diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile
index a039bb0c7..1d6d54f33 100644
--- a/security/crowdsec/Makefile
+++ b/security/crowdsec/Makefile
@@ -1,6 +1,5 @@
PLUGIN_NAME= crowdsec
-PLUGIN_VERSION= 1.0.11
-PLUGIN_REVISION= 1
+PLUGIN_VERSION= 1.0.12
PLUGIN_DEPENDS= crowdsec
PLUGIN_COMMENT= Lightweight and collaborative security engine
PLUGIN_MAINTAINER= marco@crowdsec.net
diff --git a/security/crowdsec/pkg-descr b/security/crowdsec/pkg-descr
index b4f861897..6547b151f 100644
--- a/security/crowdsec/pkg-descr
+++ b/security/crowdsec/pkg-descr
@@ -8,6 +8,10 @@ WWW: https://crowdsec.net/
Plugin Changelog
================
+1.0.12
+
+ * Fix and update service management (start/stop/reload/configure)
+
1.0.11
* convert tables to UIBootGrid (required for opnsense 25.7)
diff --git a/security/crowdsec/src/etc/rc.d/oscrowdsec b/security/crowdsec/src/etc/rc.d/oscrowdsec
index 0d310efd6..87a34c703 100755
--- a/security/crowdsec/src/etc/rc.d/oscrowdsec
+++ b/security/crowdsec/src/etc/rc.d/oscrowdsec
@@ -53,6 +53,10 @@ oscrowdsec_status () {
service crowdsec status
ret=$?
+ if ! service crowdsec_firewall enabled; then
+ return $ret
+ fi
+
if ! service crowdsec_firewall status; then
ret=1
fi
diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ServiceController.php b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ServiceController.php
index 40403a915..f1918a01b 100644
--- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ServiceController.php
+++ b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/Api/ServiceController.php
@@ -5,76 +5,40 @@
namespace OPNsense\CrowdSec\Api;
-use OPNsense\Base\ApiControllerBase;
+use OPNsense\Base\ApiMutableServiceControllerBase;
use OPNsense\Core\Backend;
/**
* Class ServiceController
* @package OPNsense\CrowdSec
*/
-class ServiceController extends ApiControllerBase
+class ServiceController extends ApiMutableServiceControllerBase
{
- /**
- * reconfigure CrowdSec
- *
- * @return array Status result
- */
- public function reloadAction(): array
- {
- $status = "failed";
- if ($this->request->isPost()) {
- $backend = new Backend();
- $bckresult = trim($backend->configdRun('template reload OPNsense/CrowdSec'));
- if ($bckresult == "OK") {
- $bckresult = trim($backend->configdRun('crowdsec reconfigure'));
- if ($bckresult == "OK") {
- $status = "ok";
- }
- }
- }
- return ["status" => $status];
+ protected static $internalServiceClass = '\OPNsense\CrowdSec\General';
+ protected static $internalServiceTemplate = 'OPNsense/CrowdSec';
+ protected static $internalServiceName = 'crowdsec';
+
+ protected function ServiceEnabled() {
+ $mdl = $this->getModel();
+
+ return (
+ $mdl->agent_enabled->__toString() === "1" ||
+ $mdl->lapi_enabled->__toString() === "1" ||
+ $mdl->firewall_bouncer_enabled->__toString() === "1"
+ );
}
- /**
- * Retrieve status of crowdsec
- *
- * @return array{
- * status: string,
- * crowdsec-status: string,
- * crowdsec-firewall-status: string
- * }
- * @throws \Exception
- */
- public function statusAction()
+ public function reconfigureAction()
{
- $backend = new Backend();
- $response = $backend->configdRun("crowdsec crowdsec-status");
+ // Run the default reconfigure logic
+ $result = parent::reconfigureAction();
- $crowdsec_status = "unknown";
- if (strpos($response, "not running") !== false) {
- $crowdsec_status = "stopped";
- } elseif (strpos($response, "is running") !== false) {
- $crowdsec_status = "running";
+ // Now we generate the config.yaml and config-firewall-bouncer.yaml files
+ if (isset($result['status']) && $result['status'] === 'ok') {
+ $backend = new Backend();
+ $backend->configdRun('crowdsec reconfigure');
}
- $response = $backend->configdRun("crowdsec crowdsec-firewall-status");
-
- $firewall_status = "unknown";
- if (strpos($response, "not running") !== false) {
- $firewall_status = "stopped";
- } elseif (strpos($response, "is running") !== false) {
- $firewall_status = "running";
- }
-
- $status = "unknown";
- if ($crowdsec_status == $firewall_status) {
- $status = $crowdsec_status;
- }
-
- return [
- "status" => $status,
- "crowdsec-status" => $crowdsec_status,
- "crowdsec-firewall-status" => $firewall_status,
- ];
+ return $result;
}
}
diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml
index 849e04eba..c4480f9f7 100644
--- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml
+++ b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml
@@ -80,7 +80,7 @@
checkbox
Generate block rules from the Crowdsec blocklists.
