feat(security): give back to CrowdSec and harden the CTI budget

Browse Source

- Bound the in-process verdict cache (FIFO eviction at 2000 entries) so a
  flood of distinct bucket-tripping IPs cannot grow it without limit.
- Record block metadata (reputation, score, behaviors, category, TTL) in
  antiddos:block:meta:{ip}, surfaced as the reason in the admin block list;
  unban now also clears the metadata and report locks.
- Track daily CTI enrichment usage in Redis (crowdsec:usage:{date}); warn
  once at 80% and pause lookups until tomorrow at CROWDSEC_CTI_DAILY_QUOTA
  (default 10000, 0 = unlimited) so a via-spread DDoS cannot burn the plan.
- Add opt-in signal push to the CrowdSec community (CAPI watcher): stable
  auto-generated 48-char machine_id/password pair persisted in Redis (or via
  env), one-time registration, cached JWT login, optional Console enrollment,
  and POST /v3/signals with a ban decision, deduped per IP. Never throws and
  reports last status to the admin panel with a verify action.
- Admin page: quota usage bar, reporting status/verify channel, and CrowdSec
  block reasons in the active-blocks list.

...

This commit is contained in:

openhands committed 2026-09-23 14:24:44 +02:00

1 parent ee25545b7f

commit 5e4fc9ab59

8 files changed

+1323 -37

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/lib/crowdsec-api.test.ts

+106

File diff suppressed because it is too large. Load diff

src/lib/crowdsec-api.ts

+178 -7

File diff suppressed because it is too large. Load diff

src/lib/crowdsec-report.test.ts

+280

File diff suppressed because it is too large. Load diff

src/lib/crowdsec-report.ts

+541

File diff suppressed because it is too large. Load diff