Episode 12/13: CrowdSec next to fail2ban, and an AppSec WAF in Caddy

Measured on the demo box against the same 24h of real traffic.

Episode 12 (detection, blocklist, firewall):
- crowdsec/ with install notes and the traps: port 8080 clash, empty first
  blocklist pull, replay forensic-mode dropping events (FIFO workaround),
  ssh-time-based-bf shipping remediation:false, the AppSec collections that
  refuse to start without extra rules.
- firewall bouncer in nftables mode (input + forward), which blocks
  Docker-published ports and survives ufw reload; iptables/DOCKER-USER does not.
- HARDENING.md episode 12 section with the numbers: fail2ban 4 banned IPs vs
  CrowdSec 23 detected / 1 blocked, blocklist overlap 50% of IPs but 19% of
  attempts, and the mode=normal blind spot for key-only root attempts.

Episode 13 (AppSec WAF):
- caddy/Dockerfile now builds the CrowdSec bouncer and AppSec handler alongside
  rate-limit, pinned to v0.14.1.
- Caddyfile imports a crowdsec snippet (bouncer + appsec) on every site except
  vpn; compose passes CROWDSEC_BOUNCER_KEY and host.docker.internal.
- Measured: virtual patching blocks known CVEs only (7 of 41 probes, near-zero
  false positives); OWASP CRS raises that to 27 of 41 but breaks git push and
  wiki editing at default paranoia. Default stays vpatch+generic.

fail2ban config unchanged. No secrets or real domains/IPs in tracked files.

compose.yml

@@ -58,7 +58,7 @@ volumes:
 
 services:
   caddy:
-    image: selfhostedops/caddy:ratelimit   # episode 10: own image with caddy-ratelimit
+    image: selfhostedops/caddy:crowdsec   # episode 12: caddy-ratelimit + CrowdSec bouncer + AppSec
     build: ./caddy
     restart: unless-stopped
     ports:
@@ -68,6 +68,9 @@ services:
     environment:
       DOMAIN: ${DOMAIN}
       ACME_EMAIL: ${ACME_EMAIL}
+      CROWDSEC_BOUNCER_KEY: ${CROWDSEC_BOUNCER_KEY}   # episode 12, see crowdsec/README.md
+    extra_hosts:
+      - "host.docker.internal:host-gateway"   # episode 12: CrowdSec runs on the host
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - ./logs/caddy:/var/log/caddy   # episode 10: JSON access log on the host for fail2ban