chore(gitea/anubis): remove anubis-secret from kustomization

Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.

Changes:
- Add Anubis as an extraContainers sidecar in the Gitea HelmRelease
  - Listens on :8080, proxies to Gitea at http://localhost:3000
  - DIFFICULTY=4 (default; tune up to increase challenge strength)
  - SERVE_ROBOTS_TXT=true (Anubis manages robots.txt)
  - OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews)
  - Signs challenges with ED25519 key from 'anubis-key' secret
- Add anubis port (8080) to Gitea service via additionalPorts
- Update Ingress to route to the 'anubis' port instead of 'http'
- Add anubis-secret.yaml placeholder with creation instructions

One-time setup required before applying:
  kubectl create secret generic anubis-key \
    --namespace gitea \
    --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)

home/baseline/ssh.nix

@@ -13,23 +13,25 @@
     includes = [ "config.local" ];
     enableDefaultConfig = false;
 
-    settings =
+    matchBlocks =
       let
         nas = {
-          User = "admin";
+          user = "admin";
         };
         owned = {
-          User = "greg";
+          user = "greg";
         };
       in
       {
         inherit nas;
 
         "*" = {
-          DynamicForward = [ "10240" ];
-          ServerAliveInterval = 60;
-          LogLevel = "error";
-          SetEnv = { TERM = "xterm-256color"; };
+          dynamicForwards = [ { port = 10240; } ];
+          serverAliveInterval = 60;
+          extraOptions = {
+            LogLevel = "error";
+            SetEnv = "TERM=xterm-256color";
+          };
         };
 
         "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -39,46 +41,46 @@
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
         gh = {
-          User = "git";
-          Hostname = "github.com";
+          user = "git";
+          hostname = "github.com";
         };
         "src" = {
-          User = "git";
-          Hostname = "jeremiah.shire-zebra.ts.net";
-          Port = 32222;
+          user = "git";
+          hostname = "jeremiah.shire-zebra.ts.net";
+          port = 32222;
         };
         srcpub = {
-          User = "git";
-          Hostname = "src.thehellings.com";
-          Port = 2222;
+          user = "git";
+          hostname = "src.thehellings.com";
+          port = 2222;
         };
         ivr = {
-          User = "git";
-          Hostname = "gitlab.com";
+          user = "git";
+          hostname = "gitlab.com";
         };
 
         "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          User = "gregory.hellings";
+          user = "gregory.hellings";
         };
 
         "*.thehellings.lan" = owned;
         "10.42.*" = owned;
 
         "host.crosswire.org crosswire" = {
-          Hostname = "host.crosswire.org";
-          User = "ghellings";
+          hostname = "host.crosswire.org";
+          user = "ghellings";
         };
 
         fedpeople = {
-          Hostname = "fedorapeople.org";
-          User = "greghellings";
+          hostname = "fedorapeople.org";
+          user = "greghellings";
         };
 
         "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          User = "greghellings";
+          user = "greghellings";
         };
 
-        "127.*" = {
+        "127.*".extraOptions = {
           PubkeyAcceptedAlgorithms = "+ssh-rsa";
           HostkeyAlgorithms = "+ssh-rsa";
         };

hosts/unstable/linode/git.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:
 
 let
   srcDomain = "src.thehellings.com";
@@ -6,23 +6,15 @@ let
 in
 {
   greg.proxies."${srcDomain}" = {
-    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
+    target = "https://gitea.shire-zebra.ts.net";
     ssl = true;
     genAliases = false;
     extraConfig = ''
-      #proxy_ssl_verify off;
-      #proxy_ssl_server_name on;
-
-      proxy_set_header X-Real-IP $remote_addr;
-      proxy_set_header X-Http-Version $server_protocol;
-      proxy_set_header User-Agent $http_user_agent;
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
       client_max_body_size 100000m;
-
-      #proxy_set_header Host $host;
-      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      #proxy_set_header X-Forwarded-Proto $scheme;
-      #proxy_set_header X-Forwarded-Ssl on;
-
       # Ultimate AI Block List v1.7 20250924
       # https://perishablepress.com/ultimate-ai-block-list/
 
@@ -95,44 +87,6 @@ in
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
-  services = {
-    anubis = {
-      instances = {
-        git = {
-          enable = true;
-          settings = {
-            BIND = "/run/anubis/anubis-git/anubis.sock";
-            COOKIE_DOMAIN = "thehellings.com";
-            SERVE_ROBOTS_TXT = true;
-            TARGET = "https://gitea.shire-zebra.ts.net/";
-          };
-        };
-      };
-    };
-
-    haproxy = {
-      enable = true;
-      config = ''
-        global
-          daemon
-          maxconn 20
-
-        defaults
-          timeout connect 500s
-          timeout client 500s
-          timeout server 1h
-
-        listen gitsshd
-          bind *:${toString sshPort}
-          timeout client 1h
-          mode tcp
-          server git-isaiah isaiah.shire-zebra.ts.net:32222
-          server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-          server git-zeke zeke.shire-zebra.ts.net:32222
-      '';
-    };
-  };
-
   systemd.services = {
     haproxy = {
       after = [
@@ -144,5 +98,25 @@ in
     };
   };
 
-  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
+  services.haproxy = {
+    enable = true;
+    config = ''
+      global
+        daemon
+        maxconn 20
+
+      defaults
+        timeout connect 500s
+        timeout client 500s
+        timeout server 1h
+
+      listen gitsshd
+        bind *:${toString sshPort}
+        timeout client 1h
+        mode tcp
+        server git-isaiah isaiah.shire-zebra.ts.net:32222
+        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+        server git-zeke zeke.shire-zebra.ts.net:32222
+    '';
+  };
 }

manifests/gitea/chart.yaml

@@ -47,6 +47,12 @@ spec:
         type: LoadBalancer
         port: 32222
         nodePort: 32222
+      # Anubis sidecar port — ingress routes here; Anubis proxies to :3000
+      additionalPorts:
+        - name: anubis
+          port: 8080
+          targetPort: 8080
+          protocol: TCP
 
     gitea:
       admin:
@@ -133,16 +139,14 @@ spec:
             value: "4"
           - name: METRICS_BIND
             value: ":9090"
-          - name: POLICY_FNAME
-            value: "/etc/anubis/policy.yaml"
           - name: SERVE_ROBOTS_TXT
             value: "true"
           - name: TARGET
             value: "http://localhost:3000"
-        volumeMounts:
-          - name: anubis-policy
-            mountPath: /etc/anubis
-            readOnly: true
+          - name: OG_PASSTHROUGH
+            value: "true"
+          - name: OG_EXPIRY_TIME
+            value: "24h"
         resources:
           limits:
             cpu: "750m"
@@ -161,11 +165,6 @@ spec:
           seccompProfile:
             type: RuntimeDefault
 
-    extraVolumes:
-      - name: anubis-policy
-        configMap:
-          name: anubis-policy
-
     strategy:
       type: RollingUpdate
       rollingUpdate:

manifests/gitea/ingress.yaml

@@ -8,7 +8,8 @@ spec:
     service:
       name: gitea-release-http
       port:
-        name: http
+        # Route through Anubis anti-crawler sidecar instead of directly to Gitea
+        name: anubis
   tls:
     - hosts:
         - gitea

manifests/gitea/secrets.yaml

@@ -15,8 +15,8 @@ spec:
         storage: |-
           MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
           MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
-        #minio_key: "{{ .minio_nas1_key }}"
-        #minio_secret: "{{ .minio_nas1_secret }}"
+        minio_key: "{{ .minio_nas1_key }}"
+        minio_secret: "{{ .minio_nas1_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore