crowdsec-firewall-bouncer: restart on config changes

[Wolfbeta]

The current config.change trigger invokes reload for changes to the
CrowdSec UCI configuration.

With the nftables backend, this can leave the bouncer running without its
dynamically populated CrowdSec sets after a configuration change. In
testing, reload replaced the nftables table and rotated the bouncer child
process, but the dynamic sets were not recreated or populated afterward.
The CAPI set remained absent across multiple update cycles.

A full restart correctly tears down the previous generation and starts a
fresh one. The new generation recreates the per-origin sets and repopulates
the decisions from LAPI.

Change the config.change trigger from reload to restart so
configuration changes follow that lifecycle.

Reproduction/verification on OpenWrt 25.12:

• Started from a healthy bouncer with a populated CAPI set (22,725 elements).
• Invoked the existing reload path.
• The nftables table was replaced and the bouncer child PID changed, while
  the procd-managed outer PID remained the same.
• The CAPI set remained absent for at least 60 seconds / six update cycles.
• Repeating the lifecycle using a full restart recreated all dynamic origin
  sets and hydrated 31,940 decisions.
• The resulting generation had populated CAPI, blocklist, and local CrowdSec
  sets, and authenticated LAPI access remained healthy.

This intentionally changes only the config-change lifecycle; the explicit
reload command remains available through the existing reload trigger.

[openwrt]

Formality Check: Failed

We checked this pull request against the contribution guidelines. Here is what needs your attention:

🛑 CRITICAL ERRORS

Commit 6245333 - crowdsec-firewall-bouncer: restart on config changes:

• Author name format is invalid ('Wolfbeta'). Please set your full name (first and last, e.g. 'Jane Doe').
• Committer name format is invalid ('Wolfbeta'). Please set your full name (first and last, e.g. 'Jane Doe').
• Commit description body is empty or contains only trailers (e.g. Signed-off-by). Please provide a meaningful description of what this change does and why
• Missing 'Signed-off-by:' line. Please add a line at the end of the commit message in the format 'Signed-off-by: Your Name [email protected]', matching your commit author or committer identity.

⚠️ STYLISTIC WARNINGS & SUGGESTIONS

Package Release Audit:

• ⚠️ Content changed in these packages, but without a PKG_RELEASE or version bump:

  • net/crowdsec-firewall-bouncer

  Increment PKG_RELEASE by 1 (or bump PKG_VERSION/PKG_SOURCE_DATE and reset PKG_RELEASE to 1) so users receive the update.

Do not increment release for minor changes. Cosmetic edits (e.g., typos in comments, copyright updates, formatting/whitespace), changing the package maintainer (PKG_MAINTAINER), or updating source download info (PKG_SOURCE_URL / PKG_HASH) do not require incrementing PKG_RELEASE.

Tip

Do not close this pull request to make corrections. Instead, modify your existing commits (e.g. git commit --amend) and update the branch using git push --force-with-lease --force-if-includes. The checks will re-run automatically.

---

_{Something broken? Consider reporting an issue.
Running version 3eeda58 deployed on 2026-08-18 11:06:29 CEST}

[openwrt-ai]

Reviewed 1 new commit. The reload -> restart switch for the crowdsec config trigger looks correct and the diagnosis in the PR body is consistent with what the init script does; two inline notes, neither of which blocks a merge on its own — the main one is that the degraded reload path is still reachable through the other trigger and through a manual reload.

---

Generated by Claude Code

[openwrt-ai]

This redirects one entry point, but the broken reload path stays reachable. The script defines no reload_service(), so with USE_PROCD=1 reload() in rc.common falls through to plain start — which re-runs init_nftables() (nft delete table ip crowdsec + recreate) without ever going through stop/service_stopped, and procd only respawns the instance if the instance parameters changed. Since the command line is identical across reloads, that is exactly the state described in the PR body: table replaced, dynamic sets gone, nothing to repopulate them.

So /etc/init.d/crowdsec-firewall-bouncer reload typed by hand, the reload_config ubus event, and the procd_add_reload_trigger on line 18 all still take that path. The PR body's "the explicit reload command remains available through the existing reload trigger" reads as if reload is a working alternative, but by this analysis it is the defect itself.

Would it make sense to also make the fallback safe, e.g. adding

reload_service() {
	restart
}

so every reload entry point gets the same lifecycle, rather than only the crowdsec config trigger?

---

Generated by Claude Code

[openwrt-ai]

nit: pre-existing, but since this PR is about the trigger set it is worth a look. _procd_add_reload_trigger expands to a config.change trigger on the UCI package named here, i.e. /etc/config/crowdsec-firewall-bouncer. No package in the feed installs that file — this one installs /etc/config/crowdsec and net/crowdsec installs the same path — so this trigger never fires and the line below is the only live one.

If that reading is right, this line could be dropped (or pointed at crowdsec, which would then duplicate the line below) as part of the same cleanup.

---

Generated by Claude Code