search

crowdsecurity / cs-cloudflare-worker-bouncer

A CrowdSec Bouncer that syncs the decisions made by CrowdSec with CloudFlare's firewall using cloudflare workers. Manages multi user, multi account, multi zone setup. Supports IP, Country and AS scoped decisions.
https://doc.crowdsec.net/docs/next/bouncers/cloudflare-workers
MIT License
3 stars 6 forks source link

Bouncer generates/deletes workers & routes on a loop #33

Closed Staene closed 6 months ago

Staene commented 6 months ago

Hi,

I am on a paid Workers plan. I followed the setup guide last night and installed the bouncer.

If I run crowdsec-cloudflare-worker-bouncer -s, it does everything correctly. I log in, my worker is there as are all my routes.

If I run systemctl start crowdsec-cloudflare-worker-bouncer, the bouncer turns on, deletes the worker and routes, creates them again, and then 10 seconds later does it all over. It's on an endless loop of creating and deleting the worker & routes.

Here's the loop from the bouncer's log — there are no errors.

time="02-05-2024 08:00:13" level=info msg="Done cleaning up existing workers" account=redacted time="02-05-2024 07:59:48" level=info msg="Cleaning up existing workers" account=redacted time="02-05-2024 07:59:46" level=info msg="Done creating turnstile widget" account=redacted zone=redacted time="02-05-2024 07:59:44" level=info msg="Adding 24731 decisions" account=redacted time="02-05-2024 07:59:44" level=info msg="Received 24731 new decisions" time="02-05-2024 07:59:44" level=info msg="Received 3 deleted decisions" time="02-05-2024 07:59:44" level=info msg="Done creating turnstile widget" account=redacted zone=redacted time="02-05-2024 07:59:44" level=info msg="Creating turnstile widget" account=redacted zone=redacted time="02-05-2024 07:59:44" level=info msg="Successfully deployed infra for all accounts" time="02-05-2024 07:59:44" level=info msg="Successfully deployed infra for account redacted" time="02-05-2024 07:59:44" level=info msg="Binded worker to route redacted.com/" account=redacted zone=redacted time="02-05-2024 07:59:40" level=info msg="Binding worker to route redacted.com/" account=redacted zone=redacted time="02-05-2024 07:59:38" level=info msg="Creating worker crowdsec-cloudflare-worker-bouncer" account=redacted time="02-05-2024 07:59:37" level=info msg="Creating KVNS CROWDSECCFBOUNCERNS" account=redacted time="02-05-2024 07:59:37" level=info msg="Done cleaning up existing workers" account=redacted time="02-05-2024 07:59:30" level=info msg="Cleaning up existing workers" account=redacted time="02-05-2024 07:59:29" level=info msg="Using API key auth" time="02-05-2024 07:59:29" level=info msg="config is valid" time="02-05-2024 07:59:29" level=info msg="Using API key auth"

Staene commented 6 months ago

Through trial and error, I learned that a zone without an A/AAAA record had to have been causing this loop. Marking as closed.