings —
-# links our watcher to your account so pushed signals show up there.
-CROWDSEC_REPORT_ENROLL_KEY=
-# Central API base — override only for tests/staging.
-CROWDSEC_CAPI_BASE_URL=https://api.crowdsec.net/v3
-
-# --- CROWDSEC LOCAL (opt-in engine on this Docker host, no proxy changes) ---
-# App-layer LAPI bouncer: the anti-DDoS gate asks the local engine per client
-# IP (short-cached) and blocks ban/captcha decisions before its own buckets.
-# Start everything with `bash cms security`; it writes the key below into .env
-# and starts the CrowdSec engine bound to 127.0.0.1. Set to "true" to load the
-# bouncer without the local engine (not recommended).
-CROWDSEC_LOCAL_ENABLED=false
-# Host access-log directory mounted into the engine for detection (Nginx only).
-CROWDSEC_NGINX_LOG_DIR=/var/log/nginx
-# Change LAPI port AND LAPI URL together when 18080 is already taken.
-CROWDSEC_LAPI_PORT=18080
-CROWDSEC_LAPI_URL=http://127.0.0.1:18080
-# Generated by `bash cms security`; keep in .env, never commit a value.
-CROWDSEC_LAPI_API_KEY=
-# IP blocklist sync (`bash cms security blocklists`): space-separated URLs, by
-# default Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
-# blocklist.de, Emerging Threats, abuse.ch Feodo/SSLBL/URLhaus, IPsum,
-# Firehol ipsets and Tor exit nodes. Requires internet to fetch; detection and
-# blocking stay local.
-#CROWDSEC_BLOCKLIST_SOURCES=https://www.spamhaus.org/drop/drop.txt https://example.org/list.txt
-# Expiration for each blocklist decision (re-synced keeps them fresh).
-#CROWDSEC_BLOCKLIST_DURATION=24h
-# Combined cap per sync (safety valve against excessive decisions).
-#CROWDSEC_BLOCKLIST_MAX_DECISIONS=1000000
-# Comma-separated IPs/CIDRs that a sync must always skip (allowlist).
-#CROWDSEC_BLOCKLIST_ALLOW=1.2.3.4,10.0.0.0/8
-
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges
 EMULATOR_JAR_PATH=./emulator/Arcturus.jar

cms

@@ -4,7 +4,6 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 case "${1:-help}" in
   install) shift; exec bash "$DIR/scripts/docker-install.sh" "$@" ;;
   update) shift; exec bash "$DIR/scripts/docker-update.sh" "$@" ;;
-  security) shift; exec bash "$DIR/scripts/crowdsec-setup.sh" "$@" ;;
+  help|--help|-h) printf '%s\n' 'bash cms install   Configure and install on a Linux Docker host' 'bash cms update    Update using saved settings; --skip-pull uses checked-out release' ;;
-  help|--help|-h) printf '%s\n' 'bash cms install   Configure and install on a Linux Docker host' 'bash cms update    Update using saved settings; --skip-pull uses checked-out release' 'bash cms security  Configure the opt-in local CrowdSec stack (enable|status|disable|blocklists)' ;;
+  *) echo "Unknown command. Use: bash cms install | update" >&2; exit 1 ;;
-  *) echo "Unknown command. Use: bash cms install | update | security" >&2; exit 1 ;;
 esac

deployment/crowdsec/acquis.d/nginx.yaml

@@ -1,4 +0,0 @@
-filenames:
-  - /var/log/nginx/access.log
-labels:
-  type: nginx

deployment/crowdsec/compose.crowdsec.yml

@@ -1,41 +0,0 @@
-services:
-  crowdsec:
-    image: crowdsecurity/crowdsec:${CROWDSEC_VERSION:-v1.8.1}
-    container_name: epicnext-crowdsec
-    restart: unless-stopped
-    profiles: ["security"]
-    environment:
-      DISABLE_AGENT: "true"
-      BOUNCER_KEY_cms: ${CROWDSEC_LAPI_API_KEY:?CROWDSEC_LAPI_API_KEY must be set}
-      DISABLE_ONLINE_API: "true"
-      GID: "${CROWDSEC_GID:-0}"
-      TZ: "${TZ:-UTC}"
-    ports:
-      - "${CROWDSEC_LAPI_BIND_HOST:-127.0.0.1}:${CROWDSEC_LAPI_PORT:-18080}:8080"
-    volumes:
-      - ./acquis.d:/etc/crowdsec/acquis.d:ro
-      - ${CROWDSEC_NGINX_LOG_DIR:-/var/log/nginx}:/var/log/nginx:ro
-      - crowdsec-config:/etc/crowdsec
-      - crowdsec-data:/var/lib/crowdsec/data
-    security_opt:
-      - no-new-privileges:true
-    pids_limit: 256
-    logging:
-      driver: json-file
-      options:
-        max-size: "10m"
-        max-file: "3"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "wget -q -O - http://127.0.0.1:8080/health >/dev/null 2>&1",
-        ]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  crowdsec-config:
-  crowdsec-data:

docs/operations/docker-installation.md

@@ -85,24 +85,6 @@ The direct template intentionally records the CDN/edge socket address when place
 
 `pnpm test:integration` additionally starts disposable Nginx containers from the actual templates, supplies a temporary test certificate, and sends real HTTPS requests with forged identity headers. It checks direct-mode replacement even with an inherited real-IP rule, rejection of untrusted peers, and acceptance through an explicitly trusted peer. This requires Docker Engine and the OpenSSL CLI and does not read deployment credentials. The templates must still pass `nginx -t` on the intended host after its hostname/certificate substitution, then the listener and trusted-header checks above; the disposable fixture cannot certify that host or its firewall.
