VPS: CrowdSec agent + firewall bouncer

mysticalsoap commented

2026-08-17 15:07:09 -04:00

Owner

Bouncer to enforce decisions coming from the homelab
Agent watching the SSH port

Folding the bouncer into Podman is fine for packaging uniformity, but it needs --network=host plus NET_ADMIN/NET_RAW to write host nftables -- so it keeps the packaging benefit and none of the isolation one.

- Bouncer to enforce decisions coming from the homelab - Agent watching the SSH port Folding the bouncer into Podman is fine for packaging uniformity, but it needs `--network=host` plus NET_ADMIN/NET_RAW to write host nftables -- so it keeps the packaging benefit and none of the isolation one.

mysticalsoap added the

audit-work

vps

new-service

labels

2026-08-17 15:07:09 -04:00

mysticalsoap referenced this issue

2026-09-21 01:22:24 -04:00

vps: crowdsec firewall bouncer, drop the traefik bait and catchall routers #307

mysticalsoap commented

2026-09-21 01:22:24 -04:00

Author

Owner

Scoped down to the firewall bouncer; the agent half is dropped. The VPS sshd is publickey-only and nothing on the box sees Forgejo's auth outcomes, so an agent there would detect nothing worth having while adding a write path to the LAPI (a compromised VPS could ban arbitrary addresses). A bouncer key is read-only. Implementation in #307, which also removes the Traefik bait/catchall routers and addInternals that only existed to give the L7 plugin a look at unrouted traffic.

Rows
Columns

VPS: CrowdSec agent + firewall bouncer #102