Files

T

Claude 8f6523a47b Add Home Assistant to CrowdSec variants

Add Home Assistant (home-automation hub, port 8123) to the -crowdsec scripts
for 24.04 and 26.04, following the existing service pattern (menu entry,
detection, defaults, parse, uninstall, install block, UFW rule, Caddy template).

- Image ghcr.io/home-assistant/home-assistant:stable, config volume, privileged
  + /run/dbus for hardware integrations; documents host-networking alternative
  for full mDNS/device discovery.
- Pre-seeds config/configuration.yaml with default_config + http.trusted_proxies
  (only on a fresh install) so HA works behind the Caddy reverse proxy without
  the usual 400 'request from reverse proxy' error.
- Integrates with configure_caddy_for_service (subdomain 'home').

Added only to the -crowdsec tier (current tip); original and -no-keycloak
scripts stay frozen as the evolution record. Both variants pass 'bash -n' and a
--dry-run --unattended pass (exit 0), including with Home Assistant forced on.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

2026-06-03 12:20:36 +00:00

3.6 KiB

Raw Blame History

Install Script Variants

This repo ships the post-install script in three tiers, for both Ubuntu 24.04 and 26.04. Pick one and run it — they are mutually exclusive (each is a complete, standalone script).

File	Keycloak	SSO	Intrusion prevention
`ubuntu-post-install-<ver>.sh`	✅ included	Keycloak or Authelia	fail2ban (SSH + Caddy)
`ubuntu-post-install-<ver>-no-keycloak.sh`	❌ removed	Authelia	fail2ban (SSH + Caddy)
`ubuntu-post-install-<ver>-crowdsec.sh`	❌ removed	Authelia	CrowdSec (replaces fail2ban)

<ver> is 24.04 or 26.04.

New services are added to the -crowdsec tier only (the current tip of the evolution); the original and -no-keycloak scripts are frozen as historical snapshots. For example, Home Assistant (home-automation hub, port 8123) is available in the -crowdsec variants. It ships with a trusted_proxies config pre-seeded so it works behind the Caddy reverse proxy out of the box.

Which one?

Original (.sh) — unchanged baseline, kept for fallback. Still offers Keycloak in the menu.
-no-keycloak — same as original but with Keycloak fully removed. Authelia is the SSO + 2FA option. Use this if you never got Keycloak running and have standardized on Authelia.
-crowdsec — builds on -no-keycloak and swaps fail2ban out for CrowdSec:
- SSH brute-force protection (CrowdSec reads /var/log/auth.log via the crowdsecurity/sshd collection)
- Caddy HTTP auth abuse (the crowdsecurity/caddy collection + a log acquisition at /etc/crowdsec/acquis.d/caddy.yaml)
- Enforcement via crowdsec-firewall-bouncer-iptables
- Geo-blocking + community IP-reputation blocklists — the capability that fail2ban and Authelia both lack
- Optional ntfy alerts on bans — when configuring CrowdSec the script can wire up an ntfy push notification (via CrowdSec's HTTP notification plugin). It writes /etc/crowdsec/notifications/ntfy.yaml and references it from the default profile in /etc/crowdsec/profiles.yaml. The same script can also install a self-hosted ntfy server (separate menu option), so alerts can stay on your own infrastructure.

A note on "notification of failed attempts"

CrowdSec alerts fire on a ban decision — i.e. once an IP crosses the failed-attempt threshold for a scenario (e.g. crowdsecurity/ssh-bf), not on every individual failed login. That gives you one actionable "X banned for Y" push instead of a flood. To alert on a single failed login you'd lower the scenario threshold or write a custom scenario, but the ban-level alert is the recommended default.

Authelia, by contrast, only sends email/SMTP notifications (for password reset and 2FA device registration) — it has no built-in "failed login" push, which is why CrowdSec → ntfy is the path used here.

Notes on the security layers

Authelia handles per-account failed-login regulation (lockout). It does not do geo-blocking.
fail2ban bans IPs at the firewall based on Caddy log patterns (401/403/429). No geo-blocking, not credential-aware.
CrowdSec covers SSH + Caddy from a single agent, adds geo/ASN enrichment and crowd-sourced reputation, and is the modern successor to fail2ban.

Useful CrowdSec commands after install:

sudo cscli metrics              # overview / parsing health
sudo cscli decisions list       # current bans
sudo cscli alerts list          # detections
sudo cscli decisions delete --ip <IP>   # unban

3.6 KiB Raw Blame History

Install Script Variants

Which one?

A note on "notification of failed attempts"

Notes on the security layers

3.6 KiB

Raw Blame History