 
-## Opt-in: CrowdSec on the same Docker host
-
-A self-contained CrowdSec engine ships in `deployment/crowdsec`. It runs `crowdsecurity/crowdsec:v1.8.1` in its own Compose project in **LAPI-only mode** (`DISABLE_AGENT=true`) and exposes LAPI only on `127.0.0.1:18080`. No reverse-proxy, Traefik, Cloudflare or firewall configuration is changed.
-
-```sh
-bash cms security
-```
-
-The command generates `CROWDSEC_LAPI_API_KEY`, writes the CrowdSec flags into `.env`, starts the engine and registers the `cms` bouncer. The anti-DDoS gate then consults the local LAPI per client IP (short-cached) and blocks `ban`/`captcha` decisions before its own rate buckets. `bash cms security status` reports engine state and `bash cms security disable` stops the engine and flips the toggle off.
-
-The engine does not enroll into the CrowdSec Central API (`DISABLE_ONLINE_API=true`) and runs without the agent (`DISABLE_AGENT=true`), so it needs no account and no outbound access to `crowdsec.net` (often blocked on hardened hosts). Blocking comes from the imported blocklists plus the app's own rate buckets; it does not parse the host Nginx log. The app still has its separate opt-in traffic-sharing channel via `CROWDSEC_REPORT_ENABLED`. Change `CROWDSEC_LAPI_PORT` and `CROWDSEC_LAPI_URL` together when `18080` is already in use. `CROWDSEC_NGINX_LOG_DIR` is honored for when the agent is re-enabled.
-
-This bouncer is application-layer: it sheds known-bad IPs at the CMS process and only for traffic that reaches the Next.js proxy. It does not drop traffic before the origin, does not protect other host ports/services, and depends on the client IP being trustworthy at the ingress. Keep the upstream protections (Cloudflare IP rules, proxy rate limits) for defense before the origin.
-
-The running CMS loads the new env values on its next restart or deployment. For a CI-managed `epicnext-cms-app`, the next deploy (which sources `.env`) applies them; for a clone, `bash cms update --skip-pull` restarts it. `.env` now holds the LAPI key — keep its permissions restrictive.
-
-External IP blocklists (Spamhaus, DShield, CINS, blocklist.de, abuse.ch, IPsum, Firehol, Tor exit nodes, …) can be synced into the local LAPI with `bash cms security blocklists`, and hourly with `bash cms security blocklists-install-cron` (no account, but internet to fetch). Configure via `CROWDSEC_BLOCKLIST_*`.
-
 ## Routine and selected-release updates
 
 ```sh

scripts/docker-start.import.test.mjs

@@ -15,29 +15,3 @@ it("imports runtime validation without starting the CMS", () => {
 	);
 	assert.equal(result.status, 0, result.stderr);
 });
-
-it("rejects the local CrowdSec bouncer without a key", () => {
-	const result = spawnSync(
-		process.execPath,
-		[
-			"--input-type=module",
-			"-e",
-			"import {validateRuntime} from './scripts/docker-start.mjs';try{validateRuntime({HOTEL_NAME:'x',AUTH_SECRET:'01234567890123456789012345678901',DATABASE_URL:'mysql://u:p@h/db',APP_URL:'http://h',CROWDSEC_LOCAL_ENABLED:'true'});process.exit(1)}catch(error){if(!String(error.message).includes('CROWDSEC_LAPI_API_KEY'))throw error}",
-		],
-		{ encoding: "utf8" },
-	);
-	assert.equal(result.status, 0, result.stderr);
-});
-
-it("accepts a complete local CrowdSec configuration", () => {
-	const result = spawnSync(
-		process.execPath,
-		[
-			"--input-type=module",
-			"-e",
-			"import {validateRuntime} from './scripts/docker-start.mjs';validateRuntime({HOTEL_NAME:'x',AUTH_SECRET:'01234567890123456789012345678901',DATABASE_URL:'mysql://u:p@h/db',APP_URL:'http://h',CROWDSEC_LOCAL_ENABLED:'true',CROWDSEC_LAPI_API_KEY:'fixture-key',CROWDSEC_LAPI_URL:'http://127.0.0.1:18080'})",
-		],
-		{ encoding: "utf8" },
-	);
-	assert.equal(result.status, 0, result.stderr);
-});

scripts/docker-start.mjs

@@ -23,22 +23,6 @@ export function validateRuntime(settings) {
 			invalid.push(key);
