chore(gitea/anubis): remove anubis-secret from kustomization

chore(gitea/anubis): remove anubis-secret.yaml, no manual secret needed
chore(gitea/anubis): remove ED25519 secret env var, Anubis auto-generates key
2026-05-21 06:05:54 +00:00 · 2026-05-21 06:05:42 +00:00 · 2026-05-21 06:05:34 +00:00 · 2026-05-20 03:34:42 -05:00
15 changed files with 240 additions and 196 deletions
@@ -31,11 +31,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1780652294,
-        "narHash": "sha256-pW0RrDJvj8EcbxXPxWVwMQ+x8LdEij3S3oB+inIUeKU=",
+        "lastModified": 1779096866,
+        "narHash": "sha256-8HtF1G7OPMXzo+f+0W+7zwzhuBUSk2EMrOS4ZvFw7+I=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "b16ef5c60459c94bd7f512977908c69b6e53b1e0",
+        "rev": "891f2baba218f4365f0c6ef96ea33f9b277f5ed0",
        "type": "github"
      },
      "original": {
@@ -239,11 +239,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780679734,
-        "narHash": "sha256-KmRNvpNOb7QEORa06bVgjW9kITcx0VhsI7w0vhmZyD8=",
+        "lastModified": 1779125151,
+        "narHash": "sha256-bPHT0oJAHe5a43lkkSGAiCEg/RBqpwv5xsFrcj+Bog8=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "b2b7db486e06e098711dc291bb25db82850e1d16",
+        "rev": "fab3fd7327a0ac7a1fae5095bf140377704fac7f",
        "type": "github"
      },
      "original": {
@@ -281,11 +281,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1780375694,
-        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
+        "lastModified": 1778039471,
+        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
+        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
        "type": "github"
      },
      "original": {
@@ -300,11 +300,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1780530521,
-        "narHash": "sha256-728J4gTwpnug5C6QpnPbFyceYlfhPeX6SEP/K4PPbVs=",
+        "lastModified": 1778839878,
+        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
        "owner": "Mic92",
        "repo": "niks3",
-        "rev": "c9a54708e881d51a76309168c5cda516bb2daeb0",
+        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
        "type": "github"
      },
      "original": {
@@ -335,15 +335,12 @@
      }
    },
    "nix-hardware": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_4"
-      },
      "locked": {
-        "lastModified": 1780310866,
-        "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=",
+        "lastModified": 1779099457,
+        "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "4ed851c979641e28597a05086332d75cdc9e395f",
+        "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
        "type": "github"
      },
      "original": {
@@ -385,11 +382,11 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1780195591,
-        "narHash": "sha256-/LAL+E75c0ioCHxyVFGwzXorfuHzToKgqPUCRq4RTIY=",
+        "lastModified": 1778984393,
+        "narHash": "sha256-r755Kh5Q0XBTPNuv9rL2rsUJTq8BDhb+lIwRWhl6yYA=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "49d924421d7c3175edc499fdc738bd70d69d97d5",
+        "rev": "0d14a58ab7aa3f513c58ccc9e47e77ffd92be204",
        "type": "github"
      },
      "original": {
@@ -416,11 +413,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1780475387,
-        "narHash": "sha256-JsufhU/MyfEEJMNmtmW0DY6LbOVIjjPS0zGQpHvgrBY=",
+        "lastModified": 1778491576,
+        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c8560a2e8ad260841c482fe30731087b92f2223e",
+        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
        "type": "github"
      },
      "original": {
@@ -432,24 +429,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1780243769,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
        "type": "github"
      },
      "original": {
@@ -459,7 +443,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_6": {
+    "nixpkgs_5": {
      "locked": {
        "lastModified": 1777207419,
        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
@@ -477,11 +461,11 @@
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1780243769,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
        "type": "github"
      },
      "original": {
@@ -500,11 +484,11 @@
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1780646548,
-        "narHash": "sha256-Ckyl/l1XBmEwnaHcHD8PvBZk1uph0NqwbJ//CAvB7iE=",
+        "lastModified": 1779116047,
+        "narHash": "sha256-2BnXm4/BvR5B0CH8nxC4CL+y+Z7woqPbPxKO7IMH85U=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "816a15282e58678dde831477964987d0262d4293",
+        "rev": "1367315826ebda2bebbf896029f44ac05df523f5",
        "type": "github"
      },
      "original": {
@@ -517,14 +501,14 @@
    "nurpkgs": {
      "inputs": {
        "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1780789357,
-        "narHash": "sha256-YrZPqCwHzUYb+fbH9tp8T90x3pN37D7onc4X7+bzktc=",
+        "lastModified": 1779124721,
+        "narHash": "sha256-Z1q8QkuHAdkmXh4SItOzViVVFVLb+tzaEaYCTHI2UKk=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "55cbac785808e7e62aee241f5b789b8f5adb8e95",
+        "rev": "ad57d8faf36bb02c65c90012cd0289daa0b2d9c4",
        "type": "github"
      },
      "original": {
@@ -600,16 +584,15 @@
    },
    "systems_3": {
      "locked": {
-        "lastModified": 1774449309,
-        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
-        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
-        "ref": "future-26.11",
        "repo": "default",
        "type": "github"
      }
@@ -643,11 +626,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780220602,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "lastModified": 1775636079,
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
@@ -658,14 +641,14 @@
    },
    "vsext": {
      "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1780718391,
-        "narHash": "sha256-hQOS9bTTzVXQNYaW4bi2EyXN8jqDe7ge07xPPbvUMuA=",
+        "lastModified": 1779077424,
+        "narHash": "sha256-2nuxPFMR1R3IlV/OlF65qjs2gGjHhASa7U0+8QX0bJg=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "e2ccd7477aa7174e34bd32c135dc470a3f822a82",
+        "rev": "b7bde1772cdb20e77381516fbbb5306a621d0965",
        "type": "github"
      },
      "original": {
@@ -682,11 +665,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780765279,
-        "narHash": "sha256-md6QHmlIx40bQkun43M2eT8aav5GURGkXEMFwof6uZs=",
+        "lastModified": 1777732699,
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "3e6d8af994e2a2d31af7a91863d7c0d6e278d951",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
        "type": "github"
      },
      "original": {
@@ -13,23 +13,25 @@
    includes = [ "config.local" ];
    enableDefaultConfig = false;

