feat(security): external IP blocklist sync for the local CrowdSec engine

README.md

@@ -827,6 +827,36 @@ bash cms security disable
 Stops the container and sets `CROWDSEC_LOCAL_ENABLED=false`. Volumes and the
 `.env` key are kept.
 
+### Step 5 — Load external IP blocklists (optional)
+
+The engine has no built-in lists, so provide your own via a one-shot sync
+(fetches the sources, replaces every previous `cscli-import` decision):
+
+```bash
+bash cms security blocklists
+```
+
+Defaults: Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
+Binary Defense, blocklist.de, Emerging Threats, BruteForceBlocker, abuse.ch
+Feodo/SSLBL/URLhaus, Botvrij, IPsum, Firehol ipsets and Tor exit nodes
+(26 sources). The largest commercial/crowdsourced lists (AbuseIPDB, MaxMind,
+Cisco Talos, AlienVault OTX) are not included because they require an account
+or API key; IPsum already aggregates ~30 additional feeds. No account is
+needed, but internet access is — only for fetching; detection and blocking
+remain local. Sync hourly as a cron job:
+
+```bash
+bash cms security blocklists-install-cron
+```
+
+Removal: `bash cms security blocklists-uninstall-cron`. Dry-run without
+touching LAPI: `bash cms security blocklists --dry-run`. Override the sources,
+duration, a combined cap or an allowlist in `.env`
+(`CROWDSEC_BLOCKLIST_SOURCES`, `CROWDSEC_BLOCKLIST_DURATION`,
+`CROWDSEC_BLOCKLIST_MAX_DECISIONS`, `CROWDSEC_BLOCKLIST_ALLOW`). Existing
+`cscli-import` decisions are replaced on every sync, so removed entries
+expire.
+
 ### Environment variables
 
 | Variable                     | Default                       | Purpose                              |