From 11e5993370c21eecb306bdbd311efc59ad6c6563 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 20 Jul 2026 23:42:07 +0000
Subject: [PATCH] Revert Russia to excluded in crowdsec geo-allowlist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Misread the previous request as "add Russia to the allowed list" —
it meant the opposite: Russia should stay excluded, same as the other
high-risk/Eastern Europe entries already left out.
---
 services/crowdsec.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/services/crowdsec.sh b/services/crowdsec.sh
index 5446614..f1e90f1 100644
--- a/services/crowdsec.sh
+++ b/services/crowdsec.sh
@@ -201,19 +201,19 @@ labels:
         sudo cscli collections install crowdsecurity/geoip-enrich 2>/dev/null || \
             echo "  ⚠ crowdsecurity/geoip-enrich may already be installed"
 
-        # North America + Europe, ISO 3166-1 alpha-2. Belarus and Turkey are
-        # left out (common abuse-traffic sources, and not really "Europe" in
-        # the sense meant here). Core Eastern Europe (Bulgaria, Czechia,
-        # Hungary, Moldova, Poland, Romania, Slovakia, Ukraine) is left out
-        # too — the Balkans and Baltics (Albania, Bosnia, Croatia, Estonia,
-        # Latvia, Lithuania, Montenegro, North Macedonia, Serbia, Slovenia)
-        # are kept in deliberately, since several of them (Estonia especially)
-        # don't fit the same risk profile despite the old Cold-War grouping.
-        # To adjust, edit the two lists below and re-run, or hand-edit
-        # $GEO_SCENARIO directly (it's plain YAML — no reinstall needed, just
-        # restart crowdsec after).
+        # North America + Europe, ISO 3166-1 alpha-2. Russia, Belarus, and
+        # Turkey are left out (common abuse-traffic sources, and not really
+        # "Europe" in the sense meant here). Core Eastern Europe (Bulgaria,
+        # Czechia, Hungary, Moldova, Poland, Romania, Slovakia, Ukraine) is
+        # left out too — the Balkans and Baltics (Albania, Bosnia, Croatia,
+        # Estonia, Latvia, Lithuania, Montenegro, North Macedonia, Serbia,
+        # Slovenia) are kept in deliberately, since several of them (Estonia
+        # especially) don't fit the same risk profile despite the old
+        # Cold-War grouping. To adjust, edit the two lists below and re-run,
+        # or hand-edit $GEO_SCENARIO directly (it's plain YAML — no reinstall
+        # needed, just restart crowdsec after).
         local _GEO_NA="US CA MX"
-        local _GEO_EU="AD AL AT BA BE CH CY DE DK EE ES FI FR GB GR HR IE IS IT LI LT LU LV MC ME MK MT NL NO PT RS RU SE SI SM VA"
+        local _GEO_EU="AD AL AT BA BE CH CY DE DK EE ES FI FR GB GR HR IE IS IT LI LT LU LV MC ME MK MT NL NO PT RS SE SI SM VA"
         local _geo_expr_list
         _geo_expr_list="$(printf "'%s', " $_GEO_NA $_GEO_EU)"
         _geo_expr_list="${_geo_expr_list%, }"