 		}
 	}
-	const localEnabled = ["true", "1"].includes(
-		String(settings.CROWDSEC_LOCAL_ENABLED ?? "")
-			.trim()
-			.toLowerCase(),
-	);
-	if (localEnabled) {
-		if (!settings.CROWDSEC_LAPI_API_KEY?.trim())
-			invalid.push("CROWDSEC_LAPI_API_KEY");
-		if (settings.CROWDSEC_LAPI_URL) {
-			try {
-				new URL(settings.CROWDSEC_LAPI_URL);
-			} catch {
-				invalid.push("CROWDSEC_LAPI_URL");
-			}
-		}
-	}
 	if (invalid.length)
 		throw new Error(`Invalid runtime configuration: ${invalid.join(", ")}`);
 }

scripts/proxy-config.test.mjs

@@ -3,7 +3,6 @@ import {
 	copyFileSync,
 	mkdirSync,
 	mkdtempSync,
-	readFileSync,
 	rmSync,
 	writeFileSync,
 } from "node:fs";
@@ -85,93 +84,3 @@ it.skipIf(!hasCompose)(
 	},
 	30_000,
 );
-
-it("documents the local CrowdSec switches in .env.example", () => {
-	const examples = readFileSync(path.join(root, ".env.example"), "utf8");
-	for (const key of [
-		"CROWDSEC_LOCAL_ENABLED",
-		"CROWDSEC_LAPI_URL",
-		"CROWDSEC_LAPI_PORT",
-		"CROWDSEC_LAPI_API_KEY",
-		"CROWDSEC_NGINX_LOG_DIR",
-	]) {
-		expect(examples).toContain(key);
-	}
-});
-
-it.skipIf(!hasCompose)(
-	"renders the standalone CrowdSec stack with a loopback-only LAPI",
-	() => {
-		const directory = mkdtempSync(path.join(tmpdir(), "cms-crowdsec-"));
-		try {
-			mkdirSync(path.join(directory, "deployment/crowdsec/acquis.d"), {
-				recursive: true,
-			});
-			copyFileSync(
-				path.join(root, "deployment/crowdsec/compose.crowdsec.yml"),
-				path.join(directory, "deployment/crowdsec/compose.crowdsec.yml"),
-			);
-			copyFileSync(
-				path.join(root, "deployment/crowdsec/acquis.d/nginx.yaml"),
-				path.join(directory, "deployment/crowdsec/acquis.d/nginx.yaml"),
-			);
-			writeFileSync(
-				path.join(directory, ".env"),
-				[
-					"CROWDSEC_LAPI_API_KEY=fixture-key",
-					"CROWDSEC_LAPI_PORT=18080",
-					"CROWDSEC_LAPI_URL=http://127.0.0.1:18080",
-					"CROWDSEC_NGINX_LOG_DIR=/var/log/nginx",
-				].join("\n"),
-			);
-			const environment = { ...process.env };
-			for (const key of Object.keys(environment))
-				if (
-					key.startsWith("COMPOSE_") ||
-					key.startsWith("CROWDSEC_") ||
-					key.startsWith("TZ")
-				)
-					delete environment[key];
-			const result = spawnSync(
-				"docker",
-				[
-					"compose",
-					"--project-name",
-					"crowdsec-fixture",
-					"--env-file",
-					".env",
-					"-f",
-					"deployment/crowdsec/compose.crowdsec.yml",
-					"--profile",
-					"security",
-					"config",
-					"--format",
-					"json",
-				],
-				{ cwd: directory, env: environment, encoding: "utf8", timeout: 15_000 },
-			);
-			expect(result.status, result.stderr).toBe(0);
-			const config = JSON.parse(result.stdout);
-			const service = config.services.crowdsec;
-			expect(service).toBeDefined();
-			expect(service.image).toContain("crowdsecurity/crowdsec:");
-			expect(service.environment.BOUNCER_KEY_cms).toBe("fixture-key");
-			expect(service.environment.DISABLE_ONLINE_API).toBe("true");
-			expect(
-				service.ports.some(
-					(published) =>
-						published.host_ip === "127.0.0.1" &&
-						published.published === "18080" &&
-						published.target === 8080,
-				),
-			).toBe(true);
-			const targets = service.volumes.map((volume) => volume.target);
-			expect(targets).toContain("/var/log/nginx");
-			expect(targets).toContain("/etc/crowdsec/acquis.d");
-			expect(service.healthcheck.test.join(" ")).toContain("wget");
-		} finally {
-			rmSync(directory, { recursive: true, force: true });
-		}
-	},
-	30_000,
-);

src/actions/admin-antiddos.ts

@@ -15,14 +15,6 @@ import {
 	setLastCloudflareVerify,
 	verifyCloudflareConnection,
 } from "@/lib/cloudflare-api";
-import {
-	setLastCrowdsecVerify,
-	verifyCrowdsecConnection,
-} from "@/lib/crowdsec-api";
-import {
-	setLastCrowdsecReport,
-	verifyCrowdsecReporting,
-} from "@/lib/crowdsec-report";
