secubox-deb/secubox-threatfeed.service at 0a05bed0280b72544b18ef637f1c94eecb00770d - secubox-deb - Gitea: Git with a cup of tea

secubox/secubox-deb

mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00

CyberMind-FR fdfc404818 feat(threatmesh): sovereign threat-intel — feeds + mesh + API, drop CrowdSec CAPI (#728 )

Phase 0 (board): CrowdSec online_client/CAPI disabled, LAPI kept.
Phase 1: secubox-threatfeed timer pulls 8 free public blocklists
  (feodo/sslbl/firehol/spamhaus-drop/blocklist.de/cins/et/dshield) ->
  shared threat_intel -> secubox-blacklist-sync -> nft. ~45k IOCs live.
Phase 2: secubox-threatmesh service gossips locally-detected CrowdSec decisions
  to SecuBox P2P peers over WireGuard + ingests peer decisions (mesh:<node>,
  consensus-counted); :8780 locked to wg*/lo by an nft drop-in.
Phase 3: /status /peers /decisions (bouncer-compatible aggregate) /mesh/ingest
  + C3BOX dashboard (sovereign mode). No CAPI, no account, no paywall.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-24 13:59:59 +02:00

13 lines

275 B

Desktop File

Raw Blame History

 [Unit]
 Description=SecuBox ThreatFeed — pull free public blocklists into threat_intel (#728)
 After=network-online.target
 Wants=network-online.target
 [Service]
 Type=oneshot
 User=root
 ExecStart=/usr/sbin/secubox-threatfeed
 Nice=10
 IOSchedulingClass=idle
 TimeoutStartSec=600