v0.7.0

🛰️ OpenSecDash v0.7.0: The Dashboard Has Learned Its ASNs

OpenSecDash v0.7.0 is a response-policy, network-context, and historical-visibility update. It adds permanent local ASN ban policies backed by ordinary CrowdSec IP decisions, keeps ASN organizations separate from IP-specific provider names, adds notifications for ASN activity, and extends the Rollup Explorer with a yearly view.

An Autonomous System Number, or ASN, identifies a network on the internet. Providers and hosting companies use ASNs to exchange routing information, which makes them a useful way to recognize where groups of public IP addresses belong.

In other words: the dashboard can now remember that an entire internet neighborhood has been troublesome, while still asking CrowdSec to lock out only the addresses it has actually seen. Even a homelab firewall should avoid starting a diplomatic incident with half the routing table.

⚠️ Upgrade Notes: No Breaking Changes

Existing Docker installations can upgrade without changing their deployment configuration. The new ASN policy tables, organization fields, and notification defaults are applied automatically through the normal database migration process.

There are three details worth knowing:

• Existing notification choices are preserved. Newly created event, system, ASN, and Insight rules now start disabled, so notifications remain explicitly opt-in. Rules that an administrator already enabled or disabled keep their saved state.
• Bare-metal installations should update to Python 3.14.7. This is the pinned and validated runtime for v0.7.0; Docker users receive it with the image.
• Permanent ASN enforcement is opt-in and dependency-aware. Creating a real policy requires usable GeoIP and CrowdSec integrations, an Operator or Admin account, and Action simulation to be disabled. The upgrade does not create policies or send new data to an external service.

No surprise bans, no retroactive sweep through old events, and no notification rule waking up simply because a migration found the light switch.

➡️ Upgrade details:
Updating OpenSecDash

🚫 Permanent ASN Policies, Carefully Applied

Operators and administrators can now mark an unwanted ASN once and let OpenSecDash respond when future public-IP events are enriched with that ASN. The action is available from the optional ASN column in Events and Access, and the resulting policies are managed on the CrowdSec page.

The word permanent describes the local OpenSecDash policy, not an endless CrowdSec ban. Each newly observed match creates a normal global scope=Ip decision for seven days. OpenSecDash does not send native ASN decisions, expand BGP prefixes, scan historical events, or renew bans on a timer. Standard CrowdSec bouncers therefore continue to work with the IP decisions they already understand.

The workflow keeps ownership deliberately narrow:

• Only newly stored public-IP events that complete GeoIP enrichment can match a policy.
• Exact CrowdSec decision IDs are tracked, so policy cleanup never broadly unbans an address or touches an unrelated decision.
• Manually unbanning a policy-owned IP creates an exception for that ASN/IP pair only.
• Reclassification to a different, non-blocked ASN releases only the old policy-owned decision; failed releases remain visible and retryable.
• Removing a policy cleans up only decisions that still match its recorded ownership, origin, and scenario.

Every successful automatic ban also creates a high-confidence IP Explorer Insight and contributes to ban counters, CrowdSec history, the Dashboard, and rollups. ASN-specific scenarios keep their detail in event history while summary views group them under Manual permanent ASN ban, because a top-scenarios chart containing 47 nearly identical AS numbers is technically accurate but emotionally unhelpful.

Important: The first request is always observed before this workflow can react. GeoIP enrichment, the CrowdSec LAPI call, and bouncer synchronization happen afterward, so enforcement can begin no earlier than a later request and is not guaranteed by the second one.

➡️ Policy setup, behavior, and recovery:
CrowdSec

🏷️ ASN Organizations Are Their Own Data Now

GeoIP enrichment now stores the ASN organization separately from the IP-specific ISP or company name. Events and Access can show both the normalized ASN and its organization, while permanent policies retain the latest organization as a reviewable display snapshot.

That distinction matters because an ASN number is the policy key, while organization names are neither authoritative nor immutable. Providers can return stale data, companies can rename themselves, and ASNs can change hands. OpenSecDash therefore waits for a substantially different organization to appear three times across at least two IPs before raising a review warning. Cosmetic differences in case, whitespace, punctuation, and common legal suffixes do not manufacture drama.

Acknowledging the warning records that somebody reviewed it. It does not prove an ownership transfer, pause the policy, or silently remove decisions; those remain separate, confirmed actions.