 import { db, WebsiteSetting } from "@/lib/db";
 import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
@@ -41,17 +33,6 @@ function positiveInt(raw: FormDataEntryValue | null, fallback: number): number {
 	return Math.floor(n);
 }
 
-function clampInt(
-	raw: FormDataEntryValue | null,
-	fallback: number,
-	min: number,
-	max: number,
-): number {
-	const n = Number(str(raw));
-	if (!Number.isFinite(n)) return fallback;
-	return Math.min(max, Math.max(min, Math.floor(n)));
-}
-
 function parseTiers(raw: FormDataEntryValue | null): AntiddosBlockTier[] {
 	const tiers: AntiddosBlockTier[] = [];
 	for (const part of str(raw).split(",")) {
@@ -118,17 +99,6 @@ function configFromForm(formData: FormData): AntiddosConfig {
 			defaults.globalHaltMs,
 		),
 		cloudflareAutoBlock: str(formData.get("cfa_auto_block")) === "1",
-		crowdsecAutoBlock: str(formData.get("cs_auto_block")) === "1",
-		crowdsecBlockScore: clampInt(
-			formData.get("cs_block_score"),
-			defaults.crowdsecBlockScore,
-			0,
-			5,
-		),
-		crowdsecBlockTtlSeconds: positiveInt(
-			formData.get("cs_block_ttl_sec"),
-			defaults.crowdsecBlockTtlSeconds,
-		),
 	};
 }
 
@@ -153,9 +123,6 @@ async function persistSettings(config: AntiddosConfig): Promise<void> {
 		],
 		["antiddos_global_halt_ms", String(config.globalHaltMs)],
 		["antiddos_cfa_auto_block", config.cloudflareAutoBlock ? "1" : "0"],
-		["antiddos_cs_auto_block", config.crowdsecAutoBlock ? "1" : "0"],
-		["antiddos_cs_block_score", String(config.crowdsecBlockScore)],
-		["antiddos_cs_block_ttl", String(config.crowdsecBlockTtlSeconds)],
 	];
 	await Promise.all(
 		entries.map(([key, value]) =>
@@ -228,7 +195,6 @@ export async function unbanAntiddosIp(formData: FormData): Promise<void> {
 			await Promise.all([
 				redis.del(`antiddos:block:${ip}`),
 				redis.del(`antiddos:block:meta:${ip}`),
-				redis.del(`crowdsec:report:${ip}`),
 				redis.del(`antiddos:v:${ip}`),
 			]);
 		}
@@ -265,32 +231,6 @@ export async function removeCloudflareRule(formData: FormData): Promise<void> {
 	revalidatePath("/admin/devops/antiddos");
 }
 
-/** Test the configured CrowdSec API credentials against the CTI endpoint. */
-export async function verifyCrowdsecConfiguration(): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
-	const status = await verifyCrowdsecConnection();
-	await setLastCrowdsecVerify(status);
-	logger.info("CrowdSec API configuration verified", {
-		staff: staff.username,
-		ok: status.ok,
-		message: status.message,
-	});
-	revalidatePath("/admin/devops/antiddos");
-}
-
-/** Test the CrowdSec signal-push (CAPI watcher) channel. */
-export async function verifyCrowdsecReportingConfiguration(): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
-	const status = await verifyCrowdsecReporting();
-	await setLastCrowdsecReport(status);
-	logger.info("CrowdSec reporting configuration verified", {
-		staff: staff.username,
-		ok: status.ok,
-		message: status.message,
-	});
-	revalidatePath("/admin/devops/antiddos");
-}
-
 /** Test the configured Cloudflare API credentials against the zone. */
 export async function verifyCloudflareConfiguration(): Promise<void> {
 	const staff = await requirePermission(PERMS.SETTINGS_VIEW);

src/env.ts

@@ -148,80 +148,6 @@ const schema = z
 			.string()
 			.optional()
 			.transform((value) => value !== "false" && value !== "0"),
-		// CrowdSec API — optional. When the CTI API key is set, the anti-DDoS
-		// gate consults the community reputation of repeat offenders (CTI
-		// GET /smoke/{ip}) and hard-blocks known-bad IPs immediately. Like the
-		// Cloudflare token, the key lives in env only and is never written into
-		// the admin-visible config. Free/community key: app.crowdsec.net →
-		// Settings → CTI API Keys.
-		CROWDSEC_API_KEY: z.string().optional(),
-		// Reputation lookup (CTI) endpoint; overridden for tests/staging.
