Update to 2021-02-17 12:00

roles/crowdsec/defaults/main.yml

@@ -36,8 +36,6 @@ crowdsec_lapi_server: "{{ inventory_hostname }}"
 # Requires crowdsec_lapi_enabled to be true too
 crowdsec_capi_enabled: False
 
-# Prometheus metrics
-crowdsec_prometheus_enabled: False
 # Port on which the prometheus metric endpoint will bind to
 crowdsec_prometheus_port: 6060
 # List of IP/CIDR allowed to access the prometheus port

roles/crowdsec/templates/config.yaml.j2

@@ -48,11 +48,9 @@ api:
 {% endif %}
 {% endif %}
 
-{% if crowdsec_prometheus_enabled %}
 prometheus:
   enabled: true
   level: full
-  listen_addr: 0.0.0.0
+  listen_addr: {{ (crowdsec_prometheus_src_ip | length > 0) | ternary(ansible_all_ipv4_addresses[0],'127.0.0.1') }}
   listen_port: {{ crowdsec_prometheus_port }}
-{% endif %}
 

roles/crowdsec_bouncer_firewall/tasks/install.yml

@@ -31,10 +31,12 @@
   copy:
     content: |
       [Unit]
+      {% if ansible_os_family == 'RedHat' or ansible_os_family == 'Debian' %}
       # Ensure cs-firewall-bouncer starts before iptables
       # so ipset are available
-      Before=iptables.service
-      # But it should start after crowdsec to be able to register on the API
+      Before={{ (ansible_os_family == 'Debian') | ternary('netfilter-persistent','iptables') }}.service
+      {% endif %}
+      # It should start after crowdsec to be able to register on the API
       After=crowdsec.service
 
       [Service]

roles/squid/files/acl/service_various.domains

@@ -3,3 +3,4 @@
 apps.identrust.com
 dns.api.gandi.net
 monip.org
+

roles/squid/files/acl/software_various.domains

@@ -343,3 +343,7 @@ downloads.sentry-cdn.com
 
 # iTop cmd extension store
 store.itophub.io
+
+# Crowdsec
+crowdsec-statics-assets.s3-eu-west-1.amazonaws.com
+api.crowdsec.com