Route CrowdSec CAPI/console-enroll traffic through VPS proxy

Confirmed 2026-08-17: home's public IP gets a 403 ForbiddenException from
AWS WAF in front of api.crowdsec.net, even on a bare unauthenticated test
request - the VPS's IP gets a normal 401 on the identical request. This is
an IP-level block unrelated to credentials, which is why LAPI kept hitting
403 on both anonymous auto-registration and console enroll with a fresh,
valid enrollment key.

Fix: HTTPS_PROXY/HTTP_PROXY pointed at a tinyproxy instance on the VPS
(bound to its Netbird interface only, not internet-reachable), reachable
from home over the existing Netbird mesh via netbird-cluster-router.
cscli/crowdsec's Go HTTP client honors standard proxy env vars.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/crowdsec/values.yaml

@@ -34,6 +34,19 @@ lapi:
           name: crowdsec-bouncer-key
           key: api-key
           optional: true
+    # Route CAPI/console-enroll HTTPS calls (api.crowdsec.net) through a
+    # tinyproxy on the VPS, reachable over Netbird. Confirmed 2026-08-17:
+    # home's public IP gets a 403 from AWS WAF in front of CrowdSec's API
+    # (even on a bare unauthenticated request), while the VPS's IP gets a
+    # normal 401 - this is an IP-level block unrelated to credentials, so a
+    # fresh enrollment key alone doesn't help without changing egress IP.
+    # cscli's Go HTTP client honors these standard proxy env vars.
+    - name: HTTPS_PROXY
+      value: "http://100.108.113.41:8888"
+    - name: HTTP_PROXY
+      value: "http://100.108.113.41:8888"
+    - name: NO_PROXY
+      value: "localhost,127.0.0.1,.svc,.svc.cluster.local,10.244.0.0/16,10.96.0.0/16"
   persistentVolume:
     data:
       enabled: false