crowdsecurity
diff --git a/‎Dockerfile‎
Lines changed: 8 additions & 3 deletions b/‎Dockerfile‎
Lines changed: 8 additions & 3 deletions
diff --git a/‎cmd/root.go‎
Lines changed: 36 additions & 116 deletions b/‎cmd/root.go‎
Lines changed: 36 additions & 116 deletions
diff --git a/‎config/crowdsec-spoa-bouncer.service‎
Lines changed: 15 additions & 2 deletions b/‎config/crowdsec-spoa-bouncer.service‎
Lines changed: 15 additions & 2 deletions
diff --git a/‎config/crowdsec-spoa-bouncer.yaml‎
Lines changed: 5 additions & 12 deletions b/‎config/crowdsec-spoa-bouncer.yaml‎
Lines changed: 5 additions & 12 deletions
diff --git a/‎debian/postinst‎
Lines changed: 5 additions & 0 deletions b/‎debian/postinst‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎debian/rules‎
Lines changed: 1 addition & 1 deletion b/‎debian/rules‎
Lines changed: 1 addition & 1 deletion
@@ -1,4 +1,4 @@
-ARG GOVERSION=1.24
+ARG GOVERSION=1.25
 
 FROM golang:${GOVERSION}-alpine AS build
 
@@ -14,8 +14,10 @@ COPY --from=build /go/src/cs-spoa-bouncer/crowdsec-spoa-bouncer /usr/local/bin/c
 COPY --from=build /go/src/cs-spoa-bouncer/config/crowdsec-spoa-bouncer.yaml /etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml
 COPY --from=build /go/src/cs-spoa-bouncer/docker/docker_start.sh /docker_start.sh
 
-## Add socat
-RUN apk add --no-cache socat
+# Set permissions for config file and binary
+RUN chmod 644 /etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml && \
+    chmod 755 /usr/local/bin/crowdsec-spoa-bouncer
+
 ## Add the same haproxy user as the official haproxy image
 RUN addgroup -g 99 -S haproxy && adduser -S -D -H -u 99 -h /var/lib/haproxy -s /sbin/nologin -G haproxy -g haproxy haproxy
 ## Add worker user
@@ -37,4 +39,7 @@ VOLUME [ "/usr/local/crowdsec/lua/haproxy/", "/var/lib/crowdsec/lua/haproxy/temp
 
 RUN chmod +x /docker_start.sh
 
+# Run as user
+USER crowdsec-spoa
+
 ENTRYPOINT ["/docker_start.sh"]
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"net"
@@ -19,13 +18,10 @@ import (
 	"github.com/spf13/pflag"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/crowdsecurity/crowdsec-spoa/internal/api"
-	"github.com/crowdsecurity/crowdsec-spoa/internal/worker"
 	"github.com/crowdsecurity/crowdsec-spoa/pkg/cfg"
 	"github.com/crowdsecurity/crowdsec-spoa/pkg/dataset"
 	"github.com/crowdsecurity/crowdsec-spoa/pkg/host"
 	"github.com/crowdsecurity/crowdsec-spoa/pkg/metrics"
-	"github.com/crowdsecurity/crowdsec-spoa/pkg/server"
 	"github.com/crowdsecurity/crowdsec-spoa/pkg/spoa"
 	csbouncer "github.com/crowdsecurity/go-cs-bouncer"
 	"github.com/crowdsecurity/go-cs-lib/csdaemon"
@@ -63,9 +59,6 @@ func Execute() error {
 	testConfig := pflag.BoolP("test", "t", false, "test config and exit")
 	showConfig := pflag.BoolP("show-config", "T", false, "show full config (.yaml + .yaml.local) and exit")
 
-	// Worker pflags
-	workerConfigJSON := pflag.String("worker-config", "", "worker configuration as JSON string")
-
 	pflag.Parse()
 
 	// Handle version flags
@@ -74,19 +67,6 @@ func Execute() error {
 		return nil
 	}
 
-	if *workerConfigJSON != "" {
-		var w *worker.Worker
-		if err := json.Unmarshal([]byte(*workerConfigJSON), &w); err != nil {
-			return fmt.Errorf("failed to parse worker config JSON: %w", err)
-		}
-
-		if w.TcpAddr == "" && w.UnixAddr == "" {
-			return fmt.Errorf("worker must have one listener address")
-		}
-		return WorkerExecute(w)
-
-	}
-
 	if configPath == nil || *configPath == "" {
 		return errors.New("configuration file is required")
 	}
@@ -158,7 +138,7 @@ func Execute() error {
 		return metricsProvider.Run(ctx)
 	})
 
