security/crowdsec: refactor service management, bump version (#4868)

* crowdsec: refactor service management

* allow disabling agent or lapi separately

security/crowdsec/Makefile

@@ -1,6 +1,5 @@
 PLUGIN_NAME=		crowdsec
-PLUGIN_VERSION=		1.0.11
-PLUGIN_REVISION=	1
+PLUGIN_VERSION=		1.0.12
 PLUGIN_DEPENDS=		crowdsec
 PLUGIN_COMMENT=		Lightweight and collaborative security engine
 PLUGIN_MAINTAINER=	marco@crowdsec.net

security/crowdsec/pkg-descr

@@ -8,6 +8,10 @@ WWW: https://crowdsec.net/
 Plugin Changelog
 ================
 
+1.0.12
+
+ * Fix and update service management (start/stop/reload/configure)
+
 1.0.11
 
 * convert tables to UIBootGrid (required for opnsense 25.7)

security/crowdsec/src/etc/rc.d/oscrowdsec

@@ -53,6 +53,10 @@ oscrowdsec_status () {
     service crowdsec status
     ret=$?
 
+    if ! service crowdsec_firewall enabled; then
+        return $ret
+    fi
+
     if ! service crowdsec_firewall status; then
         ret=1
     fi

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ServiceController.php

@@ -5,76 +5,40 @@
 
 namespace OPNsense\CrowdSec\Api;
 
-use OPNsense\Base\ApiControllerBase;
+use OPNsense\Base\ApiMutableServiceControllerBase;
 use OPNsense\Core\Backend;
 
 /**
  * Class ServiceController
  * @package OPNsense\CrowdSec
  */
-class ServiceController extends ApiControllerBase
+class ServiceController extends ApiMutableServiceControllerBase
 {
-    /**
-     * reconfigure CrowdSec
-     *
-     * @return array Status result
-     */
-    public function reloadAction(): array
-    {
-        $status = "failed";
-        if ($this->request->isPost()) {
-            $backend = new Backend();
-            $bckresult = trim($backend->configdRun('template reload OPNsense/CrowdSec'));
-            if ($bckresult == "OK") {
-                $bckresult = trim($backend->configdRun('crowdsec reconfigure'));
-                if ($bckresult == "OK") {
-                    $status = "ok";
-                }
-            }
-        }
-        return ["status" => $status];
+    protected static $internalServiceClass = '\OPNsense\CrowdSec\General';
+    protected static $internalServiceTemplate = 'OPNsense/CrowdSec';
+    protected static $internalServiceName = 'crowdsec';
+
+    protected function ServiceEnabled() {
+        $mdl = $this->getModel();
+
+        return (
+            $mdl->agent_enabled->__toString() === "1" ||
+            $mdl->lapi_enabled->__toString() === "1" ||
+            $mdl->firewall_bouncer_enabled->__toString() === "1"
+        );
     }
 
-    /**
-     * Retrieve status of crowdsec
-     *
-     * @return array{
-     *     status: string,
-     *     crowdsec-status: string,
-     *     crowdsec-firewall-status: string
-     * }
-     * @throws \Exception
-     */
-    public function statusAction()
+    public function reconfigureAction()
     {
-        $backend = new Backend();
-        $response = $backend->configdRun("crowdsec crowdsec-status");
+        // Run the default reconfigure logic
+        $result = parent::reconfigureAction();
 
-        $crowdsec_status = "unknown";
-        if (strpos($response, "not running") !== false) {
-            $crowdsec_status = "stopped";
-        } elseif (strpos($response, "is running") !== false) {
-            $crowdsec_status = "running";
+        // Now we generate the config.yaml and config-firewall-bouncer.yaml files
+        if (isset($result['status']) && $result['status'] === 'ok') {
+            $backend = new Backend();
+            $backend->configdRun('crowdsec reconfigure');
         }
 
