From 78108b7657e40728914f32b408c98edef5f14898 Mon Sep 17 00:00:00 2001 From: sabban Date: Thu, 24 Sep 2026 16:07:06 +0200 Subject: [PATCH 1/2] update skill for pacakgecloud use --- .../crowdsec/references/install/bare-metal.md | 57 +++++++++++++++---- 1 file changed, 47 insertions(+), 10 deletions(-) diff --git a/skills/crowdsec/references/install/bare-metal.md b/skills/crowdsec/references/install/bare-metal.md index 4946a1c..cc8a75f 100644 --- a/skills/crowdsec/references/install/bare-metal.md +++ b/skills/crowdsec/references/install/bare-metal.md @@ -1,27 +1,64 @@ --- verified: - - date: 2026-05-21 - version: "1.7.8" + - date: 2026-09-24 + version: "1.8.1" env: systemd - notes: "apt + systemd install path" + notes: "apt + systemd install path; Packagecloud any/any on Debian 13" --- # Install — bare metal (apt/dnf + systemd) Canonical docs: · post-install -This is the operational layer over the canonical install. Follow the doc for the -exact repo line for your distro; the notes below are what the doc doesn't tell -you, for a 1.7.x Debian/Ubuntu box. +This is the operational layer over the canonical install. The notes below cover +native packages and systemd on Debian-like and RHEL-family systems. ## 1 — Add the repository and install -The canonical path is the packagecloud one-liner, which drops a signed apt/dnf -repo and installs the engine: +### Debian-like systems: always use Packagecloud `any/any` + +For **every Debian-like installation** — Debian, Ubuntu, and all derivatives — +the normal CrowdSec Packagecloud apt source **must use `any/any`**, not a +detected distribution and codename. This applies to the standard CrowdSec +Debian package repositories, including `crowdsec/crowdsec` and +`crowdsec/crowdsec-testing`. It does not define how separate, product-specific +bouncer repositories are configured. + +After running the CrowdSec repository installer, rewrite its generated `.list` +file before `apt-get update` or package installation: + +```bash +curl -s https://install.crowdsec.net | sudo sh +sudo sed -i -E \ + 's#(packagecloud.io/crowdsec/[^/]+)/(debian|ubuntu)/ [^ ]+#\1/any/ any#' \ + /etc/apt/sources.list.d/crowdsec_*.list +sudo apt-get update +apt-cache policy crowdsec +sudo apt-get install -y crowdsec +``` + +The rewrite changes source entries from: + +```text +https://packagecloud.io/crowdsec//debian/ main +``` + +or its `/ubuntu/` equivalent to: + +```text +https://packagecloud.io/crowdsec//any/ any main +``` + +Then run `sudo apt-get update` and use `apt-cache policy ` to confirm +that the selected package comes from `/any any/main` before +installing it. Do not substitute another Debian or Ubuntu codename as a +compatibility workaround. + +On RHEL-family systems, use the normal installer and dnf path: ```bash -curl -s https://install.crowdsec.net | sudo sh # adds the repo -sudo apt install crowdsec # or: sudo dnf install crowdsec +curl -s https://install.crowdsec.net | sudo sh +sudo dnf install crowdsec ``` What this lays down: From 26726fa4045fbf6c6f9ca7fc40ee7340f5f9187a Mon Sep 17 00:00:00 2001 From: sabban Date: Fri, 25 Sep 2026 09:41:31 +0200 Subject: [PATCH 2/2] any any should be landed by the install scrip --- .../crowdsec/references/install/bare-metal.md | 39 ++++++------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/skills/crowdsec/references/install/bare-metal.md b/skills/crowdsec/references/install/bare-metal.md index cc8a75f..fbe65e0 100644 --- a/skills/crowdsec/references/install/bare-metal.md +++ b/skills/crowdsec/references/install/bare-metal.md @@ -15,44 +15,29 @@ native packages and systemd on Debian-like and RHEL-family systems. ## 1 — Add the repository and install -### Debian-like systems: always use Packagecloud `any/any` +### Debian-like systems: the installer uses Packagecloud `any/any` For **every Debian-like installation** — Debian, Ubuntu, and all derivatives — -the normal CrowdSec Packagecloud apt source **must use `any/any`**, not a -detected distribution and codename. This applies to the standard CrowdSec -Debian package repositories, including `crowdsec/crowdsec` and -`crowdsec/crowdsec-testing`. It does not define how separate, product-specific -bouncer repositories are configured. - -After running the CrowdSec repository installer, rewrite its generated `.list` -file before `apt-get update` or package installation: +use the normal CrowdSec installation script. The script configures the +Packagecloud apt repository as **`any/any`**; users must not select a Debian or +Ubuntu codename or rewrite the generated source. ```bash curl -s https://install.crowdsec.net | sudo sh -sudo sed -i -E \ - 's#(packagecloud.io/crowdsec/[^/]+)/(debian|ubuntu)/ [^ ]+#\1/any/ any#' \ - /etc/apt/sources.list.d/crowdsec_*.list -sudo apt-get update -apt-cache policy crowdsec sudo apt-get install -y crowdsec ``` -The rewrite changes source entries from: - -```text -https://packagecloud.io/crowdsec//debian/ main -``` +If repository provenance needs checking, confirm that the source created by the +installer contains `/any/ any main` and that apt selects it: -or its `/ubuntu/` equivalent to: - -```text -https://packagecloud.io/crowdsec//any/ any main +```bash +grep -R 'packagecloud.io/crowdsec/.*/any/ any main' /etc/apt/sources.list.d/ +apt-cache policy crowdsec ``` -Then run `sudo apt-get update` and use `apt-cache policy ` to confirm -that the selected package comes from `/any any/main` before -installing it. Do not substitute another Debian or Ubuntu codename as a -compatibility workaround. +If that check shows `/debian/ ` or `/ubuntu/ `, do not treat +it as the expected installer output; investigate the installer or stale source +file instead of documenting a manual codename substitution. On RHEL-family systems, use the normal installer and dnf path: