Remediation Component inclusion: cs-unifi-bouncer-pro (UniFi Network 11, multi-site)
I maintainer di solito rispondono entro 1 giorno
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Idoneità per principianti
- 35/100
Direzione di ricerca
Start by reviewing the CrowdSec Hub contribution requirements and how existing bouncers are represented in the repository. Then assess the linked project’s documentation and verification claims against those requirements; done means the Hub maintainers can decide whether and how to include it. No repository files or tests are named in the issue.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
Hello CrowdSec team,
I'd like to request the inclusion of cs-unifi-bouncer-pro as a community-maintained remediation component in the CrowdSec Hub.
Project and submission details
- Source: https://github.com/developingchet/cs-unifi-bouncer-pro
- License: MIT
- Status: Stable, actively maintained; latest release v2.4.0
- Language / deployment: Go; Docker images (Linux AMD64, ARM64, ARMv7), plus documented systemd and Kubernetes deployments
- Image: https://hub.docker.com/r/developingchet/cs-unifi-bouncer-pro (also published to GHCR)
- README and quick start: https://github.com/developingchet/cs-unifi-bouncer-pro/blob/main/README.md
What it does
A standalone bouncer that consumes CrowdSec Local API decisions and enforces bans through UniFi Network firewall rules and zone policies. It handles IPv4/IPv6, decision expiry, controller synchronization, and persistent ban state. It supports UniFi OS consoles, UniFi OS Server, and supported self-hosted Network controllers.
Why include another UniFi bouncer?
The Hub already lists Teifun2's cs-unifi-bouncer, which remains a useful option. This is an independent, complementary implementation intended for different deployment and operational needs, not a claim that the existing bouncer is obsolete. Both projects support UniFi API enforcement, zone-based rules and IPv6.
Features that make this an additional choice, based on the projects' published documentation:
| Area | cs-unifi-bouncer-pro approach |
|---|---|
| Multi-site | One process manages multiple configured UniFi sites rather than a single UNIFI_SITE selection. |
| UniFi Network 11 migration | v2.4.0 explicitly handles Network 11's zone-only firewall, rejects unsupported legacy mode, detects a legacy-to-zone transition, and cleans up converted policies. |
| Inbound and outbound enforcement | Configurable zone pairs, destination host/subnet and port scoping, plus optional EGRESS_ZONE_PAIRS to block connections to banned addresses from internal zones. |
| Multiple ban sources | CrowdSec decisions plus external text feeds, AbuseIPDB-derived lists with country filters, and manual bans; source claims prevent one source's expiry from incorrectly unbanning another's address. |
| State and recovery | bbolt persistence, TTL expiry, startup/periodic reconciliation, automatic shard creation/compaction (up to 10,000 entries per shard), rate-limit backoff, and a circuit breaker. |
| Operations | Dry-run mode without controller writes, validation and diagnostics, ban history, webhook alerts, 28 Prometheus metrics, health endpoints, and CrowdSec LAPI usage telemetry. |
These are documented design differences, not performance benchmarks or assertions that the existing project cannot implement similar features. Listing both would let users choose according to their controller version, number of sites, desired traffic direction, recovery model and deployment preferences.
Maintenance, security and verification
- Automated CI: Go tests with race detection, linting, vulnerability checks and container/seccomp validation. Latest main CI run passed.
- v2.4.0 release workflow passed; release images are Cosign-signed, with CycloneDX SBOM, checksums and build provenance.
- Hardened distroless/non-root container, read-only filesystem, dropped capabilities, seccomp allowlist, TLS verification and secret redaction. Details: security and supply-chain documentation.
Documentation for Hub review
- Install, configure and uninstall (including
drain --forcecleanup) - Full configuration reference
- Architecture and state management
- UniFi Network 11 and version upgrade guidance
- Troubleshooting
- Tests and workflow results
Suggested Hub description: "CrowdSec bouncer for UniFi Network 11 and earlier: multi-site zone-based/legacy firewall enforcement, optional egress blocking, persistent bans, reconciliation and Prometheus metrics."
Please let me know if any adjustments or additional verification are needed for inclusion. Thank you for reviewing it.
- Lingua principale
- Python
- Stelle
- 257
- Fork
- 235
- Merge medio
- 3g 20h
- PR unite (30g)
- 27
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Ha un modello di pull request
- Nessuna guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di crowdsecurity/hub
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 76/100
crowdsecurity/hub#1999 ·
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
crowdsecurity/hub#1998 · 1 commento ·
I maintainer di solito rispondono entro 1 giorno
-
traefik-logs: CLF lines with an escaped quote in the User-Agent are droppedForse già presa @stephdl l’ha presa 5 giorni fa. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 72/100
crowdsecurity/hub#1977 ·
I maintainer di solito rispondono entro 1 giorno
-
f5-big-ip-cve-2020-5902 and pulse-secure-sslvpn-cve-2019-11510 compile 4 regexes per HTTP line (`Upper(x) matches Upper('...')`)Forse già presa Una pull request collegata a questa issue è aperta o già unita. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 70/100
crowdsecurity/hub#1964 ·
I maintainer di solito rispondono entro 1 giorno
-
fix(plex-allowlist): allow subtitle transcode bursts on HTTP 400Forse già presa @hrithiksaini99 l’ha presa 1 giorno fa. Aperta
Difficoltà 1/5 1-3 ore Idoneità per principianti 82/100
crowdsecurity/hub#1945 ·
I maintainer di solito rispondono entro 1 giorno
Tutte le issue di crowdsecurity/hub
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 84/100
pylint-dev/pylint#11791 ·
I maintainer di solito rispondono entro 1 giorno
-
Rasterio granule reads never retry, so one 503 (Service Unavailable) fails the whole requestForse già presa @chuckwondo l’ha presa oggi. Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 75/100
developmentseed/titiler-cmr#305 ·
I maintainer di solito rispondono entro 1 giorno
-
community enhancement
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
I maintainer di solito rispondono entro 1 giorno
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
I maintainer di solito rispondono entro 1 giorno
-
bug
Difficoltà 2/5 1-3 ore Idoneità per principianti 86/100
I maintainer di solito rispondono entro 1 giorno