From 0dea324551922dc5e81bdc8ed51f9b0d93dd3330 Mon Sep 17 00:00:00 2001 From: tommy Date: Tue, 30 Jun 2026 22:41:35 -0500 Subject: [PATCH] traefik: de-secret CrowdSec LAPI key -> crowdsecLapiKeyFile (rotated) Old bouncer key was committed in cleartext (hist 7fac4fc) and is now rotated (new traefik-bouncer-v2 + old bouncer deleted, verified 200 on both nodes). Config now references /plugins-storage/crowdsec_lapi_key (mode-600, gitignored, lives only on the nodes). Old key in history is inert post-rotation. Co-Authored-By: Claude Opus 4.8 --- .gitignore | 1 + traefik/dynamic_conf_node01.yml | 2 +- traefik/dynamic_conf_node02.yml | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index ff4c2c3..6bedc3a 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ secrets.*.yaml credentials *credentials* *.secret +crowdsec_lapi_key diff --git a/traefik/dynamic_conf_node01.yml b/traefik/dynamic_conf_node01.yml index 030b26a..7d9873e 100644 --- a/traefik/dynamic_conf_node01.yml +++ b/traefik/dynamic_conf_node01.yml @@ -79,7 +79,7 @@ http: plugin: crowdsec-bouncer: enabled: true - crowdsecLapiKey: VMCnws/j+9pmsT4YT+t3HzrvX8OhBCwoquwo4NqWJPs + crowdsecLapiKeyFile: /plugins-storage/crowdsec_lapi_key crowdsecLapiHost: crowdsec:8080 crowdsecMode: live diff --git a/traefik/dynamic_conf_node02.yml b/traefik/dynamic_conf_node02.yml index c3fe8ac..3d0a22a 100644 --- a/traefik/dynamic_conf_node02.yml +++ b/traefik/dynamic_conf_node02.yml @@ -79,7 +79,7 @@ http: plugin: crowdsec-bouncer: enabled: true - crowdsecLapiKey: VMCnws/j+9pmsT4YT+t3HzrvX8OhBCwoquwo4NqWJPs + crowdsecLapiKeyFile: /plugins-storage/crowdsec_lapi_key crowdsecLapiHost: 192.168.99.186:8081 crowdsecMode: live