➡️ Classification limits and privacy details:
GeoIP

🔔 ASN Activity Can Send an Email — If You Ask It To

Notifications now cover successful permanent ASN-policy bans and confirmed ASN-organization changes. Ban messages include the affected IP, ASN, organization snapshot, decision duration, and CrowdSec scenario. Organization-change messages include both snapshots and the time the change was confirmed, giving an administrator enough context to investigate without treating GeoIP as an oracle.

All newly created rules are disabled. Enabling global notifications and configuring SMTP is still not enough by itself; each event, system, ASN, or Insight rule must be selected explicitly. Existing saved choices survive the upgrade.

➡️ Rule behavior and SMTP setup:
Notifications

📅 The Rollup Explorer Thinks in Years

The Rollup Explorer can now summarize a complete calendar year, including the current year to date. It combines recent daily rollups with compacted monthly rows, so the view remains useful even after raw events have left the retention window.

Yearly summaries include the same totals and breakdowns as daily and monthly views: internal and external access, security events, bans, geoblocks, total events, event types, scenarios, and countries. Long-term visibility no longer requires twelve browser tabs and the sort of mental arithmetic usually reserved for tax season.

➡️ Historical summaries and retention:
Dashboard rollups

✨ Smaller Improvements and Fixes

• The mobile navigation menu works again, including after responsive page transitions.
• Mobile search keeps its value during refreshes instead of developing selective amnesia.
• CrowdSec ASN management sections preserve their expanded or collapsed state during updates.
• Python moves to 3.14.7, Node.js to the 24 LTS line, Tailwind CSS to 4.3.3, and htmx to 2.0.10.
• Runtime, build, release, and security dependencies received routine updates, with generated third-party notices kept in sync.
• Release finalization now receives the repository context it needs, reducing the chance that the last step of a release suddenly forgets which release it is finishing.

🎯 What This Release Represents

v0.7.0 gives homelab operators a durable response to recurring traffic from an unwanted ASN without pretending that an ASN is a static list of addresses or that GeoIP data is unquestionable truth. Policies stay local, enforcement stays limited to observed IPs, ownership is recorded precisely, and unusual organization changes remain visible for human review.

At the same time, notification defaults become more deliberate and historical rollups become easier to inspect across a full year. The result is broader security context with deliberately narrow actions: remember the neighborhood, verify the address, and keep the giant red BAN THE INTERNET button safely imaginary.

---

What's Changed

✨ Enhancements

• feat: permanent asn bans by @konkos1 in #131
• feat: asn notifications by @konkos1 in #134
• feat: add yearly rollup view by @konkos1 in #135

🐛 Fixes

• fix: restore mobile navigation menu with Tailwind 4 by @konkos1 in #122
• fix: preserve mobile search during refresh by @konkos1 in #123
• fix: preserve crowdsec asn section state by @konkos1 in #132
• feat: separate asn organization data by @konkos1 in #133
• fix: speed up bounded event searches by @konkos1 in #136

🔧 Other changes

• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1 by @dependabot[bot] in #109
• build(deps): bump cryptography from 49.0.0 to 50.0.0 in /backend by @dependabot[bot] in #112
• build(deps): bump astral-sh/uv from 0.11.32 to 0.12.2 in /docker by @dependabot[bot] in #115
• build(deps): bump the python-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #116
• change: update external dependencies by @konkos1 in #117
• change: update htmx to 2.0.10 by @konkos1 in #118
• change: upgrade tailwind css to 4.3.3 by @konkos1 in #119
• change: upgrade node.js to 24 lts by @konkos1 in #120
• change: update python runtime to 3.14.7 by @konkos1 in #121
• build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 by @dependabot[bot] in #124
• build(deps): bump the python-dependencies group in /backend with 3 updates by @dependabot[bot] in #125
• build(deps): bump python from 83c1ceb to ce40764 in /docker by @dependabot[bot] in #126
• build(deps): bump astral-sh/uv from 0.12.3 to 0.12.4 in /docker by @dependabot[bot] in #127
• build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #128
• build(deps): bump the python-dependencies group in /backend with 2 updates by @dependabot[bot] in #129
• build(deps): bump astral-sh/uv from 0.12.4 to 0.12.5 in /docker by @dependabot[bot] in #130
• fix: unblock release security gate by @konkos1 in #137

Full Changelog: v0.6.0...v0.7.0