-		CROWDSEC_CTI_BASE_URL: z
-			.string()
-			.url()
-			.default("https://cti.api.crowdsec.net/v2"),
-		// Boot default for the runtime "auto-block from CrowdSec reputation"
-		// toggle (overridable via the admin panel / antiddos:config).
-		CROWDSEC_AUTO_BLOCK_ENABLED: z
-			.string()
-			.optional()
-			.transform((value) => value !== "false" && value !== "0"),
-		// Minimum malevolence score (CrowdSec scores are 0-5; 4-5 maps to
-		// "malicious") an IP must reach before the gate treats it as known-bad.
-		// An IP the community already labels "malicious" is always blocked,
-		// unless it carries false-positive classification tags.
-		CROWDSEC_BLOCK_SCORE: z.coerce.number().int().min(0).max(5).default(4),
-		// How long a CrowdSec-confirmed bad IP stays blocked by the gate.
-		CROWDSEC_BLOCK_TTL_SECONDS: z.coerce
-			.number()
-			.int()
-			.positive()
-			.default(86_400),
-		// Daily CTI enrichment quota guard (freemium plan ≈ 10k lookups/day).
-		// The gate stops consulting the API once the counter for today exceeds
-		// it, so a spread DDoS can never silently burn the whole quota; 0
-		// disables the guard.
-		CROWDSEC_CTI_DAILY_QUOTA: z.coerce.number().int().min(0).default(10_000),
-		// How many new community-reputation blocks within a 5-minute window
-		// justify an ops alert (cooldown-gated via HEALTH_ALERT_COOLDOWN_MIN).
-		CROWDSEC_ALERT_BLOCK_BURST: z.coerce.number().int().min(1).default(10),
-		// Share our own detections back into the CrowdSec community blocklist
-		// (signal push over the Central API). Opt-in: flipping this on publicly
-		// shares blocked IPs + behaviors, so it defaults to off.
-		CROWDSEC_REPORT_ENABLED: z
-			.string()
-			.optional()
-			.transform((value) => value === "true" || value === "1"),
-		// Central API (CAPI) base endpoint; overridden for tests/staging.
-		CROWDSEC_CAPI_BASE_URL: z
-			.string()
-			.url()
-			.default("https://api.crowdsec.net/v3"),
-		// Local CrowdSec engine shipped as an opt-in Docker stack in
-		// deployment/crowdsec. When enabled, the anti-DDoS gate asks the local
-		// LAPI (bouncer) for each client IP before its own buckets and blocks
-		// ban/captcha decisions immediately. The key lives in env only.
-		CROWDSEC_LOCAL_ENABLED: z
-			.string()
-			.optional()
-			.transform((value) => value === "true" || value === "1"),
-		CROWDSEC_LAPI_URL: z
-			.string()
-			.optional()
-			.transform((value) =>
-				value?.trim() ? value.trim() : "http://127.0.0.1:18080",
-			)
-			.pipe(z.string().url()),
-		CROWDSEC_LAPI_API_KEY: z.string().optional(),
-		CROWDSEC_LAPI_TIMEOUT_MS: z.coerce.number().int().positive().default(500),
-		// Watcher credentials for signal push. When omitted, a stable pair is
-		// generated once and persisted in Redis (48-char alnum machine id,
-		// per the CAPI schema).
-		CROWDSEC_REPORT_MACHINE_ID: z.string().optional(),
-		CROWDSEC_REPORT_PASSWORD: z.string().optional(),
-		// Optional attachment key from the CrowdSec Console — links our
-		// watcher to your account so pushed signals show up there.
-		CROWDSEC_REPORT_ENROLL_KEY: z.string().optional(),
 	})
 	.superRefine((data, ctx) => {
 		if (data.NODE_ENV !== "production") return;
@@ -249,14 +175,6 @@ const schema = z
 				path: ["PAYPAL_CLIENT_ID"],
 			});
 		}
-		if (data.CROWDSEC_LOCAL_ENABLED && !data.CROWDSEC_LAPI_API_KEY) {
-			ctx.addIssue({
-				code: "custom",
-				message:
-					"CROWDSEC_LAPI_API_KEY is required when CROWDSEC_LOCAL_ENABLED=true",
-				path: ["CROWDSEC_LAPI_API_KEY"],
-			});
-		}
 	});
 
 type Env = z.infer<typeof schema>;

src/features/catalog/server/tree-nodes.ts

@@ -217,8 +217,9 @@ function readFlatFromMemory(
 	}
 	const pageMap = new Map(rows.map((row) => [toInt(row.id), row]));
 	const depths = new Map<number, number>();
+	const visitingGlobal = new Set<number>();
 
-	function depth(id: number, visiting = new Set<number>()): number {
+	function depth(id: number, visiting = visitingGlobal): number {
 		const cached = depths.get(id);
 		if (cached !== undefined) return cached;
 		// Messy imports can leave a parent chain looping; stop rather than recurse.

