greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat(gitea): add Anubis anti-crawler sidecar #24

Closed
klaatu wants to merge 4 commits from feat/anubis-gitea into main
pull from: feat/anubis-gitea
merge into: :main
Conversation 4 Commits 4 Files Changed 2
+48 -1
4 Commits
Author SHA1 Message Date
klaatu aa4afea341 chore(gitea/anubis): remove anubis-secret from kustomization
buildbot/nix-eval Build done. (1 warning)
Details
buildbot/nix-build Build done.
Details
2026-05-21 06:05:54 +00:00
klaatu b12731a100 chore(gitea/anubis): remove anubis-secret.yaml, no manual secret needed
buildbot/nix-eval Build done.
Details
2026-05-21 06:05:42 +00:00
klaatu ce2c9c76a7 chore(gitea/anubis): remove ED25519 secret env var, Anubis auto-generates key
buildbot/nix-eval Build done.
Details
2026-05-21 06:05:34 +00:00
root dc083ddf1a feat(gitea): add Anubis anti-crawler sidecar
buildbot/nix-eval Build done. (1 warning)
Details
buildbot/nix-build Build done.
Details 
Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.

Changes:
- Add Anubis as an extraContainers sidecar in the Gitea HelmRelease
  - Listens on :8080, proxies to Gitea at http://localhost:3000
  - DIFFICULTY=4 (default; tune up to increase challenge strength)
  - SERVE_ROBOTS_TXT=true (Anubis manages robots.txt)
  - OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews)
  - Signs challenges with ED25519 key from 'anubis-key' secret
- Add anubis port (8080) to Gitea service via additionalPorts
- Update Ingress to route to the 'anubis' port instead of 'http'
- Add anubis-secret.yaml placeholder with creation instructions

One-time setup required before applying:
  kubectl create secret generic anubis-key \
    --namespace gitea \
    --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
 2026-05-20 03:34:42 -05:00