How does the Trusted Networks registry differ from the Cloudflare allowlist?

[jmrGrav]

There seem to be two overlapping concepts for safe IPs:

1. The Trusted Networks registry (internal/trustednetworks/) with entries for Google, Cloudflare, Anthropic, etc.
2. The Cloudflare allowlist that gets synced via the CF API

What is the difference between these two?

• Does adding something to Trusted Networks automatically add it to the Cloudflare allowlist?
• What is the Mode: enforce vs Mode: shadow distinction?
• Why are some entries hard_ban_allowed: false?
• What does the CrowdSec spoke add beyond Cloudflare?

[jmrGrav]

Trusted Networks is policy; Cloudflare allowlist is enforcement

These two are different layers of the same system.

Trusted Networks registry

The registry (internal/trustednetworks/registry.go) is the source of truth — a declarative list of network owners that should never be banned. Each entry has:

type RegistryEntry struct {
    Organization      string    // human name
    CIDRs             []string  // IP ranges
    Kind              string    // "crawler", "monitoring", "infrastructure"
    HardBanAllowed    bool      // whether a ban is ever permitted
    CloudflareWhitelist string  // sync status to CF
    CrowdSecAllowlist string    // sync status to CS
}

It is platform-agnostic — it defines intent, not mechanism.

Cloudflare allowlist

The CF allowlist is one spoke of the enforcement plane. The daemon reconciles the registry CIDRs into a CF Firewall Rule that passthrough-allows those ranges before any WAF rule triggers. It is one push target.

The spoke model

Trusted Networks Registry
        │
        ├─ Cloudflare spoke  →  CF Firewall allowlist rules
        └─ CrowdSec spoke    →  CrowdSec allowlist (via cf-allowlist-sync helper)

Each spoke can be individually enabled/disabled. Adding a CIDR to the registry propagates to all enabled spokes on the next reconciliation cycle.

Mode: shadow vs enforce

Mode	Behavior
shadow	Registry is read, diffs computed, but nothing is pushed. Operator can see what would change.
enforce	Registry CIDRs are actively synced to all enabled spokes.

Shadow mode is the safe default — you can run the daemon for days observing what it would do before committing to enforcement.

hard_ban_allowed: false

Certain entries (Cloudflare IPs, Google crawlers) have hard_ban_allowed: false. This means even if the ban pipeline fires (e.g., burst_counter hits threshold), the system refuses to issue a ban for these IPs. The protection is enforced at the decision layer, not just the allowlist sync layer — belt and suspenders.

CrowdSec spoke purpose

CrowdSec operates independently of Cloudflare. A threat blocked at the CF WAF layer is not automatically blocked at the CrowdSec/iptables layer. The CrowdSec spoke ensures that trusted networks are also exempted from CrowdSec decisions, preventing a scenario where Cloudflare passes traffic through but CrowdSec blocks it at the host level.