Referencing this post: https://forum.opnsense.org/index.php?topic=47580.0
I was trying to get a GeoIP exception list to work, which I can't seem to get to work, and restarted the Crowdsec service to restart from the Dashboard Services. When I did that, Crowdsec refused to start, even after rebooting the OPN machine.
Following that post, I found it odd that I had to disable the ruleset to get it started.
1.Has there been a workaround planned or in place that I am missing, and...
2.Has anyone had any luck with creating an exception list by DNS names? I even asked Grok about solutions, which was to put my alias in a network group alias and replace my rule with that group. It told me that IPs were preferred, but domain names sometimes have multiple providers/IPs and that's going to be more time consuming. It's just easier to disable GeoIP, get what I want, then re-enable it. Not a great solution, and yes my rule is above the GeoIP rule.
According to the docs at https://docs.opnsense.org/manual/aliases.html you can indeed use fully-qualified domain names in aliases, though I haven't tried that myself.
I am not what the Crowdsec service has to do with your GeoIP problem and I can't really comment as to what's going on with CrowdSec, so I'll focus on the GeoIP problem.
Re. exceptions lists and changes to firewall rules: The firewall is stateful, so if you change certain rules (or aliases which affect rules) you might need to reset its state at irewall: Diagnostics: States on the action tab. For good measure I usually click both button there.
Also your problem might be solved by setting your GeoIP firewall rule as an inbound rule on the WAN interface only and not on any of the LAN interfaces and VLANs. That way all your own actions, e.g. using a website in a blocked country still should work. (Don't forget to reset the firewall state after making the change.) If that doesn't help, you'll need to explain in greater detail, what scenario are you trying to cover with GeoIP and show your firewall rules.