# episode 12: the keys changed in /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
# (the package writes the rest, including api_url and api_key).
#
# nftables mode instead of the iptables default. The bouncer then owns its
# own tables (ip crowdsec, ip6 crowdsec6) with hooks on input AND forward at
# priority -10, so it drops before Docker's FORWARD rules, and `ufw reload`
# does not touch it. In iptables mode you must add DOCKER-USER to
# iptables_chains, and every `ufw reload` silently removes the rule again.
mode: nftables
nftables_hooks:
  - input
  - forward