crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range

2026-10-24 08:10:34 +00:00
parent 5cac169224
commit 81e7a9dc6a
7 changed files with 216 additions and 0 deletions
@@ -0,0 +1,15 @@
+[Unit]
+Description=Mirror the CrowdSec range ban decisions into the nftables table inet crowdsec_ranges
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/crowdsec-range-bouncer
+TimeoutStartSec=60
+StateDirectory=crowdsec-range-bouncer
+StateDirectoryMode=0700
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+NoNewPrivileges=true