Add Traefik rollback note and CrowdSec private IP allowlist note

[PizzaLovingNerd]

Description

Two notes for #1030 from running its upgrade guide and the dashboard AppSec guide in VMs.

Rolling Traefik back. The rollback section already says to restore the config that changed, but it's easy to put the old image back and forget the new flags. Traefik before v3.7.12 doesn't know aliasHeadersStrategy and crash loops with field not found, node: aliasHeadersStrategy. I hit exactly that going from v3.7.14 back to the recorded v3.6 digest, so the upgrade page now says to remove those flags when rolling back past v3.7.12.

The 4 hour AppSec ban. The warning is accurate. Two different rules from one IP gave a crowdsecurity/appsec-vpatch ban of 3h59m that blocked the dashboard, /api and /oauth2. It doesn't happen for every address though. The default crowdsecurity/whitelists parser exempts loopback, 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 from scenarios, so from a client on one of those IPv4 ranges you only see the per request 403 and never the ban. Private IPv6 (fc00::/7) isn't on that list, so those clients can still get banned. I added a line about that to the warning in crowdsec-dashboard.mdx and to the matching paragraph in crowdsec.mdx, so nobody tests from their LAN and decides the ban can't happen.

Changes

upgrade.mdx gets one paragraph in "Roll back a dependency update".

crowdsec-dashboard.mdx gets one paragraph inside the existing ban warning.

crowdsec.mdx gets one sentence at the end of the appsec-vpatch paragraph.

Testing

npm run lint:mdx and npm run build both pass. The whitelist ranges come from the hub's parsers/s02-enrich/crowdsecurity/whitelists.yaml, and I checked the ban behavior against CrowdSec v1.8.1 with the parser removed and then put back.

[vercel]

@PizzaLovingNerd is attempting to deploy a commit to the NetBird GmbH Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4f6f988b-6802-4da6-8865-177add54488d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}