From 685099e9d8d528bc2bab292856668f94ce6e59a1 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 23:39:58 +0000 Subject: [PATCH 1/2] Refine crowdsec geo-allowlist: drop core Eastern Europe, add Russia back Excludes Bulgaria, Czechia, Hungary, Moldova, Poland, Romania, Slovakia, and Ukraine per user request, while keeping the Balkans and Baltics (several of which, e.g. Estonia, don't fit the same risk profile despite the old Cold-War grouping). Russia added back to the allowed list per explicit user request. --- services/crowdsec.sh | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/services/crowdsec.sh b/services/crowdsec.sh index 8659cf8..5446614 100644 --- a/services/crowdsec.sh +++ b/services/crowdsec.sh @@ -201,14 +201,19 @@ labels: sudo cscli collections install crowdsecurity/geoip-enrich 2>/dev/null || \ echo " ⚠ crowdsecurity/geoip-enrich may already be installed" - # North America + broad geographic Europe, ISO 3166-1 alpha-2. Russia, - # Belarus, and Turkey are deliberately left out even though they span - # into Europe geographically — they're common abuse-traffic sources - # and almost certainly not what "Europe" means here. To adjust, edit - # the two lists below and re-run, or hand-edit $GEO_SCENARIO directly - # (it's plain YAML — no reinstall needed, just restart crowdsec after). + # North America + Europe, ISO 3166-1 alpha-2. Belarus and Turkey are + # left out (common abuse-traffic sources, and not really "Europe" in + # the sense meant here). Core Eastern Europe (Bulgaria, Czechia, + # Hungary, Moldova, Poland, Romania, Slovakia, Ukraine) is left out + # too — the Balkans and Baltics (Albania, Bosnia, Croatia, Estonia, + # Latvia, Lithuania, Montenegro, North Macedonia, Serbia, Slovenia) + # are kept in deliberately, since several of them (Estonia especially) + # don't fit the same risk profile despite the old Cold-War grouping. + # To adjust, edit the two lists below and re-run, or hand-edit + # $GEO_SCENARIO directly (it's plain YAML — no reinstall needed, just + # restart crowdsec after). local _GEO_NA="US CA MX" - local _GEO_EU="AD AL AT BA BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MD ME MK MT NL NO PL PT RO RS SE SI SK SM UA VA" + local _GEO_EU="AD AL AT BA BE CH CY DE DK EE ES FI FR GB GR HR IE IS IT LI LT LU LV MC ME MK MT NL NO PT RS RU SE SI SM VA" local _geo_expr_list _geo_expr_list="$(printf "'%s', " $_GEO_NA $_GEO_EU)" _geo_expr_list="${_geo_expr_list%, }" From 11e5993370c21eecb306bdbd311efc59ad6c6563 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 23:42:07 +0000 Subject: [PATCH 2/2] Revert Russia to excluded in crowdsec geo-allowlist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Misread the previous request as "add Russia to the allowed list" — it meant the opposite: Russia should stay excluded, same as the other high-risk/Eastern Europe entries already left out. --- services/crowdsec.sh | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/services/crowdsec.sh b/services/crowdsec.sh index 5446614..f1e90f1 100644 --- a/services/crowdsec.sh +++ b/services/crowdsec.sh @@ -201,19 +201,19 @@ labels: sudo cscli collections install crowdsecurity/geoip-enrich 2>/dev/null || \ echo " ⚠ crowdsecurity/geoip-enrich may already be installed" - # North America + Europe, ISO 3166-1 alpha-2. Belarus and Turkey are - # left out (common abuse-traffic sources, and not really "Europe" in - # the sense meant here). Core Eastern Europe (Bulgaria, Czechia, - # Hungary, Moldova, Poland, Romania, Slovakia, Ukraine) is left out - # too — the Balkans and Baltics (Albania, Bosnia, Croatia, Estonia, - # Latvia, Lithuania, Montenegro, North Macedonia, Serbia, Slovenia) - # are kept in deliberately, since several of them (Estonia especially) - # don't fit the same risk profile despite the old Cold-War grouping. - # To adjust, edit the two lists below and re-run, or hand-edit - # $GEO_SCENARIO directly (it's plain YAML — no reinstall needed, just - # restart crowdsec after). + # North America + Europe, ISO 3166-1 alpha-2. Russia, Belarus, and + # Turkey are left out (common abuse-traffic sources, and not really + # "Europe" in the sense meant here). Core Eastern Europe (Bulgaria, + # Czechia, Hungary, Moldova, Poland, Romania, Slovakia, Ukraine) is + # left out too — the Balkans and Baltics (Albania, Bosnia, Croatia, + # Estonia, Latvia, Lithuania, Montenegro, North Macedonia, Serbia, + # Slovenia) are kept in deliberately, since several of them (Estonia + # especially) don't fit the same risk profile despite the old + # Cold-War grouping. To adjust, edit the two lists below and re-run, + # or hand-edit $GEO_SCENARIO directly (it's plain YAML — no reinstall + # needed, just restart crowdsec after). local _GEO_NA="US CA MX" - local _GEO_EU="AD AL AT BA BE CH CY DE DK EE ES FI FR GB GR HR IE IS IT LI LT LU LV MC ME MK MT NL NO PT RS RU SE SI SM VA" + local _GEO_EU="AD AL AT BA BE CH CY DE DK EE ES FI FR GB GR HR IE IS IT LI LT LU LV MC ME MK MT NL NO PT RS SE SI SM VA" local _geo_expr_list _geo_expr_list="$(printf "'%s', " $_GEO_NA $_GEO_EU)" _geo_expr_list="${_geo_expr_list%, }"