parker/cumulus
Watch
1
0
Fork
You've already forked cumulus
 0
Code Pull requests Activity Actions

Tune CrowdSec http-probing capacity to 20 via authored mount #53

Merged
parkerhdavis merged 1 commit from crowdsec-http-probing-tuning into main 2026-10-14 08:01:32 -06:00
Conversation 0 Commits 1 Files changed 2 +39
parkerhdavis commented 2026-10-14 08:01:28 -06:00 (Migrated from github.com)
Copy link

Summary

  • Author the tuned crowdsecurity/http-probing scenario in git (capacity: 10 -> 20) and mount it read-only over the installed hub copy on the Droplet, following the acquis.d precedent so hub upgrades never clobber it.
  • fj (forgejo-cli) probes two PR-template dirs x three extensions on every PR command, and Forgejo 404s each miss: 11 requests in ~1s, one over the hub default's capacity of 10. CrowdSec read that sweep as an attack scan and banned the home IP for four hours, denying every Pangolin resource plus the fleet agents' auth endpoints, which all egress from the same address.
  • The tuned capacity absorbs a full template sweep with headroom; real scanners still overflow quickly since leakspeed: 10s barely refills the bucket.

Deployment

The live edge is already fixed (ban removed 2026-10-14, scenario tuned in place and reloaded, recovery verified: dashboard and forge 200 from home, all three sites reconnected). This PR converges git with the running state; after merge, make sync && make up droplet applies the authored mount and the container state matches the repo.

## Summary - Author the tuned `crowdsecurity/http-probing` scenario in git (`capacity: 10 -> 20`) and mount it read-only over the installed hub copy on the Droplet, following the acquis.d precedent so hub upgrades never clobber it. - `fj` (forgejo-cli) probes two PR-template dirs x three extensions on every PR command, and Forgejo 404s each miss: 11 requests in ~1s, one over the hub default's capacity of 10. CrowdSec read that sweep as an attack scan and banned the home IP for four hours, denying every Pangolin resource plus the fleet agents' auth endpoints, which all egress from the same address. - The tuned capacity absorbs a full template sweep with headroom; real scanners still overflow quickly since `leakspeed: 10s` barely refills the bucket. ## Deployment The live edge is already fixed (ban removed 2026-10-14, scenario tuned in place and reloaded, recovery verified: dashboard and forge 200 from home, all three sites reconnected). This PR converges git with the running state; after merge, `make sync && make up droplet` applies the authored mount and the container state matches the repo.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
parker/cumulus!53
No description provided.