Repository navigation
v0.7.1
🛰️ OpenSecDash v0.7.1: The Dashboard Has Learned Its ASNs — and Its Updates Can Speak Up
OpenSecDash v0.7.1 is a response-policy, network-context, historical-visibility, and notification update. It adds permanent local ASN ban policies backed by ordinary CrowdSec IP decisions, keeps ASN organizations separate from IP-specific provider names, adds notifications for ASN activity and newly available asset versions, and extends the Rollup Explorer with a yearly view.
An Autonomous System Number, or ASN, identifies a network on the internet. Providers and hosting companies use ASNs to exchange routing information, which makes them a useful way to recognize where groups of public IP addresses belong.
In other words: the dashboard can now remember that an entire internet neighborhood has been troublesome, while still asking CrowdSec to lock out only the addresses it has actually seen. It can also let you know when one of the applications in your homelab has a new release waiting. Even a homelab firewall should avoid starting a diplomatic incident with half the routing table, and even a homelab administrator should not need to patrol every release page by hand.
⚠️ Upgrade Notes: No Breaking Changes
Existing Docker installations can upgrade without changing their deployment configuration. The new ASN policy tables, organization fields, and notification defaults are applied automatically through the normal database migration and startup processes.
There are four details worth knowing:
- Existing notification choices are preserved. Newly created event, system, ASN, asset-update, and Insight rules start disabled, so notifications remain explicitly opt-in. Rules that an administrator already enabled or disabled keep their saved state.
- Asset-update notifications are opt-in. Configure SMTP, enable notifications globally, and then enable the separate Asset update available rule on the Notifications page. Existing available updates do not generate retroactive mail merely because the rule was added.
- Bare-metal installations should update to Python
3.14.7. This is the pinned and validated runtime forv0.7.1; Docker users receive it with the image. - Permanent ASN enforcement is opt-in and dependency-aware. Creating a real policy requires usable GeoIP and CrowdSec integrations, an Operator or Admin account, and Action simulation to be disabled. The upgrade does not create policies or send new data to an external service.
No surprise bans, no retroactive sweep through old events, and no notification rule waking up simply because an upgrade found the light switch.
➡️ Upgrade details:
Updating OpenSecDash
🚫 Permanent ASN Policies, Carefully Applied
Operators and administrators can now mark an unwanted ASN once and let OpenSecDash respond when future public-IP events are enriched with that ASN. The action is available from the optional ASN column in Events and Access, and the resulting policies are managed on the CrowdSec page.
The word permanent describes the local OpenSecDash policy, not an endless CrowdSec ban. Each newly observed match creates a normal global scope=Ip decision for seven days. OpenSecDash does not send native ASN decisions, expand BGP prefixes, scan historical events, or renew bans on a timer. Standard CrowdSec bouncers therefore continue to work with the IP decisions they already understand.
The workflow keeps ownership deliberately narrow:
- Only newly stored public-IP events that complete GeoIP enrichment can match a policy.
- Exact CrowdSec decision IDs are tracked, so policy cleanup never broadly unbans an address or touches an unrelated decision.
- Manually unbanning a policy-owned IP creates an exception for that ASN/IP pair only.
- Reclassification to a different, non-blocked ASN releases only the old policy-owned decision; failed releases remain visible and retryable.
- Removing a policy cleans up only decisions that still match its recorded ownership, origin, and scenario.
Every successful automatic ban also creates a high-confidence IP Explorer Insight and contributes to ban counters, CrowdSec history, the Dashboard, and rollups. ASN-specific scenarios keep their detail in event history while summary views group them under Manual permanent ASN ban, because a top-scenarios chart containing 47 nearly identical AS numbers is technically accurate but emotionally unhelpful.
Important: The first request is always observed before this workflow can react. GeoIP enrichment, the CrowdSec LAPI call, and bouncer synchronization happen afterward, so enforcement can begin no earlier than a later request and is not guaranteed by the second one.
➡️ Policy setup, behavior, and recovery:
CrowdSec
🏷️ ASN Organizations Are Their Own Data Now
GeoIP enrichment now stores the ASN organization separately from the IP-specific ISP or company name. Events and Access can show both the normalized ASN and its organization, while permanent policies retain the latest organization as a reviewable display snapshot.
