blocklist
Manage 8 threat-intel feeds behind guard. It never changes firewall rules; refresh writes its cache and init writes blocklist configuration.
Synopsis
caddy-analyze blocklist <action> [flags]
# actions: refresh | list | config | initFlags
| Flag | Default | Description |
|---|---|---|
--cache-dir | ~/.cache/caddy-analyzer/blocklists | Cache directory |
--no-default-blocklists | false | Disable 8 defaults (use with --blocklist-config for custom-only) |
--blocklist-config | Path to JSON with extra sources [{"name","url","format"}] | |
--blocklist-remove | Names to remove (comma-separated) | |
-f, --format | table | table or json for list/config |
Default feeds
| Name | Format |
|---|---|
| Spamhaus DROP v4/v6 | JSON Lines |
| FireHOL level 1 / 2 | netset |
| CINS Army | plain |
| Tor exit nodes | plain |
| Emerging Threats | plain |
| AbuseIPDB mirror | plain |
Minimal example
read-only
caddy-analyze blocklist refresh
caddy-analyze blocklist listAdvanced example
Custom feeds + JSON output; init persists settings to configuration.
caddy-analyze blocklist config -f json | jq
# add custom + remove one default
caddy-analyze blocklist --blocklist-config my.json --blocklist-remove tor-exit-nodes list
# persist so guard picks it up without CLI flags (see Configuration)
caddy-analyze blocklist --no-default-blocklists --blocklist-config my.json init