-	prometheus.MustRegister(csbouncer.TotalLAPICalls, csbouncer.TotalLAPIError, metrics.TotalActiveDecisions, metrics.TotalBlockedRequests, metrics.TotalProcessedRequests, metrics.TotalWorkerAPIConnectionErrors, metrics.TotalWorkerAPIConnectionEvents)
+	prometheus.MustRegister(csbouncer.TotalLAPICalls, csbouncer.TotalLAPIError, metrics.TotalActiveDecisions, metrics.TotalBlockedRequests, metrics.TotalProcessedRequests)
 
 	if config.PrometheusConfig.Enabled {
 		go func() {
@@ -220,121 +200,61 @@ func Execute() error {
 		}
 	}
 
-	socketConnChan := make(chan server.SocketConn)
-
-	workerServer, err := server.NewWorkerSocket(ctx, socketConnChan, config.WorkerSocketDir)
-
-	if err != nil {
-		return fmt.Errorf("failed to create worker server: %w", err)
-	}
-
-	var adminServer *server.Server
-	if config.AdminSocket != "" {
-		var err error
-		adminServer, err = server.NewAdminSocket(ctx, socketConnChan)
-
-		if err != nil {
-			return fmt.Errorf("failed to create admin server: %w", err)
-		}
-
-		err = adminServer.NewAdminListener(config.AdminSocket)
-		if err != nil {
-			return fmt.Errorf("failed to create admin listener: %w", err)
-		}
+	// Create single SPOA listener - ultra-simplified architecture
+	spoaLogger := log.WithField("component", "spoa")
+
+	// Create single SPOA directly with minimal configuration
+	spoaConfig := &spoa.SpoaConfig{
+		TcpAddr:     config.ListenTCP,
+		UnixAddr:    config.ListenUnix,
+		Dataset:     dataSet,
+		HostManager: HostManager,
+		GeoDatabase: &config.Geo,
+		Logger:      spoaLogger,
 	}
 
-	workerManager := worker.NewManager(workerServer, config.WorkerUid, config.WorkerGid)
-
-	g.Go(func() error {
-		return workerManager.Run(ctx)
-	})
-
-	apiServer := api.NewAPI(api.APIConfig{
-		WorkerManager: workerManager,
-		HostManager:   HostManager,
-		Dataset:       dataSet,
-		GeoDatabase:   &config.Geo,
-		SocketChan:    socketConnChan,
-	})
-
-	for _, worker := range config.Workers {
-		workerManager.CreateChan <- worker
+	singleSpoa, err := spoa.New(spoaConfig)
+	if err != nil {
+		return fmt.Errorf("failed to create SPOA listener: %w", err)
 	}
 
+	// Launch single SPOA server directly
 	g.Go(func() error {
-		return apiServer.Run(ctx)
-	})
-
-	// Add worker server to errgroup
-	g.Go(func() error {
-		return workerServer.Wait()
+		if err := singleSpoa.Serve(ctx); err != nil {
+			return fmt.Errorf("SPOA server failed: %w", err)
+		}
+		return nil
 	})
 
-	// Add admin server to errgroup if configured
-	if adminServer != nil {
-		g.Go(func() error {
-			return adminServer.Wait()
-		})
-	}
-
 	_ = csdaemon.Notify(csdaemon.Ready, log.StandardLogger())
 
-	if err := g.Wait(); err != nil {
+	err = g.Wait()
+
+	// Determine if this was an expected shutdown signal
+	isExpectedShutdown := false
+	if err != nil {
 		switch err.Error() {
 		case "received SIGTERM":
 			log.Info("Received SIGTERM, shutting down")
+			isExpectedShutdown = true
 		case "received interrupt":
 			log.Info("Received interrupt, shutting down")
-		default:
-			return err
+			isExpectedShutdown = true
 		}
 	}
 
-	return nil
-}
-
-func WorkerExecute(w *worker.Worker) error {
-
-	g, ctx := errgroup.WithContext(context.Background())
-
-	g.Go(func() error {
-		return HandleSignals(ctx)
-	})
-
-	spoad, err := spoa.New(w.TcpAddr, w.UnixAddr)
-
-	if err != nil {
-		return fmt.Errorf("failed to create SPOA: %w", err)
-	}
-
-	g.Go(func() error {
-		if err := spoad.ServeTCP(ctx); err != nil {
-			return fmt.Errorf("failed to serve TCP: %w", err)
-		}
-		return nil
-	})
-
-	g.Go(func() error {
-		if err := spoad.ServeUnix(ctx); err != nil {
-			return fmt.Errorf("failed to serve Unix: %w", err)
-		}
-		return nil
-	})
+	// Shutdown SPOA server gracefully after all goroutines finish
+	log.Info("Shutting down SPOA listener")
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
 
