From e7f8d1f2276465ddb3fe3abd5eeea0cbff5cfaea Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sat, 5 Sep 2026 23:36:11 -0700 Subject: [PATCH] docs(mesh): ESH egress whitelisted in crowdsec (temporary, pending static IP) --- docs/pfi/headscale-mesh-plan.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md index 0740f88..a8e2a71 100644 --- a/docs/pfi/headscale-mesh-plan.md +++ b/docs/pfi/headscale-mesh-plan.md @@ -208,3 +208,10 @@ edge, blackholing Matrix/gitea/chat for the whole ESH site (see services over the mesh (100.64/10 via ana-scale) rather than the public FortiGate VIP, that traffic never reaches CrowdSec — a concrete win beyond replacing the tunnels, worth weighing when prioritising the cut-over. + +### 06:35Z — ESH egress whitelisted in CrowdSec (operator-directed, temporary) + +`/opt/docker/conf/crowdsec/postoverflows/s01-whitelist/pfi-esh-egress.yaml` (bind mount, +persists) whitelists 23.164.40.160; SIGHUP reload, `crowdsec -t` clean, parser loaded. +TEMPORARY — remove when ESH gets its static IP. crowdsec stack is NOT in stacks/ canonical +(only stacks-mirror), so this lives on the host; re-mirror with sync-stacks.sh.