# Roadmap

_Refreshed September 23, 2026. Plans, not promises: priorities can shift with user feedback._

- Next: graduate beta with idempotent install, preflight checks, backup/rollback, and a support bundle.
- Then: a unified `unifi-sec` CLI for status/update/doctor/uninstall plus multi-device inventory.
- Later: Grafana dashboards and unattended upgrade channels after the core lifecycle is stable.

---

## Earlier roadmap notes

Development direction for the CrowdSec UniFi ecosystem.

---

## Current: v1.0 (March 2026)

**Suite provides a unified server-side stack.** Individual repos remain independently installable.

### What's shipped

- `docker-compose.yml` — one-command server-side stack (CrowdSec + Sidecar + Blocklist Import)
- `install.sh` — SSH installer for UDM/UDR devices
- Individual repos for standalone installation or development

### Repositories

| Repo | What it does |
|------|-------------|
| [crowdsec-unifi-bouncer](https://github.com/wolffcatskyy/crowdsec-unifi-bouncer) | Enforces CrowdSec decisions on UniFi firewall rules |
| [crowdsec-sidecar](https://github.com/wolffcatskyy/crowdsec-unifi-bouncer/tree/main/sidecar) | Scores and caps decisions to fit device ipset capacity |
| [crowdsec-blocklist-import](https://github.com/wolffcatskyy/crowdsec-blocklist-import) | Imports external threat feeds (AbuseIPDB, Spamhaus, IPsum) |
| [crowdsec-unifi-parser](https://github.com/wolffcatskyy/crowdsec-unifi-parser) | Parses UniFi firewall logs for CrowdSec scenarios |
| crowdsec-unifi-suite (this repo) | Unified stack + installer |

---

## v1.1 (Planned)

### Shared `.env` convention

Standardize environment variable names across all repos so the suite `.env` works
as a single source of truth for all components. No more per-component credential files.

### Grafana dashboard

Pre-built dashboard combining panels from all components:
- Sidecar: decision volume, cap events, scoring distribution
- Blocklist Import: feeds health, deduplication rate, decision counts by source
- Bouncer: sync frequency, ban/unban events, ipset fill level

### CrowdSec CTI enrichment

Optional integration with CrowdSec's free CTI API (50 calls/day):
- Enrich sidecar scoring with threat classification data
- Badge high-confidence IPs from the CrowdSec threat database
- No key required for basic tier

### UniFi log auto-detection

The installer currently requires manual log path configuration.
Auto-detect `/var/log/messages` format across UDM OS versions and configure
the parser without user intervention.

---

## v1.2 (Future)

### Unified CLI

```bash
# Install everything with one command
crowdsec-unifi setup

# Check stack health
crowdsec-unifi status

# View live bans
crowdsec-unifi bans

# Update all components
crowdsec-unifi update
```

### Cross-component health monitoring

Lightweight status endpoint on the suite's nginx that aggregates:
- CrowdSec LAPI health
- Sidecar decision cache stats
- Blocklist import last-run result
- Bouncer last-sync timestamp

Expose as a single `/health` endpoint for uptime monitors (UptimeRobot, Uptime Kuma, etc.).

### Spamhaus + AlienVault OTX reporting

Report confirmed malicious IPs from your network back upstream:
- Spamhaus SBL submission (high-confidence SSH brute force)
- AlienVault OTX pulse contributions
- AbuseIPDB reporting (already available in sidecar)

### nftables support

Modern UniFi OS versions (3.2+) include nftables. Migration path when iptables
is deprecated in a future firmware, with automatic detection of available backend.

### Multi-device support

A single server-side stack serving multiple UniFi devices on the same network,
each with its own capacity profile and sidecar instance.

---

## Contributing

Open an issue with the `roadmap` label to discuss prioritization or propose new items.

> 🤖 *This project is maintained with AI assistance. All issue responses are generated by Claude AI.*