Skip to content

v1.7.4

Choose a tag to compare

View all tags
@jmrGrav jmrGrav released this 22 Jun 10:28
· 41 commits to main since this release
v1.7.4
This tag was signed with the committer’s verified signature.
jmrGrav
GPG key ID: E34BC7955D46431A
Verified
Learn about vigilant mode.
096b0d0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[v1.7.4] — 2026-06-22

Summary

Two missions plus a hardening pass. Mission 1 closes the Cloudflare ban lifecycle loop: bans now expire and auto-deban, and auto-ban decisions require corroborating local evidence in addition to AbuseIPDB confidence — confidence=100 alone is never sufficient. Mission 2 introduces the Trusted Networks registry, a hub-and-spoke source of truth for allowlisted ASNs/CIDRs consumed by every ban/report decision point. Also includes local WAF/HTTP-error-burst evidence-only signals, four Codex-audit fixes (#64, #65, #66, #69), and HTTP-level test coverage for the first-run setup wizard (#67).

Added

  • Cloudflare ban lifecycle — internal/services/cfbanlifecycle tracks ban expiry and runs a cleanup worker that lifts expired bans automatically.
  • Reputation-gated auto-ban/auto-deban — auto-ban requires AbuseIPDB confidence=100 and a corroborating local evidence signal (burst counter ≥ 1); confidence alone is rejected. Auto-deban runs on improved reputation. New reputation_policy config block and a Cloudflare Ban Lifecycle UI page.
  • Trusted Networks registry — internal/runtime/providerstate hub-and-spoke ASN/CIDR allowlist, single source of truth consumed by ban/report decisions, with an import/export UI.
  • Local WAF / HTTP-error intelligence — internal/adapters/wafref and internal/adapters/nginxerrors ingest local WAF references and Nginx 4xx/5xx error bursts as evidence-only signals (shadow/enforce gated), surfaced in a new dashboard section.
  • Setup-wizard test coverage — HTTP-level tests drive the full first-run wizard (steps 1-9) through real session/CSRF-gated handlers, closing the coverage gaps reported in #67.

Fixes

  • #64/#65/#66/#69 — Codex audit findings — see PR #70 for the four individual fixes, including the /timeline full-history recomputation on every request (#69), now cached with a bounded TTL.

  • /run/crowdsec-lua permission denied after www-data group grant (PR #74) — cf-sync exchanges files with the OpenResty/Lua CrowdSec bouncer via the shared root:www-data 0775 directory /run/crowdsec-lua; postinst adds security-automation to the www-data group so openrestyevent.LiveSource can rename events.jsonl/waf_refs.jsonl. Linux processes keep the supplementary groups they had at exec() time, so a cf-sync instance already running when that group membership is granted or changed keeps failing with permission denied until restarted. Added a packaging regression test (TestPostinst_CrowdsecLuaGroupGrant) and documented the restart/verification steps in docs/operations/RUNBOOK.md.

Operational note

  • Upgrades may require a service restart for group membership to take effect. If an upgrade or manual usermod changes which groups security-automation belongs to (e.g. the www-data grant above), the already-running cf-sync process does not pick up the change automatically — run sudo systemctl restart cf-sync afterward. See docs/operations/RUNBOOK.md, "/run/crowdsec-lua permissions — restart required after group changes".
Assets 3
Loading