Documentation - Category - arleo.euhttps://www.arleo.eu/en/categories/documentation/Documentation - Category - arleo.euHugo -- gohugo.ioenSun, 12 Apr 2026 21:25:00 +0200Infrastructure Documentationhttps://www.arleo.eu/en/documentation/Sun, 12 Apr 2026 21:25:00 +0200Jmrhttps://www.arleo.eu/en/documentation/1. Security Architecture (10 layers)
# Layer Technology
1 DNS DNSSEC ECDSA P256-SHA256
2 Cloud CDN + WAF Cloudflare WAF + DDoS + AI Crawl Control
3 Network CrowdSec nftables Bouncer
4 Firewall Netgear PR60X SPI
5 Local WAF ModSecurity + OWASP CRS 4.x
6 IDS/IPS CrowdSec Agent + SSH/HTTP scenarios
7 HTTPS TLS 1.3 + HSTS preload
8 DNS-TLS DoH port 853
9 Application Grav CMS + CSP + Secure cookies
10 Monitoring BetterStack + CrowdSec poller + Vector

2. CrowdSec → Cloudflare Sync (crowdsec-cf-sync.py)

Location: /usr/local/bin/crowdsec-cf-sync.py Service: crowdsec-cf-sync.service Logs: /var/log/crowdsec/cf-sync.log

]]>Infrastructure Scriptshttps://www.arleo.eu/en/scripts/Sun, 12 Apr 2026 21:25:00 +0200Jmrhttps://www.arleo.eu/en/scripts/1. crowdsec-cf-sync.py

Location: /usr/local/bin/crowdsec-cf-sync.py Systemd service: crowdsec-cf-sync.service Logs: /var/log/crowdsec/cf-sync.log

Installation

cp crowdsec-cf-sync.py /usr/local/bin/
chmod +x /usr/local/bin/crowdsec-cf-sync.py
systemctl enable crowdsec-cf-sync
systemctl start crowdsec-cf-sync

Features

  • Syncs active CrowdSec bans → Cloudflare IP Access Rules (tag crowdsec-local-ban)
  • Reports banned IPs → AbuseIPDB (48h window, deduplicated)
  • Repeat-offender escalation: 1st CrowdSec ban handles | 2nd → 24h | 3rd+ → 7d (7d window)
  • ModSecurity score ≥ 5 → immediate 2h CF ban (tag modsec-ban) + AbuseIPDB report
  • Automatic /24 ban: 2+ IPs from same block in 7d → CF + CrowdSec ban 24h (tag crowdsec-cidr-ban)

Bug fixes (April 2026)

  • cs_origin vs origin in get_recent_local_bans() — the JSON field is cs_origin
  • REST API pagination /v1/decisions?limit=1000 misses cscli bans → replaced with cscli decisions list --origin
  • Items → items (lowercase) in CrowdSec allowlist JSON parsing

⚠️ Important: real tokens (CF_API_TOKEN, CF_ZONE_ID, CS_API_KEY, ABUSEIPDB_KEY) must be stored in /etc/secrets/ with chmod 600 and loaded via environment variables, not hardcoded in the script. The VOTRE_* values below are placeholders.

]]>