CrowdSec identity: no shared credentials in the Core image, register on first enable (0041 step 4) #47

New issue

Open

opened 2026-09-30 13:17:57 -03:00 by marcos-mendez · 1 comment

marcos-mendez commented

2026-09-30 13:17:57 -03:00

(Migrated from github.com)

Found while building keel-overlay-crowdsec (Keel-Linux/common#20, 0041 step 2).

trixie's crowdsec 1.4.6 postinst registers the machine with the local API (cscli machines add, keyed on /etc/machine-id) and with CrowdSec's central API (cscli capi register) at installation. crowdsec-firewall-bouncer's postinst adds itself as a bouncer and writes the key. In an image build all of this happens once, so every machine made from the image would share one CAPI identity, one set of LAPI credentials and one bouncer key.

Belongs to step 4 (keel-core image) and the enable path of step 3 (keel apply):

At image build, delete:
- /etc/crowdsec/local_api_credentials.yaml
- /etc/crowdsec/online_api_credentials.yaml
- /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.local and its .id
- /var/lib/crowdsec/data/crowdsec.db
On keel's first enable of the crowdsec overlay:
- run cscli machines add --auto --force, cscli capi register and cscli bouncers add;
- write the bouncer key into crowdsec-firewall-bouncer.yaml.local.
Network: cscli capi register fails without network. Its postinst already fails that way at install. Enabling must report the failure and must not leave a half-registered state.

Found while building keel-overlay-crowdsec (Keel-Linux/common#20, 0041 step 2). trixie's crowdsec 1.4.6 postinst registers the machine with the local API (`cscli machines add`, keyed on /etc/machine-id) and with CrowdSec's central API (`cscli capi register`) at installation. crowdsec-firewall-bouncer's postinst adds itself as a bouncer and writes the key. In an image build all of this happens once, so every machine made from the image would share one CAPI identity, one set of LAPI credentials and one bouncer key. Belongs to step 4 (keel-core image) and the enable path of step 3 (keel apply): - **At image build**, delete: - /etc/crowdsec/local_api_credentials.yaml - /etc/crowdsec/online_api_credentials.yaml - /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.local and its .id - /var/lib/crowdsec/data/crowdsec.db - **On keel's first enable of the crowdsec overlay**: - run `cscli machines add --auto --force`, `cscli capi register` and `cscli bouncers add`; - write the bouncer key into crowdsec-firewall-bouncer.yaml.local. - **Network:** `cscli capi register` fails without network. Its postinst already fails that way at install. Enabling must report the failure and must not leave a half-registered state.

marcos-mendez commented

2026-09-30 15:21:03 -03:00

(Migrated from github.com)

Add /var/lib/crowdsec/pending-registration to the image-build deletion list. crowdsec's postinst skips the pending queue when its unit is not active, and the bouncer's unit has ConditionPathExists=! on that file, so a leftover blocks the bouncer from starting (it also holds a stale key). keel's first enable now replaces it (Keel-Linux/keel#58), but the image should not carry it.

Add `/var/lib/crowdsec/pending-registration` to the image-build deletion list. crowdsec's postinst skips the pending queue when its unit is not active, and the bouncer's unit has `ConditionPathExists=!` on that file, so a leftover blocks the bouncer from starting (it also holds a stale key). keel's first enable now replaces it (Keel-Linux/keel#58), but the image should not carry it.