-    settings =
+    matchBlocks =
      let
        nas = {
-          User = "admin";
+          user = "admin";
        };
        owned = {
-          User = "greg";
+          user = "greg";
        };
      in
      {
        inherit nas;

        "*" = {
-          DynamicForward = [ "10240" ];
-          ServerAliveInterval = 60;
+          dynamicForwards = [ { port = 10240; } ];
+          serverAliveInterval = 60;
+          extraOptions = {
            LogLevel = "error";
-          SetEnv = { TERM = "xterm-256color"; };
+            SetEnv = "TERM=xterm-256color";
+          };
        };

        "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -39,46 +41,46 @@
        "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;

        gh = {
-          User = "git";
-          Hostname = "github.com";
+          user = "git";
+          hostname = "github.com";
        };
        "src" = {
-          User = "git";
-          Hostname = "jeremiah.shire-zebra.ts.net";
-          Port = 32222;
+          user = "git";
+          hostname = "jeremiah.shire-zebra.ts.net";
+          port = 32222;
        };
        srcpub = {
-          User = "git";
-          Hostname = "src.thehellings.com";
-          Port = 2222;
+          user = "git";
+          hostname = "src.thehellings.com";
+          port = 2222;
        };
        ivr = {
-          User = "git";
-          Hostname = "gitlab.com";
+          user = "git";
+          hostname = "gitlab.com";
        };

        "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          User = "gregory.hellings";
+          user = "gregory.hellings";
        };

        "*.thehellings.lan" = owned;
        "10.42.*" = owned;

        "host.crosswire.org crosswire" = {
-          Hostname = "host.crosswire.org";
-          User = "ghellings";
+          hostname = "host.crosswire.org";
+          user = "ghellings";
        };

        fedpeople = {
-          Hostname = "fedorapeople.org";
-          User = "greghellings";
+          hostname = "fedorapeople.org";
+          user = "greghellings";
        };

