{
  "id": "crowdsec-bouncer",
  "name": "CrowdSec Firewall Bouncer",
  "category": "security",
  "runtime": "native",
  "maturity": "stable",
  "description": "nftables-based firewall bouncer that automatically blocks malicious IPs from CrowdSec decisions.",
  "source": {
    "homepage": "https://crowdsec.net/",
    "github": "https://github.com/crowdsecurity/cs-firewall-bouncer"
  },
  "packages": [
    "secubox-app-crowdsec-bouncer",
    "crowdsec-firewall-bouncer"
  ],
  "capabilities": [
    "ip-blocking",
    "firewall-integration",
    "nftables"
  ],
  "requirements": {
    "arch": [
      "arm64",
      "armv7",
      "x86_64",
      "mipsel"
    ],
    "min_ram_mb": 32,
    "min_storage_mb": 10
  },
  "dependencies": [
    "crowdsec"
  ],
  "hardware": {
    "usb": false,
    "serial": false
  },
  "network": {
    "inbound_ports": [],
    "protocols": [],
    "outbound_only": true
  },
  "privileges": {
    "needs_usb": false,
    "needs_serial": false,
    "needs_net_admin": true
  },
  "update": {
    "strategy": "opkg"
  },
  "wizard": {
    "uci": {
      "config": "crowdsec",
      "section": "bouncer"
    },
    "fields": [
      {
        "id": "enabled",
        "label": "Enable Bouncer",
        "type": "checkbox",
        "uci_option": "enabled",
        "description": "Enable the firewall bouncer to block malicious IPs",
        "default": "0"
      },
      {
        "id": "ipv4",
        "label": "Enable IPv4 Blocking",
        "type": "checkbox",
        "uci_option": "ipv4",
        "description": "Block IPv4 addresses",
        "default": "1"
      },
      {
        "id": "ipv6",
        "label": "Enable IPv6 Blocking",
        "type": "checkbox",
        "uci_option": "ipv6",
        "description": "Block IPv6 addresses",
        "default": "1"
      },
      {
        "id": "deny_action",
        "label": "Deny Action",
        "type": "select",
        "uci_option": "deny_action",
        "description": "Action to take when blocking IPs",
        "options": [
          {"value": "drop", "label": "Drop (silent)"},
          {"value": "reject", "label": "Reject (with response)"},
          {"value": "tarpit", "label": "Tarpit (slow response)"}
        ],
        "default": "drop"
      },
      {
        "id": "deny_log",
        "label": "Log Blocked Connections",
        "type": "checkbox",
        "uci_option": "deny_log",
        "description": "Log blocked connections to syslog",
        "default": "1"
      },
      {
        "id": "update_frequency",
        "label": "Update Frequency",
        "type": "select",
        "uci_option": "update_frequency",
        "description": "How often to check for new decisions",
        "options": [
          {"value": "10s", "label": "10 seconds (recommended)"},
          {"value": "30s", "label": "30 seconds"},
          {"value": "1m", "label": "1 minute"},
          {"value": "5m", "label": "5 minutes"}
        ],
        "default": "10s"
      },
      {
        "id": "filter_input",
        "label": "Filter INPUT Chain",
        "type": "checkbox",
        "uci_option": "filter_input",
        "description": "Apply blocking to incoming traffic",
        "default": "1"
      },
      {
        "id": "filter_forward",
        "label": "Filter FORWARD Chain",
        "type": "checkbox",
        "uci_option": "filter_forward",
        "description": "Apply blocking to forwarded traffic",
        "default": "1"
      }
    ]
  },
  "profiles": {
    "recommended": [
      "gateway",
      "smb",
      "lab"
    ]
  },
  "actions": {
    "status": "/etc/init.d/crowdsec-firewall-bouncer status",
    "install": "cscli bouncers add crowdsec-firewall-bouncer -o raw 2>/dev/null || true"
  }
}
