Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.

The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

internal/config/waf.go

@@ -157,13 +157,6 @@ type WAF struct {
 	DNSBLAbuseIPDBLimitPercent int64
 	IPReputationCacheTTL       time.Duration
 	DNSBLAbuseIPDBTimeout      time.Duration
-	// CrowdSecDecisionsURL is where the decision list of the CrowdSec
-	// engine whose local API SWW_WAF_CROWDSEC_LAPI_URL names is fetched from:
-	// that URL with v1/decisions added to its path, "" while it is unset and
-	// none is. CrowdSecKey is the key the engine is asked with
-	// (SWW_WAF_CROWDSEC_LAPI_KEY).
-	CrowdSecDecisionsURL string
-	CrowdSecKey          string
 	// BanResponse is the status a refused client is answered with, 403
 	// or 429, or 0 to close the connection without an answer
 	// (SWW_WAF_BAN_RESPONSE). It answers a banned client, a request that
@@ -473,21 +466,12 @@ var (
 		"is not an IP address with an optional port, " +
 			"such as 192.0.2.53 or [2001:db8::53]:5353",
 	)
-	errNotLAPIURL = errors.New(
-		"is not an http or https URL without a user or a fragment, " +
-			"such as http://172.17.0.1:8080")
 	errNotRouteWatchURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as https://routewatch.example")
-	errNeedsLAPIKey  = errors.New("the engine answers no request without it")
-	errLAPIKeyUnused = errors.New(
-		"it is sent only to the engine at that URL",
-	)
-	errAnotherList = errors.New(
+	errFetchedOtherwise = errors.New(
 		"is in SWW_WAF_BLOCKLIST_URLS or is SWW_WAF_ASN_LIMIT_PERCENT_URL too",
 	)
-	errFetchedOtherwise = errors.New("is in SWW_WAF_BLOCKLIST_URLS, is " +
-		"SWW_WAF_ASN_LIMIT_PERCENT_URL or is the CrowdSec decision list too")
 	errNotTagList = errors.New(
 		"is not a name, = and an http or https URL, such as " +
 			"torexit=https://example.com/tor.txt")
@@ -502,8 +486,6 @@ var (
 	errExploitTag = errors.New(
 		"cannot lower limits: the rate limits count a request before its " +
 			"rules are matched")
-	errCrowdSecTag = errors.New(
-		"cannot be used: a CrowdSec decision refuses the request first")
 	errNoRequestGetsTag = errors.New(
 		"is a tag no request can get: it is not a name in SWW_WAF_TAG_LISTS, an " +
 			"asn= or country= tag, a dnsbl= tag of a zone in SWW_WAF_DNSBL_ZONES, " +
@@ -605,10 +587,6 @@ func WAFFromEnvironment(v *viper.Viper) (*WAF, error) {
 			"SWW_WAF_DNSBL_ABUSEIPDB_TIMEOUT_MS",
 			"2000",
 		),
-		CrowdSecDecisionsURL: env.crowdSecDecisionsURL(
-			"SWW_WAF_CROWDSEC_LAPI_URL",
-		),
-		CrowdSecKey: env.secret("SWW_WAF_CROWDSEC_LAPI_KEY"),
 		BanResponse: env.banResponse("SWW_WAF_BAN_RESPONSE", "403"),
 		LimitBanDuration: env.durationNotOff(
 			"SWW_WAF_LIMIT_BAN_DURATION",
@@ -755,7 +733,6 @@ func WAFFromEnvironment(v *viper.Viper) (*WAF, error) {
 	env.checkLookupDBPath(cfg)
 	env.checkCountriesAndLookups(cfg)
 	env.checkASNLimitPercentURL(cfg)
-	env.checkCrowdSec(cfg)
 	env.checkTagLists(cfg)
 	env.checkTags(cfg)
 
@@ -1061,26 +1038,6 @@ func (e *environment) resolver(name string) netip.AddrPort {
 	return resolver
 }
 