        "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          User = "greghellings";
+          user = "greghellings";
        };

-        "127.*" = {
+        "127.*".extraOptions = {
          PubkeyAcceptedAlgorithms = "+ssh-rsa";
          HostkeyAlgorithms = "+ssh-rsa";
        };
@@ -36,14 +36,14 @@
      ".pip/pip.conf".text = ''
        [global]
        retries = 1
-        index-url = https://pypi.python.org/
+        index-url = https://pypi.python.org/simple
        extra-index-url =
-            https://pypidev.ivrtechnology.com/
+            https://pypidev.ivrtechnology.com/simple/
      '';
      ".config/uv/uv.toml".text = ''
        index-strategy = "unsafe-first-match"
        [[index]]
-        url = "https://pypidev.ivrtechnology.com/"
+        url = "https://pypidev.ivrtechnology.com/simple/"
        name = "pypidev"
        ignore-error-codes = [403]
      '';
@@ -26,16 +26,12 @@ in
      ansible
      awscli2
      cargo
-      clippy
      direnv
-      go
      home-manager
      just
      mcp-grafana
-      nil
      nixVersions.stable
      podman
-      podman-compose
      poetry
      pre-commit
      (pulumi.withPackages (
@@ -49,7 +45,6 @@ in
      ))
      python
      rustc
-      rustfmt
      terraform
    ];
  };
@@ -22,7 +22,6 @@ let
    #"1.0.0.1" # Cloudflare
    #"149.112.112.112" # Quad 9
    metadata.infra.gw # Currently using our UniFi router for DNS as well
-    "100.100.100.100"
  ];
 in
 {
@@ -133,7 +132,7 @@ in
            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
          })
          {
-            #"shire-zebra.ts.net" = "tailscale";
+            "shire-zebra.ts.net" = "tailscale";
            "nebula.thehellings.com" = "nebula";
            nebula = "nebula";
            "thehellings.lan" = "lan";
@@ -0,0 +1,70 @@
+{
+  lib,
+  metadata,
+  pkgs,
+  ...
+}:
+let
+  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
+  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
+  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
+  getTS = get "ts" tps;
+  getIP = get "ip" ips;
+  whitelists = builtins.concatStringsSep "," (
+    [
+      "localhost"
+      "127.0.0.1"
+    ]
+    ++ getTS
+    ++ getIP
+  );
+in
+{
+  services = {
+    prowlarr = {
+      enable = true;
+      dataDir = "/arr/prowlarr";
+      openFirewall = true;
+    };
+    radarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    transmission = {
+      enable = true;
+      openPeerPorts = true;
+      openRPCPort = true;
+      package = pkgs.transmission_4;
+      settings = {
+        download-dir = "/arr/transmission/downloads";
+        rpc-bind-address = "0.0.0.0";
+        rpc-host-whitelist = whitelists;
+        rpc-host-whitelist-enabled = false;
+        rpc-whitelist = whitelists;
+        rpc-whitelist-enabled = false;
+        watch-dir-enabled = true;
+        watch-dir = "/arr/transmission/incoming";
+      };
+    };
+  };
+
+  systemd.mounts =
+    let
+      nfs = name: {
+        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
+        type = "nfs";
+        name = "${name}.mount";
+        where = "/${name}";
+        requires = [ "tailscaled-autoconnect.service" ];
+        after = [ "tailscaled-autoconnect.service" ];
+        wantedBy = [ "multi-user.target" ];
+        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
+      };
+    in
+    [
+      (nfs "arr")
+      (nfs "music")
+      (nfs "photos")
+      (nfs "video")
+    ];
+}
@@ -18,6 +18,7 @@ in
 {
  imports = [
    # Include the results of the hardware scan.
+    ./arr.nix
    ./hardware-configuration.nix
    top.niks3.nixosModules.niks3
  ];
@@ -199,25 +200,6 @@ in
    };
  };

