root
dc083ddf1a
Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers. Changes: - Add Anubis as an extraContainers sidecar in the Gitea HelmRelease - Listens on :8080, proxies to Gitea at http://localhost:3000 - DIFFICULTY=4 (default; tune up to increase challenge strength) - SERVE_ROBOTS_TXT=true (Anubis manages robots.txt) - OG_PASSTHROUGH=true (OpenGraph bots pass through for link previews) - Signs challenges with ED25519 key from 'anubis-key' secret - Add anubis port (8080) to Gitea service via additionalPorts - Update Ingress to route to the 'anubis' port instead of 'http' - Add anubis-secret.yaml placeholder with creation instructions One-time setup required before applying: kubectl create secret generic anubis-key \ --namespace gitea \ --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
24 lines
920 B
YAML
24 lines
920 B
YAML
# Secret for Anubis ED25519 signing key.
|
|
# Create with:
|
|
# kubectl create secret generic anubis-key \
|
|
# --namespace gitea \
|
|
# --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
|
|
# This file is a placeholder so kustomization knows the secret must exist.
|
|
# The secret is NOT managed here to avoid storing the key in git.
|
|
#
|
|
# If using external-secrets or agenix, replace this comment block with
|
|
# the appropriate ExternalSecret / SealedSecret manifest.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: anubis-key
|
|
namespace: gitea
|
|
annotations:
|
|
# Managed manually — do not overwrite with kustomize apply
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
type: Opaque
|
|
# data is intentionally empty; populate via:
|
|
# kubectl create secret generic anubis-key --namespace gitea \
|
|
# --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32) \
|
|
# --dry-run=client -o yaml | kubectl apply -f -
|