Repository navigation
add safe dashboard activation for crs observation - #75
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Operators currently need a host command to enable CRS observation. This adds Enable CRS observation in CrowdSec → WAF, with confirmation, progress, automatic status recovery, and explicit failure/recovery states. Installer v1.66 installs a single-purpose Unix-socket helper through an ordinary update; activation requires an installer-managed stack with AppSec already enabled and its default acquisition list.
The admin-only API audits intent, rate-limits requests, and sends only fixed verbs. The root helper executes the shared observation policy from protected host tooling, locks against maintenance, snapshots the private configuration, checks LAPI health and the private AppSec listener, and restores failures. It exposes no Docker socket, arbitrary commands, paths, uploaded policies, or protection-disable operation. CrowdSec restarts briefly; fail-closed enforcement can temporarily deny traffic and dashboard API requests, which the confirmation and operations guide explain. The installer adds the read-only socket mount, boot ordering, helper rollback, and uninstall cleanup.
Validation: 224 backend tests and schema validation; 23 frontend tests, TypeScript and production build; strict package Biome; Linux CRS control/observation, recovery, healing, and upstream-sync contracts; ShellCheck; negative verification of privilege, protocol, maintenance, cooldown, rollback, concurrency, timeout and response-sanitization guards. Twelve root-helper tests passed, including a negative pin for LAPI health without an AppSec listener. Actual isolated systemd/Docker update, host restart, plus real-browser successful activation and forced-failure recovery passed at 1440px, 390px and 320px. Production was not contacted. README, operations guide, English UI strings and changelog are updated.
Blast radius: the CrowdSec route and new internal/socket client, its WAF control component, and fork-owned installer host tooling. Existing CLI activation and high-confidence blocking remain supported; backup/restore remain CLI-only.