-  systemd.mounts =
-    let
-      nfs = name: {
-        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
-        type = "nfs";
-        name = "${name}.mount";
-        where = "/${name}";
-        requires = [ "tailscaled-autoconnect.service" ];
-        after = [ "tailscaled-autoconnect.service" ];
-        wantedBy = [ "multi-user.target" ];
-        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
-      };
-    in
-    [
-      (nfs "music")
-      (nfs "photos")
-      (nfs "video")
-    ];
-
  # After first deploy: create a Grafana service account + API token for Klaatu
  # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
  age.secrets.grafana-api-token = {
@@ -142,12 +142,12 @@ in
            updateOutputs = false;
          };
        };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net";
        evalMaxMemorySize = 8192;
        evalWorkerCount = 4;
        gitea = {
          enable = true;
-          instanceUrl = "https://gitea.shire-zebra.ts.net";
+          instanceUrl = "https://src.thehellings.com";
          oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
          oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
          tokenFile = config.age.secrets.gitea-oauthToken.path;
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:

 let
  srcDomain = "src.thehellings.com";
@@ -6,23 +6,15 @@ let
 in
 {
  greg.proxies."${srcDomain}" = {
-    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
+    target = "https://gitea.shire-zebra.ts.net";
    ssl = true;
    genAliases = false;
    extraConfig = ''
-      #proxy_ssl_verify off;
-      #proxy_ssl_server_name on;
-
-      proxy_set_header X-Real-IP $remote_addr;
-      proxy_set_header X-Http-Version $server_protocol;
-      proxy_set_header User-Agent $http_user_agent;
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
      client_max_body_size 100000m;
-
-      #proxy_set_header Host $host;
-      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      #proxy_set_header X-Forwarded-Proto $scheme;
-      #proxy_set_header X-Forwarded-Ssl on;
-
      # Ultimate AI Block List v1.7 20250924
      # https://perishablepress.com/ultimate-ai-block-list/

@@ -95,22 +87,18 @@ in

  networking.firewall.allowedTCPPorts = [ sshPort ];

-  services = {
-    anubis = {
-      instances = {
-        git = {
-          enable = true;
-          settings = {
-            BIND = "/run/anubis/anubis-git/anubis.sock";
-            COOKIE_DOMAIN = "thehellings.com";
-            SERVE_ROBOTS_TXT = true;
-            TARGET = "https://gitea.shire-zebra.ts.net/";
-          };
-        };
+  systemd.services = {
+    haproxy = {
+      after = [
+        "network-online.target"
+      ];
+      wants = [
+        "network-online.target"
+      ];
    };
  };

-    haproxy = {
+  services.haproxy = {
    enable = true;
    config = ''
      global
@@ -131,18 +119,4 @@ in
        server git-zeke zeke.shire-zebra.ts.net:32222
    '';
  };
-  };
-
-  systemd.services = {
-    haproxy = {
-      after = [
-        "network-online.target"
-      ];
-      wants = [
-        "network-online.target"
-      ];
-    };
-  };
-
-  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
 }
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.6.0"
+      version: "12.5.3"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default

    image:
-      tag: "1.26.2"
+      tag: "1.25.5"

    replicaCount: 1

@@ -47,6 +47,12 @@ spec:
        type: LoadBalancer
        port: 32222
        nodePort: 32222
+      # Anubis sidecar port — ingress routes here; Anubis proxies to :3000
+      additionalPorts:
+        - name: anubis
+          port: 8080
+          targetPort: 8080
+          protocol: TCP

    gitea:
      admin:
@@ -66,8 +72,8 @@ spec:
          APP_NAME: "Gitea: Greg's Cup of Git"
          RUN_MODE: dev
        server:
-          DOMAIN: "shire-zebra.ts.net"
-          ROOT_URL: "https://gitea.shire-zebra.ts.net"
+          DOMAIN: "thehellings.com"
+          ROOT_URL: "https://src.thehellings.com"
          SSH_PORT: "2222"
        database:
          DB_TYPE: postgres
@@ -119,6 +125,46 @@ spec:
        cpu: "100m"
        memory: "2Gi"

