fix(crowdsec): update whitelist.yaml to prevent false positive from nextcloud chunk

config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2

@@ -18,4 +18,6 @@ whitelist:
         - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
         # opencloud chunk request false positive
         - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'"
+        # nextcloud chunk request false positive
+        - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
 {% endif %}

docs/issues/crowdsec/260321_actual_budget.md

@@ -30,4 +30,4 @@
   - evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/data/migrations/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
-  - Delete false positive decision with `sudo cscli decision list --id $ID`
+  - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260321_immich.md

@@ -29,4 +29,4 @@
   - evt.Meta.target_fqdn == 'Immich.ilnmors.com' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
-  - Delete false positive decision with `sudo cscli decision list --id $ID`
+  - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260404_opencloud.md

@@ -29,4 +29,4 @@
   - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
-  - Delete false positive decision with `sudo cscli decision list --id $ID`
+  - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260502_nextcloud.md

@@ -0,0 +1,33 @@
+# Nextcloud crowdsec false positive issue
+
+## Status
+- Finished
+
+## Date
+- 2026-05-02
+
+## Version
+- Nextcloud: 33.0.3
+
+## Problem
+- When users download or modify some files, all connections to homelab services are refused.
+  - fw ban users' IP address.
+
+## Reason
+- Nextcloud uses chunks when clients uploads or download files to it.
+- LAPI decides a ban when a lot of chunks file is uploaded or downloaded from external devices.
+    - `crowdsecurity/http-crawl-non_statics`
+
+## Timeline
+- 2026-05-02: Release OpenCloud
+- 2026-05-02: Find the false positive case, and add whitelist
+
+## Solution
+- Access to fw
+  - Check the ban list with `sudo cscli alerts list`
+  - Read the ban case with `sudo cscli alerts inspect $NUMBER`
+- Add regex on whitelist
+  - evt.Meta.target_fcqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
+- Delete false positive decision
+  - Check false positive decision with `sudo cscli decision list`
+  - Delete false positive decision with `sudo cscli decision delete --id $ID`