Add CrowdSec MikroTik bouncer (edge firewall drop)

- New crowdsec-mikrotik-bouncer service: mirrors CrowdSec decisions into a
  RouterOS address-list on the AX3 for WAN edge-dropping (covers all ports,
  incl. VPN/SSH), complementing the L7 Traefik bouncer.
- Connects over api-ssl/TLS using an OpenBAO-issued cert; trusts the OpenBAO
  root+intermediate via SSL_CERT_FILE (crowdsec/famfi-ca-bundle.pem).
- Secrets (MIKROTIK_PASS, LAPI key) kept in root-only .mikrotik.env, git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,2 @@
+.mikrotik.env
+cred.adm

crowdsec/famfi-ca-bundle.pem

@@ -0,0 +1,64 @@
+-----BEGIN CERTIFICATE-----
+MIIFPTCCAyWgAwIBAgIUDlqH3oDZSYz6DCiHV8a23qxaeXAwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAxMbZmFtZmkuaG9tZSBJbnRlcm5hbCBSb290IENBMB4XDTI2
+MDYyODExNTgzOVoXDTM2MDYyNTExNTkwN1owJjEkMCIGA1UEAxMbZmFtZmkuaG9t
+ZSBJbnRlcm5hbCBSb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEA56+K6oFpJHmJ8b5RVJ3WeaMA12zKWXJCsHZN2xY654m2dioNj81g/ZluT5am
+pNN6vGB15UXjYw4qyFFqlP7bPrZ34ud8G3uH24ryGOhWm5xOjPHSItLrfhHwUmZs
+0eA2Aami0o5R5NMxGspe13xtuKAcq6DuFPtl0w1b1VgzbqPv2ouCX3HEF8q1c7Gh
+PtpxJSpcb8PxoX7sgLBu45+cNGibkiBzplWtliGhe5s6MrkyhEkoLxSvH3GjD9ao
+cZH6VKtwVHJIqAvylk84VXGO2Ycqsmuc33nsoWcUUGsa6NL8+d0J8s/2yTM1p4Kw
+JqtBFybHbaVn1K9wkcTef6KTLAI8Nd88j/m3B3mWUcQr7H05MbyJS5HoOOvZdRiF
+OvnGqu5yjZlZ4Ne74YTUxAnlz3sEJcgRtokWxfSAVLs+u3Uwva7D7XqeuJ1GJXKG
+IOeaXXdULGVUZyYblBFigDWzTF22rMpyJSjNxK0uVIHqcakKKfpcq+7ehS7A+bNI
+4gbDwRca0fbX+HMurNya1r5agQqsFZnpchVINuBGYITI8TQyyq6/kd8GqYP+KUYs
+sAj7TlVfnhAfLg2ADHRBCoc5u3Fj0Pc6bvoI6ANgVBtTFP2ysP5wBjFXqXk58h7s
+MikwtQyzdRvDkiJLQSG0UoGofybJvhKHEQ5oQwP2MioOd/MCAwEAAaNjMGEwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFKQhX4TGAuhu
+QC3DedmQwhXkfpoZMB8GA1UdIwQYMBaAFKQhX4TGAuhuQC3DedmQwhXkfpoZMA0G
+CSqGSIb3DQEBCwUAA4ICAQBaJG9aYgIxflz0KmEdJmKtjaCvjX7E7onZ9qM7jFqr
+Rjtl0zJZG1oQ8sDmM4T5fNbORpqLtcYD/Sn2grzZja+yxJFx5/a/jxfkBWwvDiGT
+hS2UuKmVZ1k1thA2PlzzjOyBh2KFP7BpjYdUIiU09K/hZrvrSS7/Vn3g6jbpiTMT
+WtxBbRgt4AdjG/rYLQPNr/yygerllcPAzMr8i7ROuvj8rddi6yCyef2MT1ayF7/w
+J2ufdbLIosYb9qanp50PpS/rWMC4vAVVFlaYEBBACQIo7N0v9learskdNpPw4vBY
+30gXn0kN15QeuYYPkqwBNVJVuXKsz/+T/WAI9Vxj8EdsxrslbflVy+7VzNn1os+R
+GTGbwdXlnK0ie3QHXISB6uKWQz6H91F9HVnzB6uypkMH9iFOdXC7tgqOjdl/ov2T
+MHYxHqXJ6NNvvWHjqIQCCft6i8AglIsP4xIj/CdpOZabkxnqabD82TXW6oQ6qPpV
+muUv8z3yqQRKHIpxgnXUOlN954L0iBIg1DkilWpAPGeA3DHZ/CkOAIxJmdkLmOu3
+4KFzvkh4D8YBzXZqsI6gBhJhriEHiNNyu6Idsah65k2+aPY5nqfYVao5t5+nXJtL
+88xi+NZUqD/79YvLoT6kBHFQbn+Gii6uOM2A/5IcdFd+xcTDh7vk86QKWxBMUQbX
+3g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFuDCCA6CgAwIBAgIUKopHIWXraxIVdgdtl5r6X4nKl1EwDQYJKoZIhvcNAQEL
+BQAwJjEkMCIGA1UEAxMbZmFtZmkuaG9tZSBJbnRlcm5hbCBSb290IENBMB4XDTI2
+MDYyODExNTg0NFoXDTMxMDYyNzExNTkxNFowJTEjMCEGA1UEAxMaZmFtZmkuaG9t
+ZSBJbnRlcm1lZGlhdGUgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+AQC51pfmO0+x5IdyGiS5tDewGf9lA861HHRLHtVmsLvDiy40tYt94Ka+7XHNVVs3
+LvLksZsbbqF7H+EgKKWtT5y1sDNv3ZoTw46tDelQoBfi0eeQAAnxqa9Erv9L5vct
+e+tW20f8r9ouCZGpq+PgXz+V6wvcai4J5Fjb4+WkDVetR7tOERhaGzIhqqOAE8rT
+LUhFIBArWDBhyrldQ883i/M7S6eGetBOEvHC/KzVWzHFl7WWX53UEsMtst+PAPS3
+D8/TYgY6H5OE7v5+PYIEfOxzNFioYiR8w3ZxqE8rvUkE+38GhMxOlQ4OBkh3lZnX
+kSgw3ZlRQtA+FVlHl1+0dhm3dxvhl5Ha/li8zuRCtAhpFnzgIbb6sfrhgUNbt0BE
+g6GnhWXEm3rXPMAlT0yPaVJ0hkLBx8itTeEcOskqC6Jjh9KqweoMRd3Q3JteB+OF
+5JB9exyrt1VhV37hfaLhBg+CIqrhJDIUt+RsUsp9QDLCl0sbprkCE6ulXzQcXEIL
+b0ZuyrGigZzTraQudp2lPyEAjkMAQlosrBPPkHIixJthWULiVv6TBzTM9Y52Hldk
+1Fq+icB7vgtMB0ytLQu586sTkxXl6jfh6rgsAId87UgvG2aTWuPLHe3Nj3iyU6pr
+JUYtj+hTofBvqG07GThRKZtdZCKTossWZ1k39Z40NkDUOQIDAQABo4HeMIHbMA4G
+A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRsZN8iNGnB
+1UsB3jfJuId6zRXSTjAfBgNVHSMEGDAWgBSkIV+ExgLobkAtw3nZkMIV5H6aGTBA
+BggrBgEFBQcBAQQ0MDIwMAYIKwYBBQUHMAKGJGh0dHBzOi8vb3BlbmJhby5mYW1m
+aS5ob21lL3YxL3BraS9jYTA2BgNVHR8ELzAtMCugKaAnhiVodHRwczovL29wZW5i
+YW8uZmFtZmkuaG9tZS92MS9wa2kvY3JsMA0GCSqGSIb3DQEBCwUAA4ICAQCdkrBf
+4dlIDQJlkoBTjF3kyVfS6/04w8gCArUeJ6WqvfWmrk8dGnPeTUK+wt2V2uUFqf0+
+OqjvmUs3BjmZ0ChAX2ebye1lL3K1E2uo6cSlpvXU/KgBDuaKc7VBT6EhjWFkS/PW
+4ZCrT/H/8Njs3YZV8zJcK+574RQb5V5hBBJppUVTqxSnutUzTb2xXQnQS9R3MJUw
+hU3HwCsev0Ca4VfOr0oXsIf9MJY6ZZFIcgkwCHqvrhUAjLMrdXP7WV18LcZ10H6x
+horynQ87uLwqA7eZWpEStJMCb6gTg+KH1Oj1Wf2hATDDjwYM+9pfGFvex40fQiBL
+gID4WnywK2dA32ummBrFiXVsvFl/KGEaGP6wd6w/7CJmp4Gry+iWZr7ujkRtJI5m
+R9f6NOops2vZT7vuWdQPSQBh0GoBTQ0TJLKMrmJgKCizLjo8r9e92gsUbfpxkigf
+7mAokYaUI9Zsq322gMblqRQNGkfeaNEL/kHa/a53oLq5hPJwssXdUM34vagczaX2
+HbTnXGmktQnA5r7f4MTNBr+rH2LuWLCfTNzsqDd5O0bdCW/YQg9R5teoyACTuANv
+slOYmoYHr+tHQHy/O7tbc1CigJe/U/n95nQX9DsmRCiAasVU8UMhgg9BWrJPAhsL
+s0CYZkxpsD2esLud37OflUyVJqhWOBvjldsviQ==
+-----END CERTIFICATE-----

