0029 (ADR-007): Keel Core ships CrowdSec and WireGuard, and a VIP on the mesh #34

New issue

Open

opened 2026-09-30 10:10:49 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-30 10:10:49 -03:00

(Migrated from github.com)

Decision (maintainer, 2026-09-30). Keel Core ships CrowdSec and WireGuard. Simple: CrowdSec installed but disabled. Advanced: the installer opens CrowdSec's configuration and configures a VIP over the WireGuard mesh, assumed by the active node. Replication and node-to-node traffic always use real addresses; the VIP is for service delivery only. Automatic VIP promotion only for database appliances.

Handbook: docs/decisions/0029-core-ships-crowdsec-and-wireguard.md (handbook#26)

Amends: 0020 (keepalived's floating address was rejected; this VIP is a mesh route, not a link-layer address; DNS with a health check remains for public clients), 0018 (amended: a VIP move is exempt from the confirmation window).

Review notes (resolved by the maintainer, 2026-09-30)

WireGuard is layer 3 with no ARP: a VIP means updating AllowedIPs (/128) on all peers, via a controller watching etcd. Resolved as the implementation detail, built with the etcd phase.
0018's 120 s window and an automatic VIP move. Resolved: 0018 is amended; a controller change that touches only the VIP's AllowedIPs is not under the window. Every other overlay change still is.
CrowdSec: 1.4.6-10 in trixie with crowdsec-firewall-bouncer 0.0.25; upstream is 1.8.1. Trixie's or a Keel-packaged current one is an implementation task.

First tasks

CrowdSec overlay in Core, disabled by default (Phase 1).
VIP controller design, after the registry (Phase 5).

**Decision (maintainer, 2026-09-30).** Keel Core ships CrowdSec and WireGuard. Simple: CrowdSec installed but disabled. Advanced: the installer opens CrowdSec's configuration and configures a VIP over the WireGuard mesh, assumed by the active node. Replication and node-to-node traffic always use real addresses; the VIP is for service delivery only. Automatic VIP promotion only for database appliances. **Handbook:** `docs/decisions/0029-core-ships-crowdsec-and-wireguard.md` (handbook#26) **Amends:** 0020 (keepalived's floating address was rejected; this VIP is a mesh route, not a link-layer address; DNS with a health check remains for public clients), 0018 (amended: a VIP move is exempt from the confirmation window). **Review notes** (resolved by the maintainer, 2026-09-30) - [x] WireGuard is layer 3 with no ARP: a VIP means updating `AllowedIPs` (/128) on all peers, via a controller watching etcd. Resolved as the implementation detail, built with the etcd phase. - [x] 0018's 120 s window and an automatic VIP move. Resolved: 0018 is amended; a controller change that touches only the VIP's AllowedIPs is not under the window. Every other overlay change still is. - [x] CrowdSec: 1.4.6-10 in trixie with crowdsec-firewall-bouncer 0.0.25; upstream is 1.8.1. Trixie's or a Keel-packaged current one is an implementation task. **First tasks** - [ ] CrowdSec overlay in Core, disabled by default (Phase 1). - [ ] VIP controller design, after the registry (Phase 5).