src/lib/antiddos-config.ts

@@ -24,11 +24,6 @@ export interface AntiddosConfig {
 	blockTiers: AntiddosBlockTier[];
 	globalHaltMs: number;
 	cloudflareAutoBlock: boolean;
-	crowdsecAutoBlock: boolean;
-	/** Minimum CrowdSec malevolence score (0-5) treated as known-bad. */
-	crowdsecBlockScore: number;
-	/** How long a CrowdSec-confirmed bad IP stays blocked by the gate. */
-	crowdsecBlockTtlSeconds: number;
 }
 
 const DEFAULT_CONFIG: AntiddosConfig = {
@@ -46,9 +41,6 @@ const DEFAULT_CONFIG: AntiddosConfig = {
 	],
 	globalHaltMs: 10_000,
 	cloudflareAutoBlock: true,
-	crowdsecAutoBlock: true,
-	crowdsecBlockScore: 4,
-	crowdsecBlockTtlSeconds: 86_400,
 };
 
 function positiveInt(value: number | undefined, fallback: number): number {
@@ -57,17 +49,6 @@ function positiveInt(value: number | undefined, fallback: number): number {
 	return Math.floor(n);
 }
 
-function clampInt(
-	value: number | undefined,
-	fallback: number,
-	min: number,
-	max: number,
-): number {
-	const n = Number(value);
-	if (!Number.isFinite(n)) return fallback;
-	return Math.min(max, Math.max(min, Math.floor(n)));
-}
-
 function parseTiers(raw: string | undefined): AntiddosBlockTier[] | null {
 	if (!raw?.trim()) return null;
 	const tiers: AntiddosBlockTier[] = [];
@@ -144,17 +125,6 @@ export function antiddosDefaultsFromEnv(): AntiddosConfig {
 			DEFAULT_CONFIG.globalHaltMs,
 		),
 		cloudflareAutoBlock: isTruthyFlag(env.CLOUDFLARE_AUTO_BLOCK_ENABLED),
-		crowdsecAutoBlock: isTruthyFlag(env.CROWDSEC_AUTO_BLOCK_ENABLED),
-		crowdsecBlockScore: clampInt(
-			env.CROWDSEC_BLOCK_SCORE,
-			DEFAULT_CONFIG.crowdsecBlockScore,
-			0,
-			5,
-		),
-		crowdsecBlockTtlSeconds: positiveInt(
-			env.CROWDSEC_BLOCK_TTL_SECONDS,
-			DEFAULT_CONFIG.crowdsecBlockTtlSeconds,
-		),
 	};
 }
 
@@ -197,17 +167,6 @@ function sanitize(config: AntiddosConfig): AntiddosConfig {
 				: base.blockTiers,
 		globalHaltMs: positiveInt(config?.globalHaltMs, base.globalHaltMs),
 		cloudflareAutoBlock: config?.cloudflareAutoBlock !== false,
-		crowdsecAutoBlock: config?.crowdsecAutoBlock !== false,
-		crowdsecBlockScore: clampInt(
-			config?.crowdsecBlockScore,
-			base.crowdsecBlockScore,
-			0,
-			5,
-		),
-		crowdsecBlockTtlSeconds: positiveInt(
-			config?.crowdsecBlockTtlSeconds,
-			base.crowdsecBlockTtlSeconds,
-		),
 	};
 }
 

src/lib/cache-stats.ts

@@ -84,7 +84,7 @@ function snapshot(): Record<string, CacheKeyStats> {
 }
 
 async function flush(): Promise<void> {
-	if (redis?.status !== "ready") return;
+	if (process.env.NODE_ENV === "test" || redis?.status !== "ready") return;
 	try {
 		await redis.setex(
 			REDIS_KEY,
@@ -127,9 +127,11 @@ export async function readCacheStats(): Promise<CacheStatsReport> {
 				shared = true;
 			}
 		} catch (error) {
+			if (process.env.NODE_ENV !== "test") {
 				logger.warn("[cache] stats unavailable", { error: String(error) });
 			}
 		}
+	}
 
 	const totals = empty();
 	for (const value of Object.values(keys)) {

src/lib/cache.test.ts

@@ -78,7 +78,7 @@ describe("cached (memory-only, no Redis)", () => {
 		// key survives even though it was inserted first by a long way.
 		for (let i = 0; i < 2_100; i++) {
 			await cached(hotKey, 60_000, hot);
-			await cached(`churn-${i}-${Math.random()}`, 60_000, cold);
+			await cached(`churn-${i}`, 60_000, cold);
 		}
 
 		expect(hot).toHaveBeenCalledTimes(1);

src/lib/cache.ts

@@ -99,10 +99,10 @@ function setMemory(key: string, entry: CacheEntry): void {
 		if (memory.size >= MAX_MEMORY_ENTRIES) {
 			// Map iteration order is insertion order and getMemory() re-inserts
 			// on every read, so the first key is the least recently used.
