Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.
Changes:
- Add Anubis as an extraContainers sidecar in the Gitea HelmRelease
- Listens on :8080, proxies to Gitea at http://localhost:3000
- DIFFICULTY=4 (default; tune up to increase challenge strength)
- SERVE_ROBOTS_TXT=true (Anubis manages robots.txt)
- OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews)
- Signs challenges with ED25519 key from 'anubis-key' secret
- Add anubis port (8080) to Gitea service via additionalPorts
- Update Ingress to route to the 'anubis' port instead of 'http'
- Add anubis-secret.yaml placeholder with creation instructions
One-time setup required before applying:
kubectl create secret generic anubis-key \
--namespace gitea \
--from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
- manifests/gitea/dump-cronjob.yaml: Remove --skip-log, --skip-custom-dir,
--skip-db flags to make backup complete
- manifests/gitea/dump-cronjob.yaml: Replace NFS volume + cleanup container
with S3 upload to backup-gitea bucket using MinIO client (mc).
30-day lifecycle set via mc ilm. Uses minio_key/minio_secret from
existing gitea-config secret.
- hosts/unstable/hosea/default.nix: Replace raw services.restic.backups.albyhub
block with greg.backup.jobs.albyhub using the greg.backup module.
Remove manual age.secrets.restic-env and age.secrets.restic-pw entries
since the greg.backup module declares them.
root
greg
klaatu