B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

router: make CrowdSec opt-in (crowdsec.enable, default off)

Browse Source 
Not every site wants the ban engine (hub sync needs internet at
activation, and it is one more moving part on a small box). Gate
crowdsec.nix on a new `crowdsec.enable` option like `omada.enable`.

gw-cnx-1 keeps it on; the VM test drops its mkForce overrides.
This commit is contained in:
kurogeek
2026-09-21 07:20:17 +00:00
parent e1e18dd9f3
commit 596ac1f4bb
6 changed files with 51 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/clan/router/README.md
+5 -4
View File
@@ -3,10 +3,11 @@
Turns a machine with several NICs into a site gateway: PPPoE WAN (ISP
credentials via vars prompts), a VLAN-filtering bridge over the LAN ports with
one L3 interface per VLAN, Kea DHCP and Blocky DNS per VLAN, nftables
firewall/NAT, DHCPv6-PD, CrowdSec, an iperf3 server and a WAN speed-test
timer. Optional: a Wi-Fi access point on the router's own radios (hostapd),
the TP-Link Omada controller (podman) and an internal Caddy reverse proxy
with a real wildcard certificate (ACME DNS-01).
firewall/NAT, DHCPv6-PD, an iperf3 server and a WAN speed-test timer.
Optional: a Wi-Fi access point on the router's own radios (hostapd), CrowdSec
with the nftables bouncer (sshd log parsing), the TP-Link Omada controller
(podman) and an internal Caddy reverse proxy with a real wildcard certificate
(ACME DNS-01).
Addressing convention: a site owns `10.<siteId>.0.0/16`; VLAN `<id>` defaults
to `10.<siteId>.<id>.0/24`, router at `.1`, DHCP pool `.100-.199`. The `mgmt`