# CrowdSec Helm chart values
# IP reputation + behavioral detection (Layer 0 of zero-trust stack)
#
# Components:
#   LAPI - Central decision engine (PostgreSQL backend via CNPG)
#   Agent - DaemonSet parsing pod logs from /var/log/pods/
#   Firewall Bouncer - Deployed separately (see firewall-bouncer.yaml)

container_runtime: containerd

lapi:
  env:
    # PostgreSQL password from CNPG auto-generated secret
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: pg-crowdsec-app
          key: password
    # CAPI enrollment (optional — user registers at app.crowdsec.net)
    - name: ENROLL_KEY
      valueFrom:
        secretKeyRef:
          name: crowdsec-capi-key
          key: enrollment-key
          optional: true
    - name: ENROLL_INSTANCE_NAME
      value: "homelabv5"
    - name: ENROLL_TAGS
      value: "k8s homelab talos"
    # Pre-register firewall bouncer API key
    - name: BOUNCER_KEY_firewall
      valueFrom:
        secretKeyRef:
          name: crowdsec-bouncer-key
          key: api-key
          optional: true
    # CAPI/console-enroll RE-ENABLED 2026-08-18. Home's public IP still gets
    # a 403 from AWS WAF in front of api.crowdsec.net (an IP-level block,
    # unrelated to credentials), so this routes through a tinyproxy on the
    # VPS over Netbird instead - confirmed working end-to-end now that real
    # pod-egress routing to the VPS exists (netbird-egress DaemonSet, see
    # infrastructure/netbird/manifests/egress-daemonset.yaml). This was
    # tried once before and failed because that egress route didn't exist
    # yet - not a proxy or credentials problem.
    - name: HTTPS_PROXY
      value: "http://100.108.113.41:8888"
    - name: HTTP_PROXY
      value: "http://100.108.113.41:8888"
    - name: NO_PROXY
      value: "localhost,127.0.0.1,.svc,.svc.cluster.local,10.244.0.0/16,10.96.0.0/16"
  persistentVolume:
    data:
      enabled: false
    config:
      enabled: false
  securityContext:
    capabilities:
      drop:
        - ALL
  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
  dashboard:
    enabled: false
  strategy:
    type: Recreate

agent:
  # Log acquisition sources
  acquisition:
    # Istio ingress gateway logs (all external traffic)
    - namespace: istio-system
      podName: istio-ingressgateway-*
      program: nginx
      poll_without_inotify: true
    # Netbird management logs
    - namespace: netbird
      podName: netbird-management-*
      program: netbird
      poll_without_inotify: true
    # Authentik server logs
    - namespace: authentik
      podName: authentik-server-*
      program: authentik
      poll_without_inotify: true

  env:
    # Install community collections for log parsing
    - name: COLLECTIONS
      value: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/http-cve"

  securityContext:
    capabilities:
      drop:
        - ALL
  resources:
    requests:
      cpu: 25m
      memory: 128Mi
    limits:
      cpu: 200m
      memory: 256Mi
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true

  # Wait for LAPI to be ready (must be a map, not scalar)
  wait_for_lapi:
    image:
      repository: busybox
      tag: "1.28"

# PostgreSQL database backend (CNPG) + auto-registration for agents
config:
  config.yaml.local: |
    db_config:
      type: postgresql
      user: app
      password: ${DB_PASSWORD}
      db_name: crowdsec
      host: pg-crowdsec-rw.crowdsec.svc
      port: 5432
      sslmode: prefer
    api:
      server:
        auto_registration:
          enabled: true
          token: ${REGISTRATION_TOKEN}
          allowed_ranges:
            - "10.244.0.0/16"
            - "127.0.0.1/32"