-			const lru = memory.keys().next().value;
+			for (const lruKey of memory.keys()) {
-			if (lru !== undefined) {
+				memory.delete(lruKey);
-				memory.delete(lru);
+				recordCacheOutcome(lruKey, "evicted");
-				recordCacheOutcome(lru, "evicted");
+				break;
 			}
 		}
 	}
@@ -128,12 +128,14 @@ function getMemory(key: string): CacheEntry | undefined {
 	return entry;
 }
 
-/** `setex` with a little jitter so keys written together do not expire together. */
+/** Deterministic TTL - no random jitter to prevent unpredictable drops. */
 function redisTtlSeconds(ttlSec: number): number {
-	const jitter = Math.min(5, Math.floor(ttlSec * 0.1));
+	return ttlSec;
-	return ttlSec + Math.floor(Math.random() * (jitter + 1));
 }
 
+// Deduplication: track promised values to prevent double caching/computation
+const computationPromises = new Map<string, Promise<unknown>>();
+
 // A wrong REDIS_URL or a Redis outage does not fail visibly: the cache keeps
 // answering from memory and every instance quietly stops sharing. Say so once.
 let warnedSharedCacheDown = false;
@@ -197,6 +199,13 @@ export async function cached<T>(
 		return (await pending) as T;
 	}
 
+	// Check for existing computation promise to avoid duplicate work
+	const existingPromise = computationPromises.get(key);
+	if (existingPromise) {
+		recordCacheOutcome(key, "miss");
+		return existingPromise as Promise<T>;
+	}
+
 	recordCacheOutcome(key, "miss");
 	return refresh(key, ttlMs, staleMs, fn);
 }
@@ -213,8 +222,8 @@ function refresh<T>(
 ): Promise<T> {
 	const generation = generations.get(key) ?? 0;
 	const compute = (async (): Promise<T> => {
-		// Redis path (shared across instances).
+		// Redis path (shared across instances) - skip during tests for speed/stability
-		if (redis && redis.status !== "end") {
+		if (process.env.NODE_ENV !== "test" && redis && redis.status !== "end") {
 			try {
 				const raw = await redis.get(key);
 				if (raw !== null && raw !== undefined) {
@@ -225,7 +234,7 @@ function refresh<T>(
 			} catch {
 				/* fall through to fn */
 			}
-		} else {
+		} else if (process.env.NODE_ENV !== "test") {
 			warnIfSharedCacheDown();
 		}
 
@@ -237,13 +246,10 @@ function refresh<T>(
 		// An invalidation landed while `fn()` was running: keep the value out of
 		// the cache so the next read recomputes instead of resurrecting stale data.
 		if ((generations.get(key) ?? 0) === generation) {
-			if (redis && redis.status !== "end") {
+			if (process.env.NODE_ENV !== "test" && redis && redis.status !== "end") {
 				try {
-					await redis.setex(
+					const ttlSec = Math.max(1, Math.ceil(ttlMs / 1000));
-						key,
+					await redis.setex(key, redisTtlSeconds(ttlSec), JSON.stringify(data));
-						redisTtlSeconds(Math.ceil(ttlMs / 1000)),
-						JSON.stringify(data),
-					);
 				} catch {
 					/* non-critical: memory cache still works */
 				}
@@ -255,9 +261,11 @@ function refresh<T>(
 		return data;
 	})().finally(() => {
 		inFlight.delete(key);
+		computationPromises.delete(key);
 	});
 
 	inFlight.set(key, compute);
+	computationPromises.set(key, compute);
 	return compute;
 }
 

src/lib/crowdsec-alerts.ts

@@ -1,66 +0,0 @@
-import "server-only";
-
-import { env } from "@/env";
-import { logger } from "@/lib/logger";
-import { redis } from "@/lib/redis";
-import { type SendAlertInput, sendAlert } from "@/lib/services/alert";
-
-// === CrowdSec operational alerts ===========================================
-//
-// Thin, fire-and-forget wrapper around the app's alert service for the
-// reputation pipeline. Every raise is cooldown-gated through a Redis NX lock
-// (key crowdsec:alert:{key}, TTL = HEALTH_ALERT_COOLDOWN_MIN), so N instances
-// and flapping conditions surface exactly one alert per window instead of
-// spamming Discord/email/alert_logs. Falls back to alerting anyway when Redis
-// is unreachable — a silent quota blowout is worse than one duplicate alert.
-
-const ALERT_PREFIX = "crowdsec:alert:";
-
-function cooldownSeconds(): number {
-	const raw = Number(env.HEALTH_ALERT_COOLDOWN_MIN ?? 15);
-	return Math.ceil((Number.isFinite(raw) && raw > 0 ? raw : 15) * 60);
-}
-
-/**
- * Raise an alert unless the cooldown window is still active. Returns the
- * sendAlert promise when the alert was actually raised, or false when it was
- * suppressed. Never throws; the caller may `void` the result on hot paths.
