feat(security): opt-in local CrowdSec LAPI bouncer on the Docker engine

src/lib/ddos-guard.ts

@@ -8,6 +8,7 @@ import { resolveClientIp } from "@/lib/client-ip";
 import { isCloudflareProxied } from "@/lib/cloudflare";
 import { maybeAutoBlockCloudflare } from "@/lib/cloudflare-api";
 import { maybeAutoBlockCrowdsec } from "@/lib/crowdsec-api";
+import { checkCrowdsecLocalBlock } from "@/lib/crowdsec-local";
 import { reportCrowdsecSignal } from "@/lib/crowdsec-report";
 import {
 	bumpCrowdsecBreakdownStat,
@@ -84,6 +85,14 @@ export async function enforceDdosRateLimit(
 		}
 	}
 
+	const localBlock = await checkCrowdsecLocalBlock(ip);
+	if (localBlock.blocked) {
+		return {
+			outcome: "block",
+			retryAfterSeconds: Math.max(localBlock.retryAfterSeconds, 1),
+		};
+	}
+
 	const global = await rateLimit(
 		"antiddos:global:all",
 		config.global.limit,