From eb68cdc425eca2e450fe4e686455c65771c376ee Mon Sep 17 00:00:00 2001
From: git <git@nix-config>
Date: Mon, 6 Jul 2026 16:12:05 +1000
Subject: [PATCH] updated crowdsec config

---
 core/crowdsec/Dockerfile         |  6 +++---
 core/crowdsec/docker-compose.yml |  9 ++++++---
 core/crowdsec/profiles.yaml      | 29 +++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 6 deletions(-)
 create mode 100644 core/crowdsec/profiles.yaml

diff --git a/core/crowdsec/Dockerfile b/core/crowdsec/Dockerfile
index 959b597..81951bf 100644
--- a/core/crowdsec/Dockerfile
+++ b/core/crowdsec/Dockerfile
@@ -1,6 +1,6 @@
 FROM crowdsecurity/crowdsec:latest
 
-COPY config/ /etc/crowdsec
+#COPY config/ /etc/crowdsec
 # Install required components at build time
-RUN cscli hub update && \
-    cscli collections install crowdsecurity/traefik --force 
+#RUN cscli hub update && \
+#    cscli collections install crowdsecurity/traefik --force 
diff --git a/core/crowdsec/docker-compose.yml b/core/crowdsec/docker-compose.yml
index 6128094..1aa880e 100644
--- a/core/crowdsec/docker-compose.yml
+++ b/core/crowdsec/docker-compose.yml
@@ -1,8 +1,8 @@
 services:
   crowdsec:
     profiles: ["core","all","crowdsec", "traefik"]
-#    image: crowdsecurity/crowdsec:latest
-    build: ${PROJECT_ROOT}/core/crowdsec
+    image: crowdsecurity/crowdsec:latest
+#    build: ${PROJECT_ROOT}/core/crowdsec
     container_name: crowdsec
     restart: always
     environment:
@@ -14,7 +14,10 @@ services:
 #      - ${PROJECT_ROOT}/core/crowdsec/config:/etc/crowdsec
       - ${DOCKER_VOLUMES}/crowdsec/logs:/logs:ro
       - ${DOCKER_VOLUMES}/crowdsec/data:/var/lib/crowdsec/data
-      - ${DOCKER_VOLUMES}/crowdsec/config:/etc/crowdsec
+#      - ${DOCKER_VOLUMES}/crowdsec/config.yaml:/etc/crowdsec/config.yaml
+#      - ${DOCKER_VOLUMES}/crowdsec/config:/etc/crowdsec
+      - ${PROJECT_ROOT}/core/crowdsec/acquis.d:/etc/crowdsec/acquis.d
+      - ${PROJECT_ROOT}/core/crowdsec/profiles.yaml:/etc/crowdsec/profiles.yaml
     networks:
 #      - reverse_proxy
       - traefik
diff --git a/core/crowdsec/profiles.yaml b/core/crowdsec/profiles.yaml
new file mode 100644
index 0000000..c4982ac
--- /dev/null
+++ b/core/crowdsec/profiles.yaml
@@ -0,0 +1,29 @@
+name: default_ip_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Ip"
+decisions:
+ - type: ban
+   duration: 4h
+#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break
+---
+name: default_range_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Range"
+decisions:
+ - type: ban
+   duration: 4h
+#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break