konairius/homelab
10
0
Fork 0
Code Issues 11 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

[security][medium] No enforcement at the edge: CrowdSec detection-only, no security-headers/rate-limit middleware #205

New Issue
Closed
opened 2026-07-14 09:48:40 +00:00 by claude-bot · 1 comment
claude-bot commented 2026-07-14 09:48:40 +00:00
Member
Copy Link
Copy Source

Finding

  • infrastructure/traefik/crowdsec-middleware.yaml exists but is not attached to any entrypoint/router (helmrelease has no additionalArguments wiring it). CrowdSec is detection-only since the 2026-06-27 IPv6 mass-ban outage.
  • No security-headers Middleware (HSTS/CSP/X-Frame-Options) exists anywhere.
  • No rate-limit Middleware exists anywhere.
    So the only ingress path has zero automated ban enforcement, no response hardening, and no rate limiting — logins sit behind app-level throttling only.

Verified

grep: only 3 Middleware objects exist (loki-basic-auth, docs redirect, crowdsec-bouncer[detached]); no headers/ratelimit anywhere; traefik helmrelease has no bouncer entrypoint wiring.

Fix

Add a security-headers + rate-limit middleware as entrypoint defaults (independent of the CrowdSec re-enable work).

Automated security review 2026-07-14. Verified.

## Finding - infrastructure/traefik/crowdsec-middleware.yaml exists but is not attached to any entrypoint/router (helmrelease has no additionalArguments wiring it). CrowdSec is detection-only since the 2026-06-27 IPv6 mass-ban outage. - No security-headers Middleware (HSTS/CSP/X-Frame-Options) exists anywhere. - No rate-limit Middleware exists anywhere. So the only ingress path has zero automated ban enforcement, no response hardening, and no rate limiting — logins sit behind app-level throttling only. ## Verified grep: only 3 Middleware objects exist (loki-basic-auth, docs redirect, crowdsec-bouncer[detached]); no headers/ratelimit anywhere; traefik helmrelease has no bouncer entrypoint wiring. ## Fix Add a security-headers + rate-limit middleware as entrypoint defaults (independent of the CrowdSec re-enable work). --- _Automated security review 2026-07-14. Verified._
claude-bot commented 2026-07-14 10:12:27 +00:00
Author
Member
Copy Link
Copy Source

Verified against origin/master (07c93e4): crowdsec-middleware.yaml exists and is detached, no security-headers Middleware, no rate-limit Middleware existed anywhere. Confirmed.

Fixed in PR #229 (branch fix/issue-205):

  • security-headers Middleware (HSTS, nosniff, xss-filter, referrer-policy, permissions-policy, conservative frame-ancestors 'self' CSP + X-Frame-Options SAMEORIGIN — not a strict default-src, since apps here span very different script/style/font needs).
  • rate-limit Middleware (100 req/s, burst 200), keyed off real client IP via sourceCriterion.ipStrategy.excludedIPs (same trusted pod CIDRs as forwardedHeaders/crowdsec-bouncer) so it doesn't collapse every external client onto one shared budget — avoids repeating the client-IP-visibility gap that caused the 2026-06-27 CrowdSec outage.
  • Both wired as websecure entrypoint defaults via helmrelease.yaml additionalArguments, same mechanism crowdsec-bouncer documents for its own re-enable.

CrowdSec enforcement re-enable is untouched, per the note in this issue — that stays off.

kubectl kustomize on kubernetes/infrastructure/traefik renders cleanly. PR: gitea_admin/homelab#229

Verified against origin/master (07c93e4): crowdsec-middleware.yaml exists and is detached, no security-headers Middleware, no rate-limit Middleware existed anywhere. Confirmed. Fixed in PR #229 (branch fix/issue-205): - security-headers Middleware (HSTS, nosniff, xss-filter, referrer-policy, permissions-policy, conservative frame-ancestors 'self' CSP + X-Frame-Options SAMEORIGIN — not a strict default-src, since apps here span very different script/style/font needs). - rate-limit Middleware (100 req/s, burst 200), keyed off real client IP via sourceCriterion.ipStrategy.excludedIPs (same trusted pod CIDRs as forwardedHeaders/crowdsec-bouncer) so it doesn't collapse every external client onto one shared budget — avoids repeating the client-IP-visibility gap that caused the 2026-06-27 CrowdSec outage. - Both wired as websecure entrypoint defaults via helmrelease.yaml additionalArguments, same mechanism crowdsec-bouncer documents for its own re-enable. CrowdSec enforcement re-enable is untouched, per the note in this issue — that stays off. kubectl kustomize on kubernetes/infrastructure/traefik renders cleanly. PR: https://gitea.renner.uno/gitea_admin/homelab/pulls/229
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#205