From 9a684cfc2e52f6038c1979b24f5bdad1ce1450fe Mon Sep 17 00:00:00 2001
From: Viktor Liu <viktor@netbird.io>
Date: Mon, 23 Mar 2026 15:08:41 +0100
Subject: [PATCH] Add CrowdSec support to netbird-proxy helm chart

---
 charts/netbird-proxy/templates/deployment.yaml | 11 +++++++++++
 charts/netbird-proxy/templates/secret.yaml     |  3 +++
 charts/netbird-proxy/values.yaml               | 10 ++++++++++
 3 files changed, 24 insertions(+)

diff --git a/charts/netbird-proxy/templates/deployment.yaml b/charts/netbird-proxy/templates/deployment.yaml
index 71964e1..278d1b7 100644
--- a/charts/netbird-proxy/templates/deployment.yaml
+++ b/charts/netbird-proxy/templates/deployment.yaml
@@ -203,6 +203,17 @@ spec:
             - name: NB_PROXY_DEBUG_ENDPOINT_ADDRESS
               value: {{ .Values.debug.address | quote }}
             {{- end }}
+            {{- if .Values.crowdsec.apiUrl }}
+            - name: NB_PROXY_CROWDSEC_API_URL
+              value: {{ .Values.crowdsec.apiUrl | quote }}
+            {{- end }}
+            {{- if or .Values.crowdsec.apiKey .Values.crowdsec.existingSecret }}
+            - name: NB_PROXY_CROWDSEC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.crowdsec.existingSecret | default (include "netbird-proxy.fullname" .) }}
+                  key: crowdsec-api-key
+            {{- end }}
             {{- with .Values.extraEnv }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
diff --git a/charts/netbird-proxy/templates/secret.yaml b/charts/netbird-proxy/templates/secret.yaml
index 0cd4d93..63ea729 100644
--- a/charts/netbird-proxy/templates/secret.yaml
+++ b/charts/netbird-proxy/templates/secret.yaml
@@ -8,6 +8,9 @@ metadata:
 type: Opaque
 data:
   token: {{ .Values.proxyToken | b64enc | quote }}
+  {{- if and .Values.crowdsec.apiKey (not .Values.crowdsec.existingSecret) }}
+  crowdsec-api-key: {{ .Values.crowdsec.apiKey | b64enc | quote }}
+  {{- end }}
 {{- end }}
 ---
 {{- if and .Values.oidc.clientSecret (not .Values.oidc.existingOidcSecret) }}
diff --git a/charts/netbird-proxy/values.yaml b/charts/netbird-proxy/values.yaml
index ad8460c..027ea08 100644
--- a/charts/netbird-proxy/values.yaml
+++ b/charts/netbird-proxy/values.yaml
@@ -50,6 +50,16 @@ supportsCustomPorts: true
 # the cluster domain.
 requireSubdomain: false
 
+# -- CrowdSec IP reputation integration.
+crowdsec:
+  # -- CrowdSec LAPI URL. Empty disables CrowdSec.
+  apiUrl: ""
+  # -- Bouncer API key. Empty disables CrowdSec.
+  apiKey: ""
+  # -- Use an existing Secret for the CrowdSec bouncer API key.
+  # The secret must contain a key named "crowdsec-api-key".
+  existingSecret: ""
+
 # -- Use host networking. Required for TCP/UDP service passthrough in
 # Kubernetes, since dynamically bound ports cannot be declared in the
 # Service manifest. When enabled, the container shares the host's