- They are applied t all interfaces, ipv4/v6, ingress and egress.
+ They are applied to all interfaces, ipv4/v6, ingress and egress.
If you disable this, you'll have to write your own rules to block anything.
diff --git a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
index 63cf526f1..cef04eb0c 100644
--- a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
+++ b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
@@ -1,7 +1,7 @@
//OPNsense/crowdsec/general
CrowdSec general configuration
- 1.0.11
+ 1.0.12
diff --git a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
index be347ee53..95b257727 100644
--- a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
+++ b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
@@ -13,7 +13,7 @@
saveFormToEndpoint(url="/api/crowdsec/general/set",formid='frm_GeneralSettings',callback_ok=function(){
$("#settingsSavedMsg").text("Saving settings....").removeClass("hidden");
// action to run after successful save, for example reconfigure service.
- ajaxCall(url="/api/crowdsec/service/reload", sendData={},callback=function(data,status) {
+ ajaxCall(url="/api/crowdsec/service/reconfigure", sendData={},callback=function(data,status) {
$("#settingsSavedMsg").html(
' Settings have been saved, services restarted.'
).removeClass("hidden");
diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py
index fa0670092..6d4869c5b 100755
--- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py
+++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.py
@@ -13,6 +13,7 @@ logging.basicConfig(level=logging.INFO)
def is_ipv6(ip: str) -> bool:
return ":" in ip
+
def load_config(filename: str) -> dict[str, Any]:
with open(filename) as fin:
return yaml.safe_load(fin)
@@ -54,6 +55,9 @@ def configure_agent(settings: dict[str, str]):
config['crowdsec_service']['acquisition_dir'] = '/usr/local/etc/crowdsec/acquis.d/'
config['db_config']['use_wal'] = True
+ enable = int(settings.get('agent_enabled', '0'))
+ config['crowdsec_service']['enable'] = bool(enable)
+
if not int(settings.get('lapi_manual_configuration', '0')):
config['api']['server']['listen_uri'] = get_netloc(settings)
diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh
index ce4660c50..9ecdd3f8e 100755
--- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh
+++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/reconfigure.sh
@@ -2,7 +2,7 @@
# This script is run
# - when the plugin is installed (by +POST_INSTALL.post)
-# - when saving the "settings" form (which calls /api/crowdsec/service/reload)
+# - when saving the "settings" form (which calls /api/crowdsec/service/reconfigure)
# - by hand, running "configctl crowdsec reconfigure"
set -e
diff --git a/security/crowdsec/src/opnsense/service/templates/OPNsense/CrowdSec/crowdsec.rc.conf.d b/security/crowdsec/src/opnsense/service/templates/OPNsense/CrowdSec/crowdsec.rc.conf.d
index 6c0f4e941..de9a90fad 100644
--- a/security/crowdsec/src/opnsense/service/templates/OPNsense/CrowdSec/crowdsec.rc.conf.d
+++ b/security/crowdsec/src/opnsense/service/templates/OPNsense/CrowdSec/crowdsec.rc.conf.d
@@ -1,5 +1,9 @@
# DO NOT EDIT THIS FILE -- OPNsense auto-generated file
-{% if helpers.exists('OPNsense.crowdsec.general.agent_enabled') and OPNsense.crowdsec.general.agent_enabled|default("1") == "1" %}
+{% if
+ (helpers.exists('OPNsense.crowdsec.general.agent_enabled') and OPNsense.crowdsec.general.agent_enabled|default("1") == "1")
+ or
+ (helpers.exists('OPNsense.crowdsec.general.lapi_enabled') and OPNsense.crowdsec.general.lapi_enabled|default("1") == "1")
+%}
crowdsec_enable="YES"
{% else %}
crowdsec_enable="NO"