From 5c6786231f47ae28a5652b62dd89421ba79f3ddf Mon Sep 17 00:00:00 2001
From: Junwei Zhao <wahyd4@gmail.com>
Date: Wed, 1 Apr 2026 19:54:01 +1100
Subject: [PATCH] Update auto ban

---
 adhoc-config/crowdsec-nginx-sync.yaml | 16 ++++++++++++++--
 ip.sh                                 | 23 +++++++++++++++++++++++
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/adhoc-config/crowdsec-nginx-sync.yaml b/adhoc-config/crowdsec-nginx-sync.yaml
index 18ef830..e2c5a06 100644
--- a/adhoc-config/crowdsec-nginx-sync.yaml
+++ b/adhoc-config/crowdsec-nginx-sync.yaml
@@ -99,13 +99,25 @@ spec:
                     sed 's/,$//')
 
                   echo "Active ban count: $(echo "$RAW" | tail -n +2 | grep -c '.' || echo 0)"
-                  echo "Blocked CIDRs: ${CIDRS:-<none>}"
+
+                  # Read any manually managed IPs from block-cidrs-manual key in the same ConfigMap.
+                  # Edit that key to permanently block IPs that CrowdSec won't remove.
+                  MANUAL=$(kubectl get configmap ingress-nginx-controller \
+                    -n ingress-nginx \
+                    -o jsonpath='{.data.block-cidrs-manual}' 2>/dev/null || true)
+
+                  # Merge CrowdSec bans + manual list, deduplicate
+                  ALL=$(printf '%s,%s' "$CIDRS" "$MANUAL" | tr ',' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
+
+                  echo "CrowdSec bans: ${CIDRS:-<none>}"
+                  echo "Manual bans:   ${MANUAL:-<none>}"
+                  echo "Merged total:  ${ALL:-<none>}"
 
                   # Patch the NGINX Ingress ConfigMap (JSON merge patch — only updates block-cidrs)
                   kubectl patch configmap ingress-nginx-controller \
                     -n ingress-nginx \
                     --type merge \
-                    -p "{\"data\":{\"block-cidrs\":\"${CIDRS}\"}}"
+                    -p "{\"data\":{\"block-cidrs\":\"${ALL}\"}}"
 
                   echo "ConfigMap patched successfully"
               resources:
diff --git a/ip.sh b/ip.sh
index fb54638..907996a 100644
--- a/ip.sh
+++ b/ip.sh
@@ -16,3 +16,26 @@ sudo netplan apply
 
 # Check DNS servers
 resolvectl status
+
+## Block IP
+
+# Ban a single IP for 1 year
+kubectl exec -n crowdsec deployment/crowdsec-lapi -- \
+  cscli decisions add --ip 1.2.3.4 --duration 8760h --reason "manual-ban"
+
+# Ban a subnet
+kubectl exec -n crowdsec deployment/crowdsec-lapi -- \
+  cscli decisions add --range 1.2.3.0/24 --duration 8760h --reason "manual-ban"
+
+# List all active decisions (including manual ones)
+kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli decisions list
+
+# Remove a manual ban
+kubectl exec -n crowdsec deployment/crowdsec-lapi -- \
+  cscli decisions delete --ip 1.2.3.4
+
+
+# # Add IPs (comma-separated, supports CIDRs)
+kubectl patch configmap ingress-nginx-controller -n ingress-nginx \
+  --type merge \
+  -p '{"data":{"block-cidrs-manual":"1.2.3.4,5.6.7.0/24"}}'