docker-compose.yml

@@ -51,6 +51,34 @@ services:
     ports:
       - "192.168.0.142:6060:6060"   # Prometheus-Metriken (CrowdSec) fuer 192.168.0.23
 
+  # MikroTik-Bouncer: spiegelt CrowdSec-Decisions in eine RouterOS-Firewall-
+  # Address-List ("crowdsec") auf der AX3 -> Edge-Drop (alle Ports, auch VPN/SSH).
+  # Verbindet sich per RouterOS-API ueber TLS (api-ssl 8729). Der Hostname
+  # mt-az.famfi.home (extra_hosts -> 192.168.0.2) muss zum Cert-SAN passen;
+  # das OpenBAO-Root+Intermediate-Bundle wird via SSL_CERT_FILE vertraut.
+  crowdsec-mikrotik-bouncer:
+    image: ghcr.io/funkolab/cs-mikrotik-bouncer:latest
+    container_name: crowdsec-mikrotik-bouncer
+    restart: unless-stopped
+    depends_on:
+      - crowdsec
+    networks:
+      - proxy
+    extra_hosts:
+      - "mt-az.famfi.home:192.168.0.2"
+    environment:
+      CROWDSEC_URL: "http://crowdsec:8080/"
+      MIKROTIK_HOST: "mt-az.famfi.home:8729"
+      MIKROTIK_USER: "apics"
+      MIKROTIK_TLS: "true"
+      MIKROTIK_IPV6: "false"
+      LOG_LEVEL: "1"
+      SSL_CERT_FILE: "/etc/ssl/famfi-ca.pem"   # trust OpenBAO CA for the RouterOS api-ssl cert
+    env_file:
+      - .mikrotik.env                          # MIKROTIK_PASS + CROWDSEC_BOUNCER_API_KEY (root-only, git-ignored)
+    volumes:
+      - ./crowdsec/famfi-ca-bundle.pem:/etc/ssl/famfi-ca.pem:ro
+
 networks:
   proxy:
     driver: bridge