crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range

2026-10-24 08:10:34 +00:00
parent 5cac169224
commit 81e7a9dc6a
7 changed files with 216 additions and 0 deletions
@@ -0,0 +1,6 @@
+---
+# Same sources as the crowdsec role (roles/crowdsec/vars/main.yml), plus loopback.
+crowdsec_range_bouncer_allow: >-
+  {{ (crowdsec.whitelist | default({}) | dict2items | rejectattr('value', 'none') | map(attribute='value') | list
+  + groups['all'] | map('extract', hostvars, 'public_ips') | select('defined') | flatten
+  + ['127.0.0.0/8', '::1/128']) | unique }}