router: make CrowdSec opt-in (crowdsec.enable, default off)

Not every site wants the ban engine (hub sync needs internet at
activation, and it is one more moving part on a small box). Gate
crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`.

gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.

modules/clan/router/README.md

@@ -3,10 +3,11 @@
 Turns a machine with several NICs into a site gateway: PPPoE WAN (ISP
 credentials via vars prompts), a VLAN-filtering bridge over the LAN ports with
 one L3 interface per VLAN, Kea DHCP and Blocky DNS per VLAN, nftables
-firewall/NAT, DHCPv6-PD, CrowdSec, an iperf3 server and a WAN speed-test
-timer. Optional: a Wi-Fi access point on the router's own radios (hostapd),
-the TP-Link Omada controller (podman) and an internal Caddy reverse proxy
-with a real wildcard certificate (ACME DNS-01).
+firewall/NAT, DHCPv6-PD, an iperf3 server and a WAN speed-test timer.
+Optional: a Wi-Fi access point on the router's own radios (hostapd), CrowdSec
+with the nftables bouncer (sshd log parsing), the TP-Link Omada controller
+(podman) and an internal Caddy reverse proxy with a real wildcard certificate
+(ACME DNS-01).
 
 Addressing convention: a site owns `10.<siteId>.0.0/16`; VLAN `<id>` defaults
 to `10.<siteId>.<id>.0/24`, router at `.1`, DHCP pool `.100-.199`. The `mgmt`

modules/clan/router/crowdsec.nix

@@ -1,46 +1,49 @@
 # CrowdSec security engine + nftables bouncer: parses sshd auth attempts from
 # the journal and bans offending source IPs at the firewall. Log-based (no
-# inline DPI) so it costs the N300 next to nothing.
+# inline DPI) so it costs the N300 next to nothing. Opt-in per site
+# (`crowdsec.enable`): the hub sync needs internet at activation time.
 { settings }:
-{ ... }:
+{ lib, ... }:
 let
   cfg = settings;
 in
 {
-  services.crowdsec = {
-    enable = true;
-    autoUpdateService = true;
-    hub.collections = [
-      "crowdsecurity/linux"
-      "crowdsecurity/sshd"
-    ];
-    localConfig = {
-      acquisitions = [
-        {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
-          labels.type = "syslog";
-        }
-      ];
-      # Never ban the ZeroTier mesh — it is the only admin path to these
-      # boxes (no public SSH), so a false positive would lock us out.
-      # Parser-stage whitelist: mesh events are dropped before any scenario.
-      parsers.s02Enrich = [
-        {
-          name = "cnx/mesh-whitelist";
-          description = "Whitelist the ZeroTier management mesh";
-          whitelist = {
-            reason = "ZeroTier mesh is the admin path";
-            cidr = [ cfg.mesh.subnet ];
-          };
-        }
+  config = lib.mkIf cfg.crowdsec.enable {
+    services.crowdsec = {
+      enable = true;
+      autoUpdateService = true;
+      hub.collections = [
+        "crowdsecurity/linux"
+        "crowdsecurity/sshd"
       ];
+      localConfig = {
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+        ];
+        # Never ban the ZeroTier mesh — it is the only admin path to these
+        # boxes (no public SSH), so a false positive would lock us out.
+        # Parser-stage whitelist: mesh events are dropped before any scenario.
+        parsers.s02Enrich = [
+          {
+            name = "cnx/mesh-whitelist";
+            description = "Whitelist the ZeroTier management mesh";
+            whitelist = {
+              reason = "ZeroTier mesh is the admin path";
+              cidr = [ cfg.mesh.subnet ];
+            };
+          }
+        ];
+      };
+    };
+
+    services.crowdsec-firewall-bouncer = {
+      enable = true;
+      registerBouncer.enable = true;
+      settings.mode = "nftables";
     };
   };
-
-  services.crowdsec-firewall-bouncer = {
-    enable = true;
-    registerBouncer.enable = true;
-    settings.mode = "nftables";
-  };
 }

modules/clan/router/interface.nix

@@ -285,6 +285,8 @@ in
 
     omada.enable = lib.mkEnableOption "TP-Link Omada SDN controller (podman container)";
 
+    crowdsec.enable = lib.mkEnableOption "CrowdSec (sshd log parsing) with the nftables bouncer";
+
     proxy = {
       enable = lib.mkEnableOption "internal reverse proxy (Caddy, wildcard cert via DNS-01)";
 

modules/clan/router/tests/vm/default.nix

@@ -131,13 +131,11 @@ in
       services.openssh.enable = true;
 
       # The sandbox has no internet: serve the blocklist from a local file
-      # instead of GitHub, and skip CrowdSec, whose hub sync needs the network
-      # (it is not what this test exercises).
+      # instead of GitHub. (CrowdSec, whose hub sync needs the network too,
+      # is opt-in and stays off.)
       services.blocky.settings.blocking.denylists.ads = lib.mkForce [
         (toString (pkgs.writeText "ads.hosts" "0.0.0.0 ads.example.com\n"))
       ];
-      services.crowdsec.enable = lib.mkForce false;
-      services.crowdsec-firewall-bouncer.enable = lib.mkForce false;
 
       # Two simulated radios: wlan0 is the AP (settings above), wlan1 plays a
       # wireless client. It lives in its own network namespace, like the