That distinction matters because an ASN number is the policy key, while organization names are neither authoritative nor immutable. Providers can return stale data, companies can rename themselves, and ASNs can change hands. OpenSecDash therefore waits for a substantially different organization to appear three times across at least two IPs before raising a review warning. Cosmetic differences in case, whitespace, punctuation, and common legal suffixes do not manufacture drama.
Acknowledging the warning records that somebody reviewed it. It does not prove an ownership transfer, pause the policy, or silently remove decisions; those remain separate, confirmed actions.
➡️ Classification limits and privacy details:
GeoIP
🔔 ASN Activity Can Send an Email — If You Ask It To
Notifications cover successful permanent ASN-policy bans and confirmed ASN-organization changes. Ban messages include the affected IP, ASN, organization snapshot, decision duration, and CrowdSec scenario. Organization-change messages include both snapshots and the time the change was confirmed, giving an administrator enough context to investigate without treating GeoIP as an oracle.
All newly created rules are disabled. Enabling global notifications and configuring SMTP is still not enough by itself; each event, system, ASN, asset-update, or Insight rule must be selected explicitly. Existing saved choices survive the upgrade.
➡️ Rule behavior and SMTP setup:
Notifications
📦 New Asset Updates Can Send an Email Too
The new Asset update available rule can send an email when OpenSecDash first detects that an asset is outdated or when a different latest version appears later. Repeated checks of the same available version do not create duplicate notifications.
Each message includes the update-relevant details that are available: asset and system names, VMID, asset and system types, inventory source, installed version, available version, host URL, and check time. It also contains a direct link to the matching GitHub release notes and, when an OpenSecDash base URL is configured, a link back to the affected system in the Asset Explorer. If several updates are waiting, the digest keeps the details and release-notes link for every included asset.
The rule starts disabled, just like every other newly created notification rule. OpenSecDash does not send existing inventory data anywhere unless an administrator configures SMTP and explicitly enables both notifications and this rule.
➡️ Asset inventory and update checks:
Asset update checks
➡️ Rule behavior and SMTP setup:
Notifications
📅 The Rollup Explorer Thinks in Years
The Rollup Explorer can now summarize a complete calendar year, including the current year to date. It combines recent daily rollups with compacted monthly rows, so the view remains useful even after raw events have left the retention window.
Yearly summaries include the same totals and breakdowns as daily and monthly views: internal and external access, security events, bans, geoblocks, total events, event types, scenarios, and countries. Long-term visibility no longer requires twelve browser tabs and the sort of mental arithmetic usually reserved for tax season.
➡️ Historical summaries and retention:
Dashboard rollups
✨ Smaller Improvements and Fixes
- The mobile navigation menu works again, including after responsive page transitions.
- Mobile search keeps its value during refreshes instead of developing selective amnesia.
- CrowdSec ASN management sections preserve their expanded or collapsed state during updates.
- Python moves to
3.14.7, Node.js to the 24 LTS line, Tailwind CSS to4.3.3, and htmx to2.0.10. - Runtime, build, release, and security dependencies received routine updates, with generated third-party notices kept in sync.
- Release finalization now receives the repository context it needs, reducing the chance that the last step of a release suddenly forgets which release it is finishing.
🎯 What This Release Represents
v0.7.1 gives homelab operators a durable response to recurring traffic from an unwanted ASN without pretending that an ASN is a static list of addresses or that GeoIP data is unquestionable truth. Policies stay local, enforcement stays limited to observed IPs, ownership is recorded precisely, and unusual organization changes remain visible for human review.
At the same time, notification defaults become more deliberate, newly available asset versions can report themselves with useful context and release notes, and historical rollups become easier to inspect across a full year. The result is broader security context with deliberately narrow actions: remember the neighborhood, verify the address, keep applications current, and leave the giant red BAN THE INTERNET button safely imaginary.
What's Changed
✨ Enhancements
🐛 Fixes
- fix: group CrowdSec ASN rollup scenarios by @konkos1 in #138
- fix: preserve CrowdSec ASN scenario prefixes by @konkos1 in #139
- fix: style all notification links as buttons by @konkos1 in #145
🔧 Other changes
- build(deps): bump astral-sh/uv from 0.12.5 to 0.12.7 in /docker by @dependabot[bot] in #143
- build(deps): bump cryptography from 50.0.0 to 50.0.1 in /backend in the python-dependencies group by @dependabot[bot] in #144
Full Changelog: v0.7.0...v0.7.1
