apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: crowdsec
  namespace: prometheus
  labels:
    release: prometheus-stack
spec:
  groups:
    - name: crowdsec
      rules:
        - alert: CrowdsecFirewallBouncerStale
          expr: |
            absent(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"})
            or sum(rate(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"}[10m])) == 0
          for: 15m
          labels:
            severity: critical
          annotations:
            summary: "Firewall bouncer stopped pulling decisions"
            description: "No LAPI pulls from firewall-workstation for 15 minutes. L3 enforcement is decaying: existing bans expire, new ones never land. Check the systemd unit on the node."

        - alert: CrowdsecDecisionsSpike
          expr: |
            sum(cs_active_decisions) - sum(cs_active_decisions offset 30m) > 20
          for: 5m
          labels:
            severity: warning
          annotations:
            summary: "Spike in active CrowdSec decisions"
            description: "Active decisions grew by more than 20 in 30 minutes (current: {{ $value }}). Possible ban storm or self-ban - check cscli decisions list."

        - alert: CrowdsecLAPIDecisionErrors
          expr: |
            sum(rate(cs_lapi_decisions_ko_total[5m])) > 0
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "CrowdSec LAPI decision errors"
            description: "LAPI is failing decision lookups. Bouncers may be failing open. Check LAPI logs and DB health."