Local edits to /etc/nginx/conf.d/crowdsec_nginx.conf are silently discarded on every package reinstall/upgrade
/etc/nginx/conf.d/crowdsec_nginx.conf is not registered as a dpkg conffile:
$ dpkg-query -W -f='${Conffiles}\n' crowdsec-nginx-bouncer
/etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf be1ad541c5dfedbbebbd0bf65c33200d
Only crowdsec-nginx-bouncer.conf is tracked. crowdsec_nginx.conf is dropped as a plain package-owned file, so any locally required nginx-level directive in it — resolver, lua_shared_dict size, lua_ssl_verify_depth, lua_ssl_trusted_certificate, etc. — is silently overwritten on every apt install --reinstall and every version upgrade, with no prompt and no diff shown.
Why this matters
Some of these directives aren't cosmetic — they're required to fix real operational issues that aren't covered by crowdsec-nginx-bouncer.conf's own options:
lua_ssl_verify_depth needs raising when the CrowdSec LAPI or a captcha/appsec backend sits behind an intermediate cert chain deeper than nginx's default verify depth — without it, TLS verification fails with certificate chain errors.
lua_shared_dict crowdsec_cache frequently needs to be sized above the shipped 50m default on busier hosts to avoid cache churn.
resolver sometimes needs to point at another DNS, especially in environments where egress to specific resolvers is restricted.
Right now the only ways to keep these are:
- Remember to manually reapply the edit after every reinstall/upgrade (error-prone, easy to miss, no warning that it happened).
- dpkg-divert the file out of package control entirely — but this also silently swallows upstream changes to the file (e.g. the lua_package_path move from /usr/lib/crowdsec/lua/ to /usr/local/lua/crowdsec/ between versions, or the embedded bouncer version string in cs.init(...)), which then have to be manually diffed and merged back in by hand.
- An external apt/dpkg hook that re-patches the file after every transaction — works, but it's third-party tooling compensating for something the package could handle natively.
Suggested fixes (any one of these would resolve it)
Option A — Register it as a conffile. Gives users the standard dpkg behavior (preserve-on-modify, prompt-on-conflicting-upgrade) they already expect for crowdsec-nginx-bouncer.conf.
Option B — Split out a user-override include. Ship crowdsec_nginx.conf as-is (package-owned, safe to overwrite), but have it include a second file, e.g. crowdsec_nginx.local.conf, that the package creates empty/untouched if it doesn't already exist and never overwrites afterward. Directives like lua_ssl_verify_depth, resolver, or an overridden lua_shared_dict size could go there. This also protects users from upstream structural changes to the main file, since only the override file is theirs.
Option C — Document the divert pattern officially. If neither A nor B is feasible, at minimum documenting the dpkg-divert approach (and what to re-diff after upgrades) in the nginx bouncer docs would save others from re-discovering this the hard way.
Environment
Package: crowdsec-nginx-bouncer (Debian/Ubuntu apt package, v1.1.6)
Confirmed via dpkg-query -W -f='${Conffiles}\n' crowdsec-nginx-bouncer that /etc/nginx/conf.d/crowdsec_nginx.conf is absent from the conffiles list while /etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf is present.
Happy to test a patch.
Local edits to
/etc/nginx/conf.d/crowdsec_nginx.confare silently discarded on every package reinstall/upgrade/etc/nginx/conf.d/crowdsec_nginx.confis not registered as a dpkg conffile:Only
crowdsec-nginx-bouncer.confis tracked.crowdsec_nginx.confis dropped as a plain package-owned file, so any locally required nginx-level directive in it — resolver, lua_shared_dict size, lua_ssl_verify_depth, lua_ssl_trusted_certificate, etc. — is silently overwritten on every apt install --reinstall and every version upgrade, with no prompt and no diff shown.Why this matters
Some of these directives aren't cosmetic — they're required to fix real operational issues that aren't covered by crowdsec-nginx-bouncer.conf's own options:
lua_ssl_verify_depth needs raising when the CrowdSec LAPI or a captcha/appsec backend sits behind an intermediate cert chain deeper than nginx's default verify depth — without it, TLS verification fails with certificate chain errors.
lua_shared_dict crowdsec_cache frequently needs to be sized above the shipped 50m default on busier hosts to avoid cache churn.
resolver sometimes needs to point at another DNS, especially in environments where egress to specific resolvers is restricted.
Right now the only ways to keep these are:
Suggested fixes (any one of these would resolve it)
Option A — Register it as a conffile. Gives users the standard dpkg behavior (preserve-on-modify, prompt-on-conflicting-upgrade) they already expect for
crowdsec-nginx-bouncer.conf.Option B — Split out a user-override include. Ship
crowdsec_nginx.confas-is (package-owned, safe to overwrite), but have it include a second file, e.g.crowdsec_nginx.local.conf, that the package creates empty/untouched if it doesn't already exist and never overwrites afterward. Directives like lua_ssl_verify_depth, resolver, or an overridden lua_shared_dict size could go there. This also protects users from upstream structural changes to the main file, since only the override file is theirs.Option C — Document the divert pattern officially. If neither A nor B is feasible, at minimum documenting the dpkg-divert approach (and what to re-diff after upgrades) in the nginx bouncer docs would save others from re-discovering this the hard way.
Environment
Package:
crowdsec-nginx-bouncer(Debian/Ubuntu apt package, v1.1.6)Confirmed via
dpkg-query -W -f='${Conffiles}\n' crowdsec-nginx-bouncerthat/etc/nginx/conf.d/crowdsec_nginx.confis absent from the conffiles list while/etc/crowdsec/bouncers/crowdsec-nginx-bouncer.confis present.Happy to test a patch.