Adds Anubis as a sidecar container to the Gitea pod to protect against AI crawlers and scrapers.
How it works
Anubis sits in front of Gitea and presents a lightweight proof-of-work challenge to clients that look like bots. Legitimate browsers solve it transparently; most scrapers give up.
Ingress → Anubis (:8080) → Gitea (:3000)
Changes
chart.yaml — adds extraContainers with Anubis sidecar + additionalPorts entry for port 8080
ingress.yaml — routes to anubis port instead of http
anubis-secret.yaml — placeholder with instructions for the required secret
kustomization.yaml — includes the new secret manifest
Before applying
Create the signing key secret (one-time, not stored in git):
DIFFICULTY — currently 4 (default). Increase to make the challenge harder for crawlers.
SERVE_ROBOTS_TXT — true, so Anubis controls robots.txt (disallows all crawlers)
OG_PASSTHROUGH — true, so OpenGraph link previews work normally
## What
Adds [Anubis](https://anubis.techaro.lol) as a sidecar container to the Gitea pod to protect against AI crawlers and scrapers.
## How it works
Anubis sits in front of Gitea and presents a lightweight proof-of-work challenge to clients that look like bots. Legitimate browsers solve it transparently; most scrapers give up.
```
Ingress → Anubis (:8080) → Gitea (:3000)
```
## Changes
- **`chart.yaml`** — adds `extraContainers` with Anubis sidecar + `additionalPorts` entry for port 8080
- **`ingress.yaml`** — routes to `anubis` port instead of `http`
- **`anubis-secret.yaml`** — placeholder with instructions for the required secret
- **`kustomization.yaml`** — includes the new secret manifest
## Before applying
Create the signing key secret (one-time, not stored in git):
```sh
kubectl create secret generic anubis-key \
--namespace gitea \
--from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
```
## Tunables
- `DIFFICULTY` — currently `4` (default). Increase to make the challenge harder for crawlers.
- `SERVE_ROBOTS_TXT` — `true`, so Anubis controls robots.txt (disallows all crawlers)
- `OG_PASSTHROUGH` — `true`, so OpenGraph link previews work normally
Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.
Changes:
- Add Anubis as an extraContainers sidecar in the Gitea HelmRelease
- Listens on :8080, proxies to Gitea at http://localhost:3000
- DIFFICULTY=4 (default; tune up to increase challenge strength)
- SERVE_ROBOTS_TXT=true (Anubis manages robots.txt)
- OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews)
- Signs challenges with ED25519 key from 'anubis-key' secret
- Add anubis port (8080) to Gitea service via additionalPorts
- Update Ingress to route to the 'anubis' port instead of 'http'
- Add anubis-secret.yaml placeholder with creation instructions
One-time setup required before applying:
kubectl create secret generic anubis-key \
--namespace gitea \
--from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
Good call — dropped the anubis-secret.yaml file, removed it from kustomization.yaml, and stripped the ED25519_PRIVATE_KEY_HEX env var from the container spec. Anubis will auto-generate a key on startup.
Good call — dropped the `anubis-secret.yaml` file, removed it from `kustomization.yaml`, and stripped the `ED25519_PRIVATE_KEY_HEX` env var from the container spec. Anubis will auto-generate a key on startup.
Understood — thanks for the heads up. Since it was merged manually with major changes, I'll treat the current main branch as the source of truth. If you want me to review what landed (vs. what was in the PR) or document the differences, just say the word.
Understood — thanks for the heads up. Since it was merged manually with major changes, I'll treat the current `main` branch as the source of truth. If you want me to review what landed (vs. what was in the PR) or document the differences, just say the word.
Pull request closed
Please reopen this pull request to perform a merge.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
greg
What
Adds Anubis as a sidecar container to the Gitea pod to protect against AI crawlers and scrapers.
How it works
Anubis sits in front of Gitea and presents a lightweight proof-of-work challenge to clients that look like bots. Legitimate browsers solve it transparently; most scrapers give up.
Changes
chart.yaml— addsextraContainerswith Anubis sidecar +additionalPortsentry for port 8080ingress.yaml— routes toanubisport instead ofhttpanubis-secret.yaml— placeholder with instructions for the required secretkustomization.yaml— includes the new secret manifestBefore applying
Create the signing key secret (one-time, not stored in git):
Tunables
DIFFICULTY— currently4(default). Increase to make the challenge harder for crawlers.SERVE_ROBOTS_TXT—true, so Anubis controls robots.txt (disallows all crawlers)OG_PASSTHROUGH—true, so OpenGraph link previews work normally@@ -0,0 +1,23 @@# Secret for Anubis ED25519 signing key.This entire file can then be removed from the PR.
@@ -122,0 +137,4 @@value: ":8080"- name: DIFFICULTYvalue: "4"- name: ED25519_PRIVATE_KEY_HEXThis secret is unnecessary. I do not need to persist the value, and if one is unspecified then Anubis will generate one on its own.
Good call — dropped the
anubis-secret.yamlfile, removed it fromkustomization.yaml, and stripped theED25519_PRIVATE_KEY_HEXenv var from the container spec. Anubis will auto-generate a key on startup.Merged manually, but with major changes.
Understood — thanks for the heads up. Since it was merged manually with major changes, I'll treat the current
mainbranch as the source of truth. If you want me to review what landed (vs. what was in the PR) or document the differences, just say the word.Pull request closed