From 6dd5bbc2cea4b419887cc7f43eab8b30c128d0c7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 21 Jul 2026 12:36:02 +0000
Subject: [PATCH] Include the check/unban commands directly in CrowdSec ntfy
 alerts

Confirmed live: a legitimate SIP device on a CGNAT ISP (Starlink,
T-Mobile home internet) got collaterally banned by
crowdsecurity/asterisk_bf alongside actual bad actors sharing the same
carrier IP. The alert now includes the exact commands (with the banned
IP substituted in) instead of just naming the ban, so recovering from
this doesn't require remembering or looking up cscli syntax.
---
 services/crowdsec.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/crowdsec.sh b/services/crowdsec.sh
index f1e90f1..aeb451f 100644
--- a/services/crowdsec.sh
+++ b/services/crowdsec.sh
@@ -284,6 +284,8 @@ format: |
   {{range . -}}
   {{range .Decisions -}}
   {{.Value}} banned: {{.Scenario}} for {{.Duration}}
+  Check all bans:  sudo cscli decisions list
+  Unban this IP:   sudo cscli decisions delete --ip {{.Value}}
   {{end -}}
   {{end -}}
 url: $CS_NTFY_URL