fix(crowdsec): update whitelist.yaml to prevent false positive from nextcloud chunk

ansible/roles/common/tasks/services/set_crowdsec.yaml

@@ -36,15 +36,10 @@
   ansible.builtin.set_fact:
     acquisd_list:
       fw:
-        collection:
-          - "crowdsecurity/suricata"
-        parser: []
+        collection: "crowdsecurity/suricata"
         config: "suricata.yaml"
       auth:
-        collection:
-          - "crowdsecurity/caddy"
-        parser:
-          - "crowdsecurity/nextcloud-whitelist"
+        collection: "crowdsecurity/caddy"
         config: "caddy.yaml"
 
 - name: Deploy crowdsec-update service files
@@ -186,8 +181,7 @@
   block:
     - name: Install crowdsec collection
       ansible.builtin.command:
-        cmd: "cscli collections install {{ item }}"
-      loop: "{{ acquisd_list[node['name']]['collection'] }}"
+        cmd: "cscli collections install {{ acquisd_list[node['name']]['collection'] }}"
       become: true
       changed_when: "'overwrite' not in is_collection_installed.stderr"
       failed_when:
@@ -195,17 +189,6 @@
         - "'already installed' not in is_collection_installed.stderr"
       register: "is_collection_installed"
 
-    - name: Install crowdsec parser
-      ansible.builtin.command:
-        cmd: "cscli parsers install {{ item }}"
-      loop: "{{ acquisd_list[node['name']]['parser'] }}"
-      become: true
-      changed_when: "'overwrite' not in is_parser_installed.stderr"
-      failed_when:
-        - is_parser_installed.rc != 0
-        - "'already installed' not in is_parser_installed.stderr"
-      register: "is_parser_installed"
-
     - name: Create crowdsec acquis.d directory
       ansible.builtin.file:
         path: "/etc/crowdsec/acquis.d"

config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2

@@ -18,4 +18,6 @@ whitelist:
         - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
         # opencloud chunk request false positive
         - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'"
+        # nextcloud chunk request false positive
+        - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
 {% endif %}

docs/issues/crowdsec/260321_actual_budget.md

@@ -26,7 +26,7 @@
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
+- Add regex on whitelist
   - evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/data/migrations/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`

docs/issues/crowdsec/260321_immich.md

@@ -25,8 +25,8 @@
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
-  - evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
+- Add regex on whitelist
+  - evt.Meta.target_fqdn == 'Immich.ilnmors.com' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
   - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260404_opencloud.md

@@ -25,7 +25,7 @@
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
+- Add regex on whitelist
   - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`

docs/issues/crowdsec/260502_nextcloud.md

@@ -14,25 +14,20 @@
   - fw ban users' IP address.
 
 ## Reason
-- Nextcloud has a lot of workflows which can be caught from crowdsec
+- Nextcloud uses chunks when clients uploads or download files to it.
+- LAPI decides a ban when a lot of chunks file is uploaded or downloaded from external devices.
+    - `crowdsecurity/http-crawl-non_statics`
 
 ## Timeline
-- 2026-05-02: Release nextcloud
+- 2026-05-02: Release OpenCloud
 - 2026-05-02: Find the false positive case, and add whitelist
-- 2026-05-03: Install crowdsecurity/nextcloud-whitelist parser
-- 2026-05-03: Make previous expressions annotation
 
 ## Solution
-- Install crowdsecurity/nextcloud-whitelist on auth node
-
-### Deprecated solution
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/dist/'
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/remote.php/dav/files/'
+- Add regex on whitelist
+  - evt.Meta.target_fcqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
   - Delete false positive decision with `sudo cscli decision delete --id $ID`