crowdsec: disabled_scenarios removes hub scenarios replaced by local ones, absent_files removes retired local files

crowdsec/tasks/main.yml

@@ -53,6 +53,7 @@
     - /etc/crowdsec/bouncers
     - /etc/crowdsec/parsers/s02-enrich
     - /etc/systemd/system/crowdsec.service.d
+    - /etc/systemd/system/crowdsec-hubupdate.service.d
     - /etc/systemd/system/crowdsec-firewall-bouncer.service.d
     - /etc/systemd/system/nftables.service.d
 
@@ -171,6 +172,37 @@
   when: crowdsec_missing | length > 0
   notify: Restart crowdsec
 
+# The script upgrades every hub item with --force (a scenario removed with --force taints its collection, and a plain upgrade skips
+# tainted collections) and removes the disabled scenarios again. It runs here once and daily as crowdsec-hubupdate.service.
+- name: Install the hub update script
+  ansible.builtin.template:
+    src: crowdsec-hubupdate.sh.j2
+    dest: /usr/local/sbin/crowdsec-hubupdate
+    mode: "0755"
+
+- name: Run the hub update script instead of the package one
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/crowdsec-hubupdate.service.d/override.conf
+    mode: "0644"
+    content: |
+      [Service]
+      ExecStart=
+      ExecStart=/usr/local/sbin/crowdsec-hubupdate
+  register: crowdsec_hubupdate_dropin
+
+- name: Reload systemd for the hub update unit
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: crowdsec_hubupdate_dropin is changed
+
+- name: Upgrade the hub items and remove the disabled scenarios
+  ansible.builtin.command: /usr/local/sbin/crowdsec-hubupdate
+  environment:
+    NO_RELOAD: "1"
+  register: crowdsec_hubupdate
+  changed_when: "'changed' in crowdsec_hubupdate.stdout"
+  notify: Restart crowdsec
+
 - name: Install the local parsers and scenarios
   ansible.builtin.copy:
     dest: "/etc/crowdsec/{{ item.key }}"
@@ -181,6 +213,15 @@
     label: "{{ item.key }}"
   notify: Restart crowdsec
 
+- name: Remove retired local files
+  ansible.builtin.file:
+    path: "/etc/crowdsec/{{ item.value }}"
+    state: absent
+  loop: "{{ crowdsec.absent_files | dict2items | rejectattr('value', 'none') }}"
+  loop_control:
+    label: "{{ item.value }}"
+  notify: Restart crowdsec
+
 - name: Enable the agent and the bouncer
   ansible.builtin.systemd:
     name: "{{ item }}"