vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(mesh): ESH egress whitelisted in crowdsec (temporary, pending static IP)

Browse Source
This commit is contained in:
Vuong Hoang
2026-09-05 23:36:11 -07:00
parent e88ec01726
commit e7f8d1f227
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pfi/headscale-mesh-plan.md
+7
View File
@@ -208,3 +208,10 @@ edge, blackholing Matrix/gitea/chat for the whole ESH site (see
services over the mesh (100.64/10 via ana-scale) rather than the public FortiGate VIP,
that traffic never reaches CrowdSec — a concrete win beyond replacing the tunnels, worth
weighing when prioritising the cut-over.
### 06:35Z — ESH egress whitelisted in CrowdSec (operator-directed, temporary)
`/opt/docker/conf/crowdsec/postoverflows/s01-whitelist/pfi-esh-egress.yaml` (bind mount,
persists) whitelists 23.164.40.160; SIGHUP reload, `crowdsec -t` clean, parser loaded.
TEMPORARY — remove when ESH gets its static IP. crowdsec stack is NOT in stacks/ canonical
(only stacks-mirror), so this lives on the host; re-mirror with sync-stacks.sh.