viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

crowdsec: register kvsync + firewall bouncer keys in LAPI

Browse source 
Seeds two new bouncers at LAPI startup (BOUNCER_KEY_kvsync, BOUNCER_KEY_firewall)
from Vault secret/platform, mirroring the existing BOUNCER_KEY_traefik wiring.
These are the two halves of the real enforcement that replaces the dead Yaegi
plugin: kvsync authenticates the LAPI->Cloudflare-KV sync (proxied edge Worker),
firewall authenticates the cs-firewall-bouncer DaemonSet (direct-host nftables).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-20 08:12:38 +00:00
parent 4d9fdbc7f7
commit 38675b7922
3 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
stacks/crowdsec/main.tf
View file

@ -32,4 +32,8 @@ module "crowdsec" {
# Same key the traefik-stack bouncer middleware uses — seeded into LAPI so the
# bouncer authenticates and pulls decisions (was unregistered → 403 → fail-open).
ingress_bouncer_key = data.vault_kv_secret_v2.secrets.data["ingress_crowdsec_api_key"]
# Real enforcement replacing the dead Traefik plugin: kvsync feeds the proxied
# edge Worker via Cloudflare KV; firewall is the direct-host nftables bouncer.
kvsync_bouncer_key = data.vault_kv_secret_v2.secrets.data["kvsync_bouncer_key"]
firewall_bouncer_key = data.vault_kv_secret_v2.secrets.data["firewall_bouncer_key"]
}