3edef38ba3
ops-readonly gets two read-only questions, waf_blocked and waf_rule_info. The rule ids per blocked request are in CrowdSec's alerts, not in its log, and alerts need machine credentials that can also write, so waf-export.py runs on the host and the container gets one more read-only mount. Workflow G lets a local 3B model draft CRS route exclusions as a Forgejo issue. The model never writes rule syntax, a code node checks every field against the tool output, the only write permission is an issue in one repo, trusted sources live in the workflow and the trigger needs a token. waf-propose.py does the same without a model: 5 of 5 false positives, no exclusion for an attack, 0.03 s. The model proposed an exclusion for nearly every attack it saw. Numbers and the traps we hit are in HARDENING.md.
12 lines
504 B
Desktop File
12 lines
504 B
Desktop File
# Episode 14: dumps CrowdSec's WAF alerts to a JSON file for ops-readonly.
|
|
# Runs on the host, because cscli needs machine credentials that can also write.
|
|
# cp ops-readonly/waf-export.{service,timer} /etc/systemd/system/
|
|
# systemctl daemon-reload && systemctl enable --now waf-export.timer
|
|
[Unit]
|
|
Description=Export CrowdSec WAF alerts for the read-only agent tool
|
|
After=crowdsec.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/python3 /opt/selfhostedops-stack/ops-readonly/waf-export.py
|
|
Nice=10
|