-	if err := g.Wait(); err != nil {
-		switch err.Error() {
-		case "received SIGTERM":
-		case "received interrupt":
-		default:
-			return err
-		}
+	if shutdownErr := singleSpoa.Shutdown(shutdownCtx); shutdownErr != nil {
+		log.Errorf("Failed to shutdown SPOA: %v", shutdownErr)
 	}
 
-	cancelCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	if err := spoad.Shutdown(cancelCtx); err != nil {
-		return fmt.Errorf("failed to shutdown server: %w", err)
+	// Return error only if it was unexpected
+	if err != nil && !isExpectedShutdown {
+		return err
 	}
 
 	return nil
 
@@ -1,16 +1,29 @@
 [Unit]
 Description=The haproxy spoa bouncer for CrowdSec
+Documentation=https://docs.crowdsec.net/u/bouncers/haproxy_spoa/
 After=syslog.target network.target remote-fs.target nss-lookup.target crowdsec.service
 
 [Service]
 Type=notify
+User=crowdsec-spoa
+Group=crowdsec-spoa
+# Allow binding to lower ports if needed
+# AmbientCapabilities=CAP_NET_BIND_SERVICE
 ExecStart=${BIN} -c ${CFG}/crowdsec-spoa-bouncer.yaml
 ExecStartPre=${BIN} -c ${CFG}/crowdsec-spoa-bouncer.yaml -t
-ExecStartPre=/bin/mkdir -p /run/crowdsec-spoa
-ExecStartPre=/bin/chown crowdsec-spoa:crowdsec-spoa /run/crowdsec-spoa
 ExecStartPost=/bin/sleep 0.1
 Restart=always
 RestartSec=10
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+RuntimeDirectory=crowdsec-spoa
+RuntimeDirectoryMode=2750
+RuntimeDirectoryPreserve=yes
+LogsDirectory=crowdsec-spoa
+LogsDirectoryMode=0750
 
 [Install]
 WantedBy=multi-user.target
@@ -1,6 +1,6 @@
 ## Log configuration
 log_mode: file
-log_dir: /var/log/
+log_dir: /var/log/crowdsec-spoa/
 log_level: info
 log_compression: true
 log_max_size: 100
@@ -13,20 +13,13 @@ api_url: http://127.0.0.1:8080/
 api_key: ${API_KEY}
 insecure_skip_verify: false
 
-## SPOA configuration
-workers:
-  - name: spoa1
-    listen_addr: 0.0.0.0:9000
-    listen_socket: /run/crowdsec-spoa/spoa-1.sock
-worker_user: crowdsec-spoa
-worker_group: crowdsec-spoa
+## SPOA listener configuration
+# Configure TCP and/or Unix socket listeners
+listen_tcp: 0.0.0.0:9000
+listen_unix: /run/crowdsec-spoa/spoa.sock
 #asn_database_path: /var/lib/crowdsec/data/GeoLite2-ASN.mmdb
 #city_database_path: /var/lib/crowdsec/data/GeoLite2-City.mmdb
 
-#admin socket
-admin_socket: /run/crowdsec-spoa-admin.sock
-
-
 prometheus:
   enabled: false
   listen_addr: 127.0.0.1
 
@@ -22,6 +22,11 @@ if ! getent passwd crowdsec-spoa >/dev/null; then
     adduser crowdsec-spoa --system --group --comment "crowdsec haproxy spoa bouncer"
 fi
 
+# Set config file group ownership
+if [ -f "$CONFIG" ]; then
+    chgrp crowdsec-spoa "$CONFIG" 2>/dev/null || true
+fi
+
 if [ -d "/etc/haproxy" ]; then
     cp /usr/share/doc/crowdsec-haproxy-spoa-bouncer/examples/crowdsec.cfg /etc/haproxy/crowdsec.cfg
 fi
 
@@ -37,5 +37,5 @@ execute_after_dh_fixperms:
 	PKG="crowdsec-haproxy-spoa-bouncer"; \
 	chmod 0755 "debian/$$PKG/usr/bin/$$BOUNCER"; \
 	chmod 0600 "debian/$$PKG/usr/lib/$$PKG/_bouncer.sh"; \
-	chmod 0600 "debian/$$PKG/etc/crowdsec/bouncers/$$BOUNCER.yaml"; \
+	chmod 0640 "debian/$$PKG/etc/crowdsec/bouncers/$$BOUNCER.yaml"; \
 	chmod 0644 "debian/$$PKG/lib/systemd/system/$$BOUNCER.service"