3 Commits

Include renames

Author	SHA1	Message	Date
openhands	3e1a3f92c8	feat(security): recovery alerts, gate-block sharing, rolling-window burst and admin breakdown for CrowdSec	2026-09-23 15:06:16 +02:00
openhands	301edd2c9a	feat(security): ops alerts, shared backoff, atomic quota and daily stats for CrowdSec ... Add an alerting/stats layer over the existing CrowdSec integration: - New crowdsec-alerts.ts: cooldown-gated ops alerts (Redis NX lock, TTL from HEALTH_ALERT_COOLDOWN_MIN) fanning out through the app's sendAlert service. Raised for daily quota exhaustion, block bursts (5-min window past CROWDSEC_ALERT_BLOCK_BURST), and signal-push failures. - New crowdsec-stats.ts: daily counters (lookups/blocks/reports/report_fail) in Redis with a 14-day reader for the admin panel. - Shared 403/429 backoff: the pause marker now lives in Redis (crowdsec:backoff-until) so every instance honours it, not just the process that hit the limit. - Atomic quota reservation: INCR-before-call with self-rollback on overshoot, so concurrent instances can never slip calls past the daily ceiling. - Admin anti-DDoS page gains a last-14-days activity table next to the quota bar.	2026-09-23 14:45:35 +02:00
openhands	5e4fc9ab59	feat(security): give back to CrowdSec and harden the CTI budget ... - Bound the in-process verdict cache (FIFO eviction at 2000 entries) so a flood of distinct bucket-tripping IPs cannot grow it without limit. - Record block metadata (reputation, score, behaviors, category, TTL) in antiddos:block:meta:{ip}, surfaced as the reason in the admin block list; unban now also clears the metadata and report locks. - Track daily CTI enrichment usage in Redis (crowdsec:usage:{date}); warn once at 80% and pause lookups until tomorrow at CROWDSEC_CTI_DAILY_QUOTA (default 10000, 0 = unlimited) so a via-spread DDoS cannot burn the plan. - Add opt-in signal push to the CrowdSec community (CAPI watcher): stable auto-generated 48-char machine_id/password pair persisted in Redis (or via env), one-time registration, cached JWT login, optional Console enrollment, and POST /v3/signals with a ban decision, deduped per IP. Never throws and reports last status to the admin panel with a verify action. - Admin page: quota usage bar, reporting status/verify channel, and CrowdSec block reasons in the active-blocks list.	2026-09-23 14:24:44 +02:00