Homelabv4/infrastructure/crowdsec/values.yaml

# CrowdSec Helm chart values
# IP reputation + behavioral detection (Layer 0 of zero-trust stack)
#
# Components:
#   LAPI - Central decision engine (PostgreSQL backend via CNPG)
#   Agent - DaemonSet parsing pod logs from /var/log/pods/
#   Firewall Bouncer - Deployed separately (see firewall-bouncer.yaml)

container_runtime: containerd

lapi:
  env:
    # PostgreSQL password from CNPG auto-generated secret
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: pg-crowdsec-app
          key: password
    # CAPI enrollment (optional — user registers at app.crowdsec.net)
    - name: ENROLL_KEY
      valueFrom:
        secretKeyRef:
          name: crowdsec-capi-key
          key: enrollment-key
          optional: true
    - name: ENROLL_INSTANCE_NAME
      value: "homelabv5"
    - name: ENROLL_TAGS
      value: "k8s homelab talos"
    # Pre-register firewall bouncer API key
    - name: BOUNCER_KEY_firewall
      valueFrom:
        secretKeyRef:
          name: crowdsec-bouncer-key
          key: api-key
          optional: true
    # CAPI/console-enroll disabled for now (2026-08-17). Root causes found:
    # 1) Home's public IP gets a 403 from AWS WAF in front of api.crowdsec.net
    #    (even on a bare unauthenticated request) - an IP-level block
    #    unrelated to credentials; ENROLL_KEY above is valid and correctly
    #    wired, but can't get past this from home.
    # 2) Tried routing around it via a proxy on the VPS over Netbird -
    #    confirmed no node in this cluster has any route into the Netbird
    #    mesh CIDR for pod-originated (egress) traffic at all. The
    #    per-namespace netbird "router" pods (gitlab, vault, argocd, etc.)
    #    are inbound-only infrastructure (let external Netbird peers reach
    #    K8s services) - nothing provides the reverse path. Building that
    #    properly needs either a Talos-native static route (fragile - would
    #    point at a pod IP that changes on every restart) or a deliberate
    #    exception to the disallow-host-namespaces STIG policy that
    #    correctly blocks the hostNetwork-based approach. Out of scope for
    #    a same-night fix - tracked as a separate future task.
    # LAPI treats a failed CAPI/enroll attempt as fatal at startup (crashes
    # the whole server, taking the agent + bouncer down with it via their
    # dependency on LAPI), so disable it entirely rather than crash-loop.
    # ENROLL_KEY above stays set - flip this back to false (or remove it)
    # once real pod-egress routing to the VPS exists, no other change needed.
    - name: DISABLE_ONLINE_API
      value: "true"
  persistentVolume:
    data:
      enabled: false
    config:
      enabled: false
  securityContext:
    capabilities:
      drop:
        - ALL
  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
  dashboard:
    enabled: false
  strategy:
    type: Recreate

agent:
  # Log acquisition sources
  acquisition:
    # Istio ingress gateway logs (all external traffic)
    - namespace: istio-system
      podName: istio-ingressgateway-*
      program: nginx
      poll_without_inotify: true
    # Netbird management logs
    - namespace: netbird
      podName: netbird-management-*
      program: netbird
      poll_without_inotify: true
    # Authentik server logs
    - namespace: authentik
      podName: authentik-server-*
      program: authentik
      poll_without_inotify: true

  env:
    # Install community collections for log parsing
    - name: COLLECTIONS
      value: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/http-cve"

  securityContext:
    capabilities:
      drop:
        - ALL
  resources:
    requests:
      cpu: 25m
      memory: 128Mi
    limits:
      cpu: 200m
      memory: 256Mi
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true

  # Wait for LAPI to be ready (must be a map, not scalar)
  wait_for_lapi:
    image:
      repository: busybox
      tag: "1.28"

# PostgreSQL database backend (CNPG) + auto-registration for agents
config:
  config.yaml.local: |
    db_config:
      type: postgresql
      user: app
      password: ${DB_PASSWORD}
      db_name: crowdsec
      host: pg-crowdsec-rw.crowdsec.svc
      port: 5432
      sslmode: prefer
    api:
      server:
        auto_registration:
          enabled: true
          token: ${REGISTRATION_TOKEN}
          allowed_ranges:
            - "10.244.0.0/16"
            - "127.0.0.1/32"