-        $response = $backend->configdRun("crowdsec crowdsec-firewall-status");
-
-        $firewall_status = "unknown";
-        if (strpos($response, "not running") !== false) {
-            $firewall_status = "stopped";
-        } elseif (strpos($response, "is running") !== false) {
-            $firewall_status = "running";
-        }
-
-        $status = "unknown";
-        if ($crowdsec_status == $firewall_status) {
-            $status = $crowdsec_status;
-        }
-
-        return [
-            "status" => $status,
-            "crowdsec-status" => $crowdsec_status,
-            "crowdsec-firewall-status" => $firewall_status,
-        ];
+        return $result;
     }
 }

security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml

@@ -80,7 +80,7 @@
     <label>Create blocklist rules</label>
     <type>checkbox</type>
     <help>Generate block rules from the Crowdsec blocklists.
-    They are applied t all interfaces, ipv4/v6, ingress and egress.
+    They are applied to all interfaces, ipv4/v6, ingress and egress.
     If you disable this, you'll have to write your own rules to block anything.</help>
   </field>
 

security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml

@@ -1,7 +1,7 @@
 <model>
   <mount>//OPNsense/crowdsec/general</mount>
   <description>CrowdSec general configuration</description>
-  <version>1.0.11</version>
+  <version>1.0.12</version>
   <items>
 
     <agent_enabled type="BooleanField">

security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt

@@ -13,7 +13,7 @@
             saveFormToEndpoint(url="/api/crowdsec/general/set",formid='frm_GeneralSettings',callback_ok=function(){
                 $("#settingsSavedMsg").text("Saving settings....").removeClass("hidden");
                 // action to run after successful save, for example reconfigure service.
-                ajaxCall(url="/api/crowdsec/service/reload", sendData={},callback=function(data,status) {
+                ajaxCall(url="/api/crowdsec/service/reconfigure", sendData={},callback=function(data,status) {
                     $("#settingsSavedMsg").html(
                         '<i class="fa fa-check text-success"></i> Settings have been saved, services restarted.'
                     ).removeClass("hidden");

security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py

@@ -13,6 +13,7 @@ logging.basicConfig(level=logging.INFO)
 def is_ipv6(ip: str) -> bool:
     return ":" in ip
 
+
 def load_config(filename: str) -> dict[str, Any]:
     with open(filename) as fin:
         return yaml.safe_load(fin)
@@ -54,6 +55,9 @@ def configure_agent(settings: dict[str, str]):
     config['crowdsec_service']['acquisition_dir'] = '/usr/local/etc/crowdsec/acquis.d/'
     config['db_config']['use_wal'] = True
 
+    enable = int(settings.get('agent_enabled', '0'))
+    config['crowdsec_service']['enable'] = bool(enable)
+
     if not int(settings.get('lapi_manual_configuration', '0')):
         config['api']['server']['listen_uri'] = get_netloc(settings)
 

security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh

@@ -2,7 +2,7 @@
 
 # This script is run
 #  - when the plugin is installed (by +POST_INSTALL.post)
-#  - when saving the "settings" form (which calls /api/crowdsec/service/reload)
+#  - when saving the "settings" form (which calls /api/crowdsec/service/reconfigure)
 #  - by hand, running "configctl crowdsec reconfigure"
 
 set -e

security/crowdsec/src/opnsense/service/templates/OPNsense/CrowdSec/crowdsec.rc.conf.d

@@ -1,5 +1,9 @@
 # DO NOT EDIT THIS FILE -- OPNsense auto-generated file
-{% if helpers.exists('OPNsense.crowdsec.general.agent_enabled') and OPNsense.crowdsec.general.agent_enabled|default("1") == "1" %}
+{% if
+  (helpers.exists('OPNsense.crowdsec.general.agent_enabled') and OPNsense.crowdsec.general.agent_enabled|default("1") == "1")
+  or
+  (helpers.exists('OPNsense.crowdsec.general.lapi_enabled') and OPNsense.crowdsec.general.lapi_enabled|default("1") == "1")
+%}
 crowdsec_enable="YES"
 {% else %}
 crowdsec_enable="NO"