crowdsec-unifi-bouncer/crowdsec-firewall-bouncer.yaml.example at main · wolffcatskyy/crowdsec-unifi-bouncer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
mode: ipset
update_frequency: 10s
log_mode: file
log_dir: /data/crowdsec-bouncer/log/
log_level: info
log_compression: true
log_max_size: 100
log_max_backups: 3
log_max_age: 30

# --- Upstream Configuration ---
# Option 1: Direct LAPI connection (simple, but LAPI sends ALL decisions)
#   If LAPI has more decisions than your ipset maxelem, excess are silently dropped.
api_url: http://YOUR_CROWDSEC_LAPI:8080/
api_key: YOUR_BOUNCER_API_KEY

# Option 2: Sidecar proxy (recommended when LAPI decisions > device capacity)
#   The sidecar scores, prioritizes, and caps decisions to fit your device.
#   Deploy the sidecar first (see sidecar/), then point the bouncer at it:
# api_url: http://YOUR_SIDECAR_HOST:8084/
# api_key: YOUR_BOUNCER_API_KEY

insecure_skip_verify: false
disable_ipv6: true
deny_action: DROP
deny_log: false
supported_decisions_types:
  - ban
blacklists_ipv4: crowdsec-blacklists
blacklists_ipv6: crowdsec6-blacklists
ipset_type: nethash
iptables_chains:
  - INPUT
  - FORWARD
iptables_add_rule_comments: true
prometheus:
  enabled: false
  listen_addr: 127.0.0.1
  listen_port: 60601