Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.

The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.

Model: opus-5-5

docs/alerts.md

@@ -13,9 +13,8 @@ back or dropped.
   threshold. The request was refused unless the alert's `detail` gives `mode`:
   `detect` or `observe`.
 - `anomaly`: a count over an anomaly threshold.
-- `reputation_hit`: a request from a client on a blocklist, the CrowdSec
-  decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
-  One alert per source.
+- `reputation_hit`: a request from a client on a blocklist or a DNS blocklist,
+  or with an AbuseIPDB score that is a hit. One alert per source.
 - `source_failure`: one of:
     - GeoJS failing;
     - a list that cannot be fetched;
@@ -69,8 +68,7 @@ on one line:
             "earlier_bans": {
                 "limit": 0,
                 "attack": 0,
-                "admin": 0,
-                "crowdsec": 0
+                "admin": 0
             }
         }
     },

docs/request-log.md

@@ -97,7 +97,7 @@ Every one of these lines has:
     - `client_denied`: refused for `SWW_WAF_DENY_NETS`, for a reputation source
       with the action `deny`, or for a tag in `SWW_WAF_TAG_DENY`;
     - `temporarily_banned`: refused under a ban that runs out, or for a `ban`
-      rule, a trap path or a CrowdSec decision that made such a ban;
+      rule or a trap path that made such a ban;
     - `permanently_banned`: refused under a ban that never runs out, including a
       ban this request made or made permanent;
     - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
@@ -118,8 +118,6 @@ Every one of these lines has:
     - `countries`: `country`, and `setting`, the country list that refused it;
     - `tag_deny`: `tag`, the tag of `SWW_WAF_TAG_DENY` the request carries;
     - `blocklists`: `lists`, the blocklist URLs that list the client;
-    - `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
-      decision ends;
     - `dnsbl`: `zones`, the DNS blocklist zones that list the client, their keys
       masked;
     - `abuseipdb`: `score`, and `min_score`, `SWW_WAF_ABUSEIPDB_MIN_SCORE`;
@@ -171,7 +169,6 @@ Every one of these lines has:
   and the rules that matched, for a request it inspected.
 - `reputation`: the sources the client is on, in this order:
     - blocklist URLs;
-    - the CrowdSec decision list's URL;
     - DNS blocklist zones;
     - `abuseipdb`.
 - `tags`: the request's tags, sorted, left out when it has none. Each tag and

docs/settings.md

@@ -180,8 +180,8 @@ in [`SPEC.md`](../SPEC.md).
   `name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
   tag, and may hold `=`, such as `vpn=mullvad`. Each list is an `http` or
   `https` URL fetched like a blocklist. A name or URL listed twice is refused.
-  So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS`,
-  `SWW_WAF_ASN_LIMIT_PERCENT_URL`, or the CrowdSec decision list.
+  So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS` or is
+  `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
 - `SWW_WAF_TAG_DENY` (default empty): tags whose requests are refused, such as
   `torexit,country=CN`. A tag listed twice, an `asn=` tag without a number, or a
   `country=` tag without a country, is refused.
@@ -214,9 +214,6 @@ tag that no request can get stops the start. A request can get only these:
   `SWW_WAF_CORE_RULE_SET_MODE` nor `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD` is
   `off`.
 
-`crowdsec` stops the start in both settings, because a CrowdSec decision refuses
-the request first.
-
 ## Biased thresholds
 
 - `SWW_WAF_ASN_BYTES_LIMIT_PERCENT` and `SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT`
@@ -333,14 +330,6 @@ the request first.
   score, from 0 to 100, that is a hit.
 - `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a
   day, a whole number above zero. AbuseIPDB's free accounts may make 1,000.
-- `SWW_WAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec
-  engine you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL
-  without a user or a fragment; its decision list is at `v1/decisions` under it.
-  Set without the key, it is refused. So is a decision list URL that is also in
-  `SWW_WAF_BLOCKLIST_URLS`, or that is `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
-- `SWW_WAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
-  `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
-  URL, it is refused.
 - `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` (default `limit:25`): `deny`,
   `limit:<percent>` or `log`, for DNS blocklist and AbuseIPDB hits.
 - `SWW_WAF_IP_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict

docs/state-files.md

@@ -25,7 +25,7 @@ Active and past bans: every ban an admin made, and up to `SWW_WAF_MAX_BANS` of
 those `waf` made. Per entry:
 
 - `netblock`, `start` and `expires` (`null` for a permanent ban);
-- `cause`: `attack`, `limit`, `admin` or `crowdsec`;
+- `cause`: `attack`, `limit` or `admin`;
 - `reason`: a short reason;
 - `lifted`: when an admin lifted it, if one did;
 - `notes`: the notes below.