From 33b0d018f969dcc3b067b1713babd748e2569ad2 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Mon, 17 Aug 2026 18:39:23 -0500 Subject: [PATCH] Route CrowdSec CAPI/console-enroll traffic through VPS proxy Confirmed 2026-08-17: home's public IP gets a 403 ForbiddenException from AWS WAF in front of api.crowdsec.net, even on a bare unauthenticated test request - the VPS's IP gets a normal 401 on the identical request. This is an IP-level block unrelated to credentials, which is why LAPI kept hitting 403 on both anonymous auto-registration and console enroll with a fresh, valid enrollment key. Fix: HTTPS_PROXY/HTTP_PROXY pointed at a tinyproxy instance on the VPS (bound to its Netbird interface only, not internet-reachable), reachable from home over the existing Netbird mesh via netbird-cluster-router. cscli/crowdsec's Go HTTP client honors standard proxy env vars. Co-Authored-By: Claude Sonnet 5 --- infrastructure/crowdsec/values.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/infrastructure/crowdsec/values.yaml b/infrastructure/crowdsec/values.yaml index 2e4c060..56586ee 100644 --- a/infrastructure/crowdsec/values.yaml +++ b/infrastructure/crowdsec/values.yaml @@ -34,6 +34,19 @@ lapi: name: crowdsec-bouncer-key key: api-key optional: true + # Route CAPI/console-enroll HTTPS calls (api.crowdsec.net) through a + # tinyproxy on the VPS, reachable over Netbird. Confirmed 2026-08-17: + # home's public IP gets a 403 from AWS WAF in front of CrowdSec's API + # (even on a bare unauthenticated request), while the VPS's IP gets a + # normal 401 - this is an IP-level block unrelated to credentials, so a + # fresh enrollment key alone doesn't help without changing egress IP. + # cscli's Go HTTP client honors these standard proxy env vars. + - name: HTTPS_PROXY + value: "http://100.108.113.41:8888" + - name: HTTP_PROXY + value: "http://100.108.113.41:8888" + - name: NO_PROXY + value: "localhost,127.0.0.1,.svc,.svc.cluster.local,10.244.0.0/16,10.96.0.0/16" persistentVolume: data: enabled: false