Skip to content

v1.3.39.1 -- Out-of-band bans counted, 1 % gate

Patch on v1.3.39.0. argosVersion 1.3.39.0 -> 1.3.39.1. Panel only; no schema, nothing in the blocking path.

What ships

  • looksLikeAppSec accepts the crowdsecurity/crowdsec-appsec- prefix. The out-of-band ban scenario (crowdsecurity/crowdsec-appsec-outofband, kind=crowdsec, remediation=true) was the 2 % gap between the panel and the LAPI after the v1.3.39.0 deploy: 6 alerts never counted by the AppSec page (since v1.3.4) nor, therefore, by the v1.3.39.0 dashboard and overview. TestOutOfBandBanIsAnAppSecBan pins the real scenario name as an AppSec ban with category appsec-misc, and that crowdsecurity/http-* and CAPI list updates still do not count.
  • waf-sources-agree.sh default gate 5 % -> 1 %.
  • appsec_unavailable says what is not enforced. The notification text (and its catalogue entry) now states that with the crowdsec container down no CrowdSec ban is being enforced either, because the Caddy bouncer runs in live mode with no local decision cache, not only that AppSec is unreachable. String only.
  • Docs: what happens if CrowdSec is down. New section in docs/features/crowdsec.md (live mode, no cache, hard_fails off -> nothing enforced and AppSec not inspecting while the LAPI is down; what the panel shows; why fail-open was chosen over the alternative that kills Caddy; stream mode as the v1.3.40 PHASE 0 item). docs/operations/deployment.md: raising a container's memory limit with docker update first and the off-hours recreate later (--no-deps, because crowdsec-init shares the crowdsec network namespace). docs/reference/env-vars.md: the compose resource limits.
  • CrowdSec memory cap 256 MB -> 384 MB. The v1.3.39.0 watch peaked at 90.3 % of 256 MB. Applied on prod on 2026-09-26 with docker update --memory 384m --memory-swap 768m argos-prod-crowdsec (no restart: 176 MB / 384 MB, 46 %, right after) and CROWDSEC_MEM_LIMIT=384m in the operational .env; .env.example default raised to 384m. Cgroup and compose diverge until the operator's off-hours recreate: docker inspect shows the updated cgroup (384 MB), docker compose config resolves 384 MB from .env, but the container compose remembers was created with 256 MB, so the service definition no longer matches. Consequence: any full docker compose up -d in ~/argos-prod would recreate crowdsec now (a 10-15 s unprotected window); make deploy-prod is safe because it runs up -d --force-recreate --no-deps argos. The aligning docker compose up -d --no-deps crowdsec needs a separate OK.
  • Planned for the v1.3.40 PHASE 0, not here: bouncer stream mode (decision cache in Caddy, no per-request LAPI call, downloaded bans keep applying during a LAPI outage); first recover why v1.3.20 chose live mode (git log -S, release note, strikes).

Measured

Before on prod (1.3.39.0), gate 1 %: dashboard 260 / overview 260 / AppSec 260 / LAPI 266 (245 hits + 21 bans): FAIL, 2 %.

After on prod (deploy 09:47:27Z, image sha256:81c930... -> sha256:e52c85..., healthy in 10 s, crowdsec container untouched): waf-sources-agree.sh PASS at 1 %: dashboard 266 / overview 266 / AppSec 266 / LAPI 266 (245 hits + 21 bans), 0 %. dashboard-latency.sh strict PASS (health 0.001 s hit, overview 0.056 s); panel-boot.sh PASS (0.155 s, purge +122.0 s). crowdsec at 238 MB / 384 MB (62 %) after the smokes.

Files changed

  • backend/internal/appsec/metrics.go (+ alerts_test.go), scripts/smoke/waf-sources-agree.sh, CHANGELOG.md, docs/release-notes/v1.3.39.1.md, mkdocs.yml, docs/operations/verification-report.md, backend/cmd/argos/main.go, frontend/package.json.