add anubis

botPolicy.yaml

@@ -0,0 +1,85 @@
+# based off of:
+# https://codeberg.org/Codeberg-Infrastructure/scripted-configuration/src/commit/7ffebf4c40967edd2c9fa1eca4e715046c775efd/hosts/anubis/etc/anubis/forgejo.botPolicies.yaml
+# which is:
+# Copyright (C) 2022 by Codeberg e.V., codeberg@codeberg.org
+#
+# Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is
+# hereby granted.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE
+# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE
+# FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+# OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+bots:
+    - name: libre-chip-registration
+      path_regex: ^/user/sign_up
+      action: CHALLENGE
+      challenge:
+          difficulty: 4
+          report_as: 4 
+          algorithm: fast
+
+    - import: (data)/bots/_deny-pathological.yaml
+    - import: (data)/bots/aggressive-brazilian-scrapers.yaml
+    - import: (data)/meta/ai-block-aggressive.yaml
+
+    - import: (data)/crawlers/_allow-good.yaml
+
+    - import: (data)/clients/x-firefox-ai.yaml
+    - import: (data)/common/keep-internet-working.yaml
+
+    - name: generic-browser
+      user_agent_regex: >-
+        Mozilla|Opera
+      action: WEIGH
+      weight:
+        adjust: 10
+
+    - name: session-token
+      action: WEIGH
+      expression:
+        all:
+          - '"Cookie" in headers'
+          - 'headers["Cookie"].contains("i_like_gitea=")'
+      weight:
+        adjust: -5 # Allow nojs challenge.
+
+dnsbl: false
+
+status_codes:
+  CHALLENGE: 200
+  DENY: 200
+
+thresholds:
+  - name: no-suspicion
+    expression: weight <= 0 # If no rule flagged the request, then do not issue a challenge.
+    action: ALLOW
+  - name: mild-suspicion
+    expression:
+      all:
+        - weight > 0
+        - weight < 10
+    action: CHALLENGE
+    challenge:
+      algorithm: metarefresh
+      difficulty: 1
+      report_as: 1
+  - name: moderate-suspicion
+    expression:
+      all:
+        - weight >= 10
+        - weight < 20
+    action: CHALLENGE
+    challenge:
+      algorithm: fast
+      difficulty: 2
+      report_as: 2
+  - name: extreme-suspicion
+    expression: weight >= 20
+    action: CHALLENGE
+    challenge:
+      algorithm: fast
+      difficulty: 4
+      report_as: 4

docker-compose.yml

@@ -26,7 +26,7 @@ services:
       - NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx
       - NGINX_ENVSUBST_FILTER=^(BASE_DOMAIN_NAME|ALT_BASE_DOMAIN_NAME)$$
     links:
-      - forgejo
+      - anubis
       - mail
     networks:
       - net_with_ipv6
@@ -75,6 +75,34 @@ services:
       - net_with_ipv6
     # labels:  # enable when stalwart has a stable release channel
     #   - "com.centurylinklabs.watchtower.enable=true"
+  anubis:
+    image: ghcr.io/techarohq/anubis:latest
+    environment:
+      BIND: ":80"
+      DIFFICULTY: "4"
+      TARGET: "http://forgejo:3000"
+      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
+      PUBLIC_URL: "https://git.${BASE_DOMAIN_NAME}"
+      COOKIE_DOMAIN: "git.${BASE_DOMAIN_NAME}"
+      COOKIE_SAME_SITE: Strict
+      REDIRECT_DOMAINS: "git.${BASE_DOMAIN_NAME}"
+      WEBMASTER_EMAIL: "postmaster@${BASE_DOMAIN_NAME}"
+    healthcheck:
+      test: ["CMD", "anubis", "--healthcheck"]
+      interval: 5s
+      timeout: 30s
+      retries: 5
+      start_period: 500ms
+    expose:
+      - '80'
+    volumes:
+      - "./botPolicy.yaml:/data/cfg/botPolicy.yaml:ro"
+    links:
+      - forgejo
+    networks:
+      - net_with_ipv6
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
 
 networks:
   net_with_ipv6:

nginx_templates/conf.d/default.conf.template

@@ -35,7 +35,7 @@ server {
     }
 
     location / {
-        proxy_pass http://forgejo:3000;
+        proxy_pass http://anubis;
 
         proxy_set_header Connection $http_connection;
         proxy_set_header Upgrade $http_upgrade;