+    # Anubis anti-crawler sidecar
+    # Anubis listens on :8080 and proxies to Gitea at http://localhost:3000
+    # Ingress is updated to route to the anubis port instead of http
+    extraContainers:
+      - name: anubis
+        image: ghcr.io/techarohq/anubis:latest
+        imagePullPolicy: Always
+        env:
+          - name: BIND
+            value: ":8080"
+          - name: DIFFICULTY
+            value: "4"
+          - name: METRICS_BIND
+            value: ":9090"
+          - name: SERVE_ROBOTS_TXT
+            value: "true"
+          - name: TARGET
+            value: "http://localhost:3000"
+          - name: OG_PASSTHROUGH
+            value: "true"
+          - name: OG_EXPIRY_TIME
+            value: "24h"
+        resources:
+          limits:
+            cpu: "750m"
+            memory: "256Mi"
+          requests:
+            cpu: "250m"
+            memory: "256Mi"
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+
    strategy:
      type: RollingUpdate
      rollingUpdate:
@@ -8,7 +8,8 @@ spec:
    service:
      name: gitea-release-http
      port:
-        name: http
+        # Route through Anubis anti-crawler sidecar instead of directly to Gitea
+        name: anubis
  tls:
    - hosts:
        - gitea
@@ -15,8 +15,8 @@ spec:
        storage: |-
          MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
          MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
-        #minio_key: "{{ .minio_nas1_key }}"
-        #minio_secret: "{{ .minio_nas1_secret }}"
+        minio_key: "{{ .minio_nas1_key }}"
+        minio_secret: "{{ .minio_nas1_secret }}"
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
@@ -27,7 +27,7 @@ spec:
  chart:
    spec:
      chart: longhorn
-      version: "1.11.2"
+      version: "1.11.1"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -398,25 +398,17 @@
      {
        name = "Media";
        bookmarks = [
-          {
-            name = "Flaresolverr";
-            url = "http://nas1.shire-zebra.ts.net:30098";
-          }
          {
            name = "Prowlarr";
-            url = "http://nas1.shire-zebra.ts.net:30050/";
-          }
-          {
-            name = "Sonarr (TV)";
-            url = "http://nas1.shire-zebra.ts.net:30113/";
-          }
-          {
-            name = "Radarr (Movies)";
-            url = "http://nas1.shire-zebra.ts.net:30025/";
+            url = "https://hosea.shire-zebra.ts.net:9696/";
          }
          {
            name = "Transmission";
-            url = "http://nas1.shire-zebra.ts.net:30096/";
+            url = "https://hosea.shire-zebra.ts.net:9091/";
+          }
+          {
+            name = "Radarr (Movies)";
+            url = "https://hosea.shire-zebra.ts.net:7878/";
          }
        ];
      }
Author	SHA1	Message	Date
klaatu	aa4afea341	chore(gitea/anubis): remove anubis-secret from kustomization buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details	2026-05-21 06:05:54 +00:00
klaatu	b12731a100	chore(gitea/anubis): remove anubis-secret.yaml, no manual secret needed buildbot/nix-eval Build done. Details	2026-05-21 06:05:42 +00:00
klaatu	ce2c9c76a7	chore(gitea/anubis): remove ED25519 secret env var, Anubis auto-generates key buildbot/nix-eval Build done. Details	2026-05-21 06:05:34 +00:00
root	dc083ddf1a	feat(gitea): add Anubis anti-crawler sidecar buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers. Changes: - Add Anubis as an extraContainers sidecar in the Gitea HelmRelease - Listens on :8080, proxies to Gitea at http://localhost:3000 - DIFFICULTY=4 (default; tune up to increase challenge strength) - SERVE_ROBOTS_TXT=true (Anubis manages robots.txt) - OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews) - Signs challenges with ED25519 key from 'anubis-key' secret - Add anubis port (8080) to Gitea service via additionalPorts - Update Ingress to route to the 'anubis' port instead of 'http' - Add anubis-secret.yaml placeholder with creation instructions One-time setup required before applying: kubectl create secret generic anubis-key \ --namespace gitea \ --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)	2026-05-20 03:34:42 -05:00