fix: do not claim mastery of TS net

Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.

flake.lock

@@ -239,11 +239,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779125151,
-        "narHash": "sha256-bPHT0oJAHe5a43lkkSGAiCEg/RBqpwv5xsFrcj+Bog8=",
+        "lastModified": 1779507042,
+        "narHash": "sha256-7wOwi8B6D0BYsieZCnHZZj2sNUzgJhLoIVSfkwB7lxQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fab3fd7327a0ac7a1fae5095bf140377704fac7f",
+        "rev": "509ed3c603349a9d43de9e2ae6613baea6bd5b34",
         "type": "github"
       },
       "original": {
@@ -281,11 +281,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1778039471,
-        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "lastModified": 1779508581,
+        "narHash": "sha256-qZjcS4jRe0pUv4ZAFCyr7ELFrb3LPLr+5u8LHRZjMVQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "rev": "e13397b445bb0dcb390f90126914113ec5dd5afe",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1778839878,
-        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
+        "lastModified": 1779223902,
+        "narHash": "sha256-qQogttCU2zOyK7MN85yPaUxxN2u0BN9zabfO4X7FwNg=",
         "owner": "Mic92",
         "repo": "niks3",
-        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
+        "rev": "1db826ca990cb3dead5c033bcfba4bf68ce9fc05",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
     },
     "nix-hardware": {
       "locked": {
-        "lastModified": 1779099457,
-        "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
+        "lastModified": 1779258371,
+        "narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
+        "rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
         "type": "github"
       },
       "original": {
@@ -413,11 +413,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1778491576,
-        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
+        "lastModified": 1779142197,
+        "narHash": "sha256-Fypu3KtYQ+ZXL91CZIGqS3ZKwrMH6GOSPCtJ07W3ecU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
+        "rev": "d4d6b67b138722feb847a75760a430943c33f4ef",
         "type": "github"
       },
       "original": {
@@ -429,11 +429,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1779508470,
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1779508470,
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -484,11 +484,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1779116047,
-        "narHash": "sha256-2BnXm4/BvR5B0CH8nxC4CL+y+Z7woqPbPxKO7IMH85U=",
+        "lastModified": 1779554657,
+        "narHash": "sha256-qjLcUp7DBpmSUL+nVjLymp2nEvAzeKKoAVDCRgZYxFk=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "1367315826ebda2bebbf896029f44ac05df523f5",
+        "rev": "1a380f12453ba97ad8cc9c60f223afb1cb8bace8",
         "type": "github"
       },
       "original": {
@@ -504,11 +504,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1779124721,
-        "narHash": "sha256-Z1q8QkuHAdkmXh4SItOzViVVFVLb+tzaEaYCTHI2UKk=",
+        "lastModified": 1779579389,
+        "narHash": "sha256-YbWzWejE/QRBLQN9VKBL66byuTFPvncQgiv4NC25lN4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "ad57d8faf36bb02c65c90012cd0289daa0b2d9c4",
+        "rev": "65439f69b3bcf6b26b8a7c92c26bd09066fdf9c5",
         "type": "github"
       },
       "original": {
@@ -644,11 +644,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1779077424,
-        "narHash": "sha256-2nuxPFMR1R3IlV/OlF65qjs2gGjHhASa7U0+8QX0bJg=",
+        "lastModified": 1779507994,
+        "narHash": "sha256-vw/u69n4vPibpWNUVkbwlfVHQukg3xcuKoHwCXJkOvc=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "b7bde1772cdb20e77381516fbbb5306a621d0965",
+        "rev": "375f9dc68aa90ccff57891af5dfe1d5fb2a9b20a",
         "type": "github"
       },
       "original": {

home/baseline/ssh.nix

@@ -13,25 +13,23 @@
     includes = [ "config.local" ];
     enableDefaultConfig = false;
 
-    matchBlocks =
+    settings =
       let
         nas = {
-          user = "admin";
+          User = "admin";
         };
         owned = {
-          user = "greg";
+          User = "greg";
         };
       in
       {
         inherit nas;
 
         "*" = {
-          dynamicForwards = [ { port = 10240; } ];
-          serverAliveInterval = 60;
-          extraOptions = {
-            LogLevel = "error";
-            SetEnv = "TERM=xterm-256color";
-          };
+          DynamicForward = [ "10240" ];
+          ServerAliveInterval = 60;
+          LogLevel = "error";
+          SetEnv = { TERM = "xterm-256color"; };
         };
 
         "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -41,46 +39,46 @@
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
         gh = {
-          user = "git";
-          hostname = "github.com";
+          User = "git";
+          Hostname = "github.com";
         };
         "src" = {
-          user = "git";
-          hostname = "jeremiah.shire-zebra.ts.net";
-          port = 32222;
+          User = "git";
+          Hostname = "jeremiah.shire-zebra.ts.net";
+          Port = 32222;
         };
         srcpub = {
-          user = "git";
-          hostname = "src.thehellings.com";
-          port = 2222;
+          User = "git";
+          Hostname = "src.thehellings.com";
+          Port = 2222;
         };
         ivr = {
-          user = "git";
-          hostname = "gitlab.com";
+          User = "git";
+          Hostname = "gitlab.com";
         };
 
         "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          user = "gregory.hellings";
+          User = "gregory.hellings";
         };
 
         "*.thehellings.lan" = owned;
         "10.42.*" = owned;
 
         "host.crosswire.org crosswire" = {
-          hostname = "host.crosswire.org";
-          user = "ghellings";
+          Hostname = "host.crosswire.org";
+          User = "ghellings";
         };
 
         fedpeople = {
-          hostname = "fedorapeople.org";
-          user = "greghellings";
+          Hostname = "fedorapeople.org";
+          User = "greghellings";
         };
 
         "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          user = "greghellings";
+          User = "greghellings";
         };
 
-        "127.*".extraOptions = {
+        "127.*" = {
           PubkeyAcceptedAlgorithms = "+ssh-rsa";
           HostkeyAlgorithms = "+ssh-rsa";
         };

hosts/unstable/genesis/networking.nix

@@ -22,6 +22,7 @@ let
     #"1.0.0.1" # Cloudflare
     #"149.112.112.112" # Quad 9
     metadata.infra.gw # Currently using our UniFi router for DNS as well
+    "100.100.100.100"
   ];
 in
 {
@@ -132,7 +133,7 @@ in
             file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
           })
           {
-            "shire-zebra.ts.net" = "tailscale";
+            #"shire-zebra.ts.net" = "tailscale";
             "nebula.thehellings.com" = "nebula";
             nebula = "nebula";
             "thehellings.lan" = "lan";

hosts/unstable/jeremiah/default.nix

@@ -142,12 +142,12 @@ in
             updateOutputs = false;
           };
         };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
         evalMaxMemorySize = 8192;
         evalWorkerCount = 4;
         gitea = {
           enable = true;
-          instanceUrl = "https://src.thehellings.com";
+          instanceUrl = "https://gitea.shire-zebra.ts.net";
           oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
           oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
           tokenFile = config.age.secrets.gitea-oauthToken.path;

hosts/unstable/linode/git.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 let
   srcDomain = "src.thehellings.com";
@@ -6,15 +6,23 @@ let
 in
 {
   greg.proxies."${srcDomain}" = {
-    target = "https://gitea.shire-zebra.ts.net";
+    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
     ssl = true;
     genAliases = false;
     extraConfig = ''
-      proxy_ssl_verify off;
-      proxy_ssl_server_name on;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Ssl on;
+      #proxy_ssl_verify off;
+      #proxy_ssl_server_name on;
+
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Http-Version $server_protocol;
+      proxy_set_header User-Agent $http_user_agent;
       client_max_body_size 100000m;
+
+      #proxy_set_header Host $host;
+      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      #proxy_set_header X-Forwarded-Proto $scheme;
+      #proxy_set_header X-Forwarded-Ssl on;
+
       # Ultimate AI Block List v1.7 20250924
       # https://perishablepress.com/ultimate-ai-block-list/
 
@@ -87,6 +95,44 @@ in
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
+  services = {
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            TARGET = "https://gitea.shire-zebra.ts.net/";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          daemon
+          maxconn 20
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.shire-zebra.ts.net:32222
+          server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+          server git-zeke zeke.shire-zebra.ts.net:32222
+      '';
+    };
+  };
+
   systemd.services = {
     haproxy = {
       after = [
@@ -98,25 +144,5 @@ in
     };
   };
 
-  services.haproxy = {
-    enable = true;
-    config = ''
-      global
-        daemon
-        maxconn 20
-
-      defaults
-        timeout connect 500s
-        timeout client 500s
-        timeout server 1h
-
-      listen gitsshd
-        bind *:${toString sshPort}
-        timeout client 1h
-        mode tcp
-        server git-isaiah isaiah.shire-zebra.ts.net:32222
-        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-        server git-zeke zeke.shire-zebra.ts.net:32222
-    '';
-  };
+  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
 }

manifests/gitea/chart.yaml

@@ -66,8 +66,8 @@ spec:
           APP_NAME: "Gitea: Greg's Cup of Git"
           RUN_MODE: dev
         server:
-          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://src.thehellings.com"
+          DOMAIN: "shire-zebra.ts.net"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres
@@ -119,6 +119,53 @@ spec:
         cpu: "100m"
         memory: "2Gi"
 
+    # Anubis anti-crawler sidecar
+    # Anubis listens on :8080 and proxies to Gitea at http://localhost:3000
+    # Ingress is updated to route to the anubis port instead of http
+    extraContainers:
+      - name: anubis
+        image: ghcr.io/techarohq/anubis:latest
+        imagePullPolicy: Always
+        env:
+          - name: BIND
+            value: ":8080"
+          - name: DIFFICULTY
+            value: "4"
+          - name: METRICS_BIND
+            value: ":9090"
+          - name: POLICY_FNAME
+            value: "/etc/anubis/policy.yaml"
+          - name: SERVE_ROBOTS_TXT
+            value: "true"
+          - name: TARGET
+            value: "http://localhost:3000"
+        volumeMounts:
+          - name: anubis-policy
+            mountPath: /etc/anubis
+            readOnly: true
+        resources:
+          limits:
+            cpu: "750m"
+            memory: "256Mi"
+          requests:
+            cpu: "250m"
+            memory: "256Mi"
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+
+    extraVolumes:
+      - name: anubis-policy
+        configMap:
+          name: anubis-policy
+
     strategy:
       type: RollingUpdate
       rollingUpdate:

manifests/gitea/secrets.yaml

@@ -15,8 +15,8 @@ spec:
         storage: |-
           MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
           MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
-        minio_key: "{{ .minio_nas1_key }}"
-        minio_secret: "{{ .minio_nas1_secret }}"
+        #minio_key: "{{ .minio_nas1_key }}"
+        #minio_secret: "{{ .minio_nas1_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore

network.json

@@ -14,7 +14,7 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
       "external": true,
       "ts": "100.119.228.115",
-      "aliases": [ "s3" ]
+      "aliases": ["s3"]
     },
     "exodus": {
       "ip": null,