-// crowdSecDecisionsURL reads the setting that is the URL of the CrowdSec
-// engine's local API, such as http://172.17.0.1:8080, and returns the URL
-// its decision list is fetched from, that URL with v1/decisions added to
-// its path, "" while it is unset or empty.
-func (e *environment) crowdSecDecisionsURL(name string) string {
-	value := e.value(name, "")
-	if value == "" {
-		return ""
-	}
-
-	lapi, err := url.Parse(value)
-	if err != nil || !isHTTPURL(lapi) {
-		e.check(name, fmt.Errorf("%q %w", value, errNotLAPIURL))
-
-		return ""
-	}
-
-	return lapi.JoinPath("v1", "decisions").String()
-}
-
 // routeWatchURL reads the setting that is the URL of a routewatch instance,
 // "" while it is unset or empty.
 func (e *environment) routeWatchURL(name string) string {
@@ -1190,39 +1147,12 @@ func (e *environment) checkASNLimitPercentURL(cfg *WAF) {
 	}
 }
 
-// checkCrowdSec refuses SWW_WAF_CROWDSEC_LAPI_URL without
-// SWW_WAF_CROWDSEC_LAPI_KEY, the key without the URL, and a decision list
-// that is fetched as another list too.
-func (e *environment) checkCrowdSec(cfg *WAF) {
-	decisionsURL := cfg.CrowdSecDecisionsURL
-
-	switch {
-	case decisionsURL != "" && cfg.CrowdSecKey == "":
-		e.check("SWW_WAF_CROWDSEC_LAPI_URL", fmt.Errorf(
-			"is set while SWW_WAF_CROWDSEC_LAPI_KEY is unset; %w",
-			errNeedsLAPIKey,
-		))
-	case decisionsURL == "" && cfg.CrowdSecKey != "":
-		e.check("SWW_WAF_CROWDSEC_LAPI_KEY", fmt.Errorf(
-			"is set while SWW_WAF_CROWDSEC_LAPI_URL is unset; %w",
-			errLAPIKeyUnused,
-		))
-	case decisionsURL != "" && (slices.Contains(cfg.BlocklistURLs, decisionsURL) ||
-		decisionsURL == cfg.ASNLimitPercentURL):
-		e.check(
-			"SWW_WAF_CROWDSEC_LAPI_URL",
-			fmt.Errorf("gives the decision list %q, which %w",
-				decisionsURL, errAnotherList),
-		)
-	}
-}
-
 // checkTagLists refuses a list of SWW_WAF_TAG_LISTS whose URL is fetched as
 // another list too: the file at a URL is read as one kind of list.
 func (e *environment) checkTagLists(cfg *WAF) {
 	for _, list := range cfg.TagLists {
 		if slices.Contains(cfg.BlocklistURLs, list.URL) ||
-			list.URL == cfg.ASNLimitPercentURL || list.URL == cfg.CrowdSecDecisionsURL {
+			list.URL == cfg.ASNLimitPercentURL {
 			e.check(
 				"SWW_WAF_TAG_LISTS",
 				fmt.Errorf("%q %w", list.URL, errFetchedOtherwise),
@@ -1232,8 +1162,7 @@ func (e *environment) checkTagLists(cfg *WAF) {
 }
 
 // checkTags refuses a tag of SWW_WAF_TAG_DENY or SWW_WAF_TAG_LIMIT_PERCENT that would
-// never apply: crowdsec, whose request is refused before tags are acted on, and
-// any tag these settings cannot give a request.
+// never apply: any tag these settings cannot give a request.
 func (e *environment) checkTags(cfg *WAF) {
 	for _, tag := range cfg.TagDeny {
 		e.check("SWW_WAF_TAG_DENY", checkTag(cfg, tag))
@@ -1246,10 +1175,6 @@ func (e *environment) checkTags(cfg *WAF) {
 
 // checkTag returns an error when tag would never apply, as checkTags says.
 func checkTag(cfg *WAF, tag string) error {
-	if tag == CrowdSecTag {
-		return fmt.Errorf("%q %w", tag, errCrowdSecTag)
-	}
-
 	if !requestCanGetTag(cfg, tag) {
 		return fmt.Errorf("%q %w", MaskZoneKey(tag), errNoRequestGetsTag)
 	}
@@ -2010,7 +1935,6 @@ const (
 	DNSBLTagPrefix   = "dnsbl="
 	PrefixTagPrefix  = "prefix="
 	AbuseIPDBTag     = "abuseipdb"
-	CrowdSecTag      = "crowdsec"
 	// ExploitSignatureTag is the tag of a request a rule file or the Core
 	// Rule Set matched.
 	ExploitSignatureTag = "exploitsignature"