forust
0859479c0f
ci / lint-compose (push) Successful in 9s
ci / lint-actionlint (push) Successful in 4s
ci / lint-shellcheck (push) Successful in 7s
ci / lint-prettier (push) Successful in 12s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 9s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 5s
renovate-ci / validate-renovate (push) Successful in 7s
ci / build (push) Failing after 14m22s
Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.
42 lines
1.6 KiB
YAML
42 lines
1.6 KiB
YAML
apiVersion: monitoring.coreos.com/v1
|
|
kind: PrometheusRule
|
|
metadata:
|
|
name: crowdsec
|
|
namespace: prometheus
|
|
labels:
|
|
release: prometheus-stack
|
|
spec:
|
|
groups:
|
|
- name: crowdsec
|
|
rules:
|
|
- alert: CrowdsecFirewallBouncerStale
|
|
expr: |
|
|
absent(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"})
|
|
or sum(rate(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"}[10m])) == 0
|
|
for: 15m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "Firewall bouncer stopped pulling decisions"
|
|
description: "No LAPI pulls from firewall-workstation for 15 minutes. L3 enforcement is decaying: existing bans expire, new ones never land. Check the systemd unit on the node."
|
|
|
|
- alert: CrowdsecDecisionsSpike
|
|
expr: |
|
|
sum(cs_active_decisions) - sum(cs_active_decisions offset 30m) > 20
|
|
for: 5m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "Spike in active CrowdSec decisions"
|
|
description: "Active decisions grew by more than 20 in 30 minutes (current: {{ $value }}). Possible ban storm or self-ban - check cscli decisions list."
|
|
|
|
- alert: CrowdsecLAPIDecisionErrors
|
|
expr: |
|
|
sum(rate(cs_lapi_decisions_ko_total[5m])) > 0
|
|
for: 10m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "CrowdSec LAPI decision errors"
|
|
description: "LAPI is failing decision lookups. Bouncers may be failing open. Check LAPI logs and DB health."
|