feat(security): give back to CrowdSec and harden the CTI budget

- Bound the in-process verdict cache (FIFO eviction at 2000 entries) so a
  flood of distinct bucket-tripping IPs cannot grow it without limit.
- Record block metadata (reputation, score, behaviors, category, TTL) in
  antiddos:block:meta:{ip}, surfaced as the reason in the admin block list;
  unban now also clears the metadata and report locks.
- Track daily CTI enrichment usage in Redis (crowdsec:usage:{date}); warn
  once at 80% and pause lookups until tomorrow at CROWDSEC_CTI_DAILY_QUOTA
  (default 10000, 0 = unlimited) so a via-spread DDoS cannot burn the plan.
- Add opt-in signal push to the CrowdSec community (CAPI watcher): stable
  auto-generated 48-char machine_id/password pair persisted in Redis (or via
  env), one-time registration, cached JWT login, optional Console enrollment,
  and POST /v3/signals with a ban decision, deduped per IP. Never throws and
  reports last status to the admin panel with a verify action.
- Admin page: quota usage bar, reporting status/verify channel, and CrowdSec
  block reasons in the active-blocks list.

.env.example

@@ -89,6 +89,25 @@ CROWDSEC_BLOCK_SCORE=4
 CROWDSEC_BLOCK_TTL_SECONDS=86400
 # Endpoint — override only for tests/staging.
 CROWDSEC_CTI_BASE_URL=https://cti.api.crowdsec.net/v2
+# Daily enrichment-call ceiling (freemium plan ≈ 10k/day). Once today's
+# counter reaches it, reputation lookups pause until tomorrow so a spread
+# DDoS cannot silently burn the whole quota. 0 = unlimited.
+CROWDSEC_CTI_DAILY_QUOTA=10000
+
+# --- CROWDSEC SIGNAL PUSH (share our blocks back, optional) ---
+# Opt-in: pushes blocked IPs + behaviors to the CrowdSec Central API (CAPI) so
+# the community blocklist protects other members too. Set to "true" to enable.
+# Requires watcher credentials — either set both CROWDSEC_REPORT_MACHINE_ID
+# (48 chars, [A-Za-z0-9]) and CROWDSEC_REPORT_PASSWORD now, or leave them
+# unset and let the app generate a stable pair persisted in Redis automatically.
+CROWDSEC_REPORT_ENABLED=false
+CROWDSEC_REPORT_MACHINE_ID=
+CROWDSEC_REPORT_PASSWORD=
+# Optional: attachment key from https://app.crowdsec.net → Console settings —
+# links our watcher to your account so pushed signals show up there.
+CROWDSEC_REPORT_ENROLL_KEY=
+# Central API base — override only for tests/staging.
+CROWDSEC_CAPI_BASE_URL=https://api.crowdsec.net/v3
 
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges

src/actions/admin-antiddos.ts

@@ -19,6 +19,10 @@ import {
 	setLastCrowdsecVerify,
 	verifyCrowdsecConnection,
 } from "@/lib/crowdsec-api";
+import {
+	setLastCrowdsecReport,
+	verifyCrowdsecReporting,
+} from "@/lib/crowdsec-report";
 import { db, WebsiteSetting } from "@/lib/db";
 import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
@@ -223,6 +227,8 @@ export async function unbanAntiddosIp(formData: FormData): Promise<void> {
 		if (redis) {
 			await Promise.all([
 				redis.del(`antiddos:block:${ip}`),
+				redis.del(`antiddos:block:meta:${ip}`),
+				redis.del(`crowdsec:report:${ip}`),
 				redis.del(`antiddos:v:${ip}`),
 			]);
 		}
@@ -272,6 +278,19 @@ export async function verifyCrowdsecConfiguration(): Promise<void> {
 	revalidatePath("/admin/devops/antiddos");
 }
 
+/** Test the CrowdSec signal-push (CAPI watcher) channel. */
+export async function verifyCrowdsecReportingConfiguration(): Promise<void> {
+	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
+	const status = await verifyCrowdsecReporting();
+	await setLastCrowdsecReport(status);
+	logger.info("CrowdSec reporting configuration verified", {
+		staff: staff.username,
+		ok: status.ok,
+		message: status.message,
+	});
+	revalidatePath("/admin/devops/antiddos");
+}
+
 /** Test the configured Cloudflare API credentials against the zone. */
 export async function verifyCloudflareConfiguration(): Promise<void> {
 	const staff = await requirePermission(PERMS.SETTINGS_VIEW);

src/env.ts

@@ -177,6 +177,31 @@ const schema = z
 			.int()
 			.positive()
 			.default(86_400),
+		// Daily CTI enrichment quota guard (freemium plan ≈ 10k lookups/day).
+		// The gate stops consulting the API once the counter for today exceeds
+		// it, so a spread DDoS can never silently burn the whole quota; 0
+		// disables the guard.
+		CROWDSEC_CTI_DAILY_QUOTA: z.coerce.number().int().min(0).default(10_000),
+		// Share our own detections back into the CrowdSec community blocklist
+		// (signal push over the Central API). Opt-in: flipping this on publicly
+		// shares blocked IPs + behaviors, so it defaults to off.
+		CROWDSEC_REPORT_ENABLED: z
+			.string()
+			.optional()
+			.transform((value) => value === "true" || value === "1"),
+		// Central API (CAPI) base endpoint; overridden for tests/staging.
+		CROWDSEC_CAPI_BASE_URL: z
+			.string()
+			.url()
+			.default("https://api.crowdsec.net/v3"),
+		// Watcher credentials for signal push. When omitted, a stable pair is
+		// generated once and persisted in Redis (48-char alnum machine id,
+		// per the CAPI schema).
+		CROWDSEC_REPORT_MACHINE_ID: z.string().optional(),
+		CROWDSEC_REPORT_PASSWORD: z.string().optional(),
+		// Optional attachment key from the CrowdSec Console — links our
+		// watcher to your account so pushed signals show up there.
+		CROWDSEC_REPORT_ENROLL_KEY: z.string().optional(),
 	})
 	.superRefine((data, ctx) => {
 		if (data.NODE_ENV !== "production") return;