739895d81e
Fixes CrowdSec not starting automatically on container boot and LAPI binding failures due to permission issues. Changes: - Fix Dockerfile: Add charon:charon ownership for CrowdSec directories - Move reconciliation from routes.go goroutine to main.go initialization - Add mutex protection to prevent concurrent reconciliation - Increase LAPI startup timeout from 30s to 60s - Add config validation in entrypoint script Testing: - Backend coverage: 85.4% (✅ meets requirement) - Frontend coverage: 87.01% (✅ exceeds requirement) - Security: 0 Critical/High vulnerabilities (✅ Trivy + Go scans) - All CrowdSec-specific tests passing (✅ 100%) Technical Details: - Reconciliation now runs synchronously during app initialization (after DB migrations, before HTTP server starts) - Maintains "GUI-controlled" design philosophy per entrypoint docs - Follows principle of least privilege (charon user, not root) - No breaking changes to API or behavior Documentation: - Implementation guide: docs/implementation/crowdsec_startup_fix_COMPLETE.md - Migration guide: docs/implementation/crowdsec_startup_fix_MIGRATION.md - QA report: docs/reports/qa_report_crowdsec_startup_fix.md Related: #crowdsec-startup-timeout
Scripts Directory
Running Tests Locally Before Pushing to CI
WAF Integration Test
Always run this locally before pushing WAF-related changes to avoid CI failures:
# From project root
bash ./scripts/coraza_integration.sh
Or use the VS Code task: Ctrl+Shift+P → Tasks: Run Task → Coraza: Run Integration Script
Requirements:
-
Docker image
charon:localmust be built first:docker build -t charon:local . -
The script will:
- Start a test container with WAF enabled
- Create a backend container (httpbin)
- Test WAF in block mode (expect HTTP 403)
- Test WAF in monitor mode (expect HTTP 200)
- Clean up all test containers
Expected output:
✓ httpbin backend is ready
✓ Coraza WAF blocked payload as expected (HTTP 403) in BLOCK mode
✓ Coraza WAF in MONITOR mode allowed payload through (HTTP 200) as expected
=== All Coraza integration tests passed ===
Other Test Scripts
- Security Scan:
bash ./scripts/security-scan.sh - Go Test Coverage:
bash ./scripts/go-test-coverage.sh - Frontend Test Coverage:
bash ./scripts/frontend-test-coverage.sh
CI/CD Workflows
Changes to these scripts may trigger CI workflows:
coraza_integration.sh→ WAF Integration Tests workflow- Files in
.github/workflows/directory control CI behavior
Tip: Run tests locally to save CI minutes and catch issues faster!