From b465377760dde6cd23e8976bda54d087b572ae4c Mon Sep 17 00:00:00 2001
From: Marco Mariani <marco@crowdsec.net>
Date: Thu, 1 Jun 2023 14:35:21 +0200
Subject: [PATCH] crowdsec: update 1.0.6 - correct option to detect changes
 from symlinks

---
 security/crowdsec/+POST_INSTALL.post                         | 3 +++
 security/crowdsec/Makefile                                   | 2 +-
 security/crowdsec/pkg-descr                                  | 5 +++++
 security/crowdsec/src/etc/crowdsec/acquis.d/opnsense.yaml    | 4 ++++
 .../opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml    | 2 +-
 .../opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt    | 5 +++++
 6 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/security/crowdsec/+POST_INSTALL.post b/security/crowdsec/+POST_INSTALL.post
index 4c5abec40..fd090d0dc 100755
--- a/security/crowdsec/+POST_INSTALL.post
+++ b/security/crowdsec/+POST_INSTALL.post
@@ -1,3 +1,6 @@
 #!/bin/sh
 
 configctl crowdsec reconfigure
+
+# apply new configuration immediately, don't wait for hub updates
+service crowdsec reload >/dev/null 2>&1 || :
diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile
index 161f3870d..ca8b22e79 100644
--- a/security/crowdsec/Makefile
+++ b/security/crowdsec/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		crowdsec
-PLUGIN_VERSION=		1.0.5
+PLUGIN_VERSION=		1.0.6
 PLUGIN_DEPENDS=		crowdsec
 PLUGIN_COMMENT=		Lightweight and collaborative security engine
 PLUGIN_MAINTAINER=	marco@crowdsec.net
diff --git a/security/crowdsec/pkg-descr b/security/crowdsec/pkg-descr
index 48e83b5ea..8d635b67c 100644
--- a/security/crowdsec/pkg-descr
+++ b/security/crowdsec/pkg-descr
@@ -8,6 +8,11 @@ WWW: https://crowdsec.net/
 Plugin Changelog
 ================
 
+1.0.6
+
+ * default acquis.d/opnsense.yaml to "poll_without_inotify=true" which is now required
+   to acquire content from symlinks.
+
 1.0.5
 
 * fix ban example
diff --git a/security/crowdsec/src/etc/crowdsec/acquis.d/opnsense.yaml b/security/crowdsec/src/etc/crowdsec/acquis.d/opnsense.yaml
index 7867ccdae..98ec286d5 100644
--- a/security/crowdsec/src/etc/crowdsec/acquis.d/opnsense.yaml
+++ b/security/crowdsec/src/etc/crowdsec/acquis.d/opnsense.yaml
@@ -24,5 +24,9 @@ filenames:
 # but the option works with both.
 force_inotify: true
 
+# this option is required from crowdsec v1.5.0 to follow
+# changes in symlinks
+poll_without_inotify: true
+
 labels:
   type: syslog
diff --git a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
index 71e67aa4c..4349222b6 100644
--- a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
+++ b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
@@ -1,7 +1,7 @@
 <model>
   <mount>//OPNsense/crowdsec/general</mount>
   <description>CrowdSec general configuration</description>
-  <version>1.0.5</version>
+  <version>1.0.6</version>
   <items>
 
     <agent_enabled type="BooleanField">
diff --git a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
index 733130940..9a0076933 100644
--- a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
+++ b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
@@ -77,6 +77,11 @@
         <p>A few remarks:</p>
 
         <ul>
+            <li>
+                New acquisition files go under <code>/usr/local/etc/crowdsec/acquis.d</code>. See opnsense.yaml for details.
+                The option <code>poll_without_inotify: true</code> is required if the acquitision targets are symlinks (which
+                is the case for most opnsense logs).
+            </li>
             <li>
                 If your OPNsense is &lt;22.1, you must check "Disable circular logs" in the Settings menu for the
                 ssh and web-auth parsers to work. If you upgrade to 22.1, it will be done automatically.