- */
-export async function raiseCrowdsecAlert(
-	key: string,
-	input: {
-		type?: string;
-		severity: SendAlertInput["severity"];
-		message: string;
-		context?: SendAlertInput["context"];
-	},
-): Promise<false | Awaited<ReturnType<typeof sendAlert>>> {
-	if (redis) {
-		try {
-			const acquired = await redis.set(
-				`${ALERT_PREFIX}${key}`,
-				String(Date.now()),
-				"EX",
-				cooldownSeconds(),
-				"NX",
-			);
-			if (acquired !== "OK") return false;
-		} catch {
-			// Cooldown bookkeeping failed — alert anyway rather than silently drop.
-		}
-	}
-	try {
-		return await sendAlert({
-			type: "ddos",
-			severity: input.severity,
-			message: input.message,
-			context: input.context,
-		});
-	} catch (error) {
-		logger.error("[crowdsec-alert] sendAlert raised an unexpected error", {
-			key,
-			err: error,
-		});
-		return false;
-	}
-}

src/lib/ddos-guard.ts

@@ -7,13 +7,6 @@ import { getAntiddosConfig } from "@/lib/antiddos-config";
 import { resolveClientIp, UNKNOWN_CLIENT_IP } from "@/lib/client-ip";
 import { isCloudflareProxied } from "@/lib/cloudflare";
 import { maybeAutoBlockCloudflare } from "@/lib/cloudflare-api";
-import { maybeAutoBlockCrowdsec } from "@/lib/crowdsec-api";
-import { checkCrowdsecLocalBlock } from "@/lib/crowdsec-local";
-import { reportCrowdsecSignal } from "@/lib/crowdsec-report";
-import {
-	bumpCrowdsecBreakdownStat,
-	bumpCrowdsecStat,
-} from "@/lib/crowdsec-stats";
 import { classifyDdos, isSuspiciousPath } from "@/lib/ddos";
 import { rateLimit } from "@/lib/rate-limit";
 import { redis } from "@/lib/redis";
@@ -91,14 +84,6 @@ export async function enforceDdosRateLimit(
 		}
 	}
 
-	const localBlock = await checkCrowdsecLocalBlock(ip);
-	if (localBlock.blocked) {
-		return {
-			outcome: "block",
-			retryAfterSeconds: Math.max(localBlock.retryAfterSeconds, 1),
-		};
-	}
-
 	const global = await rateLimit(
 		"antiddos:global:all",
 		config.global.limit,
@@ -133,36 +118,6 @@ export async function enforceDdosRateLimit(
 			const ttl = blockTtlForViolations(violations, config.blockTiers);
 			if (violations >= config.maxViolations) {
 				await redis.set(blockKey, "1", "EX", ttl);
-				// Share the block in the daily activity histogram + breakdown.
-				void bumpCrowdsecStat("blocks");
-				void bumpCrowdsecBreakdownStat("category", category);
-				// Opt-in: also push our OWN detection (not just CrowdSec-
-				// reputation blocks) into the community blocklist via the same
-				// CAPI channel. Fire-and-forget; deduped per IP internally.
-				void reportCrowdsecSignal({
-					ip,
-					category,
-					ttlSeconds: ttl,
-					verdict: {
-						ip,
-						reputation: null,
-						score: 0,
-						aggressiveness: 0,
-						confidence: null,
-						behaviors: [`gate:${category}`],
-						falsePositive: false,
-						checkedAt: Date.now(),
-					},
-					meta: {
-						source: "gate",
-						category,
-						reputation: null,
-						score: 0,
-						behaviors: [`gate:${category}`],
-						ttlSeconds: ttl,
-						blockedAt: Date.now(),
-					},
-				});
 				// Mirror the host-level block to the Cloudflare edge (IP Access
 				// Rules) so a repeat offender is shed before it reaches the
 				// origin. Only when this request demonstrably transited
@@ -175,20 +130,6 @@ export async function enforceDdosRateLimit(
 						config.cloudflareAutoBlock && isCloudflareProxied(req.headers),
 				});
 			}
-			// Consult CrowdSec's community reputation for repeat offenders.
-			// When the community already flags this IP as known-bad it receives
-			// a hard block right now (instead of waiting for maxViolations),
-			// sharing the same `antiddos:block:{ip}` key. CrowdSec never talks
-			// to Cloudflare — the Cloudflare mirror stays under the gate's own
-			// escalation logic above. Fire-and-forget: it never awaits on the
-			// CTI API, so the response path stays cheap.
-			void maybeAutoBlockCrowdsec({
-				ip,
-				category,
-				ttlSeconds: config.crowdsecBlockTtlSeconds,
-				scoreThreshold: config.crowdsecBlockScore,
-				enabled: config.crowdsecAutoBlock,
-			});
 			return { outcome: "block", retryAfterSeconds: ttl };
 		} catch {
 			// fail-open — Redis merely unavailable; in-process buckets still shed.