travisshears / Anubis Config

bots: - name: php path_regex: php$ action: DENY - name: api-calls expression: any: - 'method == "POST"' - 'method == "PATCH"' - 'method == "DELETE"' - 'path.contains("/api/")' action: ALLOW # Defaults taken from https://github.com/TecharoHQ/anubis/blob/main/data/botPolicies.yaml # Pathological bots to deny - import: (data)/bots/_deny-pathological.yaml - import: (data)/bots/aggressive-brazilian-scrapers.yaml - import: (data)/meta/ai-block-aggressive.yaml # Search engine crawlers to allow, defaults to: - import: (data)/crawlers/_allow-good.yaml # Challenge Firefox AI previews - import: (data)/clients/x-firefox-ai.yaml # Allow common "keeping the internet working" routes (well-known, favicon, robots.txt) - import: (data)/common/keep-internet-working.yaml # Generic catchall rule - name: generic-browser user_agent_regex: >- Mozilla|Opera action: WEIGH weight: adjust: 10 # The weight thresholds for when to trigger individual challenges. Any # CHALLENGE will take precedence over this. # # A threshold has four configuration options: # # - name: the name that is reported down the stack and used for metrics # - expression: A CEL expression with the request weight in the variable # weight # - action: the Anubis action to apply, similar to in a bot policy # - challenge: which challenge to send to the user, similar to in a bot policy # # See https://anubis.techaro.lol/docs/admin/configuration/thresholds for more # information. thresholds: # By default Anubis ships with the following thresholds: - name: minimal-suspicion # This client is likely fine, its soul is lighter than a feather expression: weight <= 0 # a feather weighs zero units action: ALLOW # Allow the traffic through # For clients that had some weight reduced through custom rules, give them a # lightweight challenge. - name: mild-suspicion expression: all: - weight > 0 - weight < 10 action: CHALLENGE challenge: # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh algorithm: metarefresh difficulty: 1 report_as: 1 # For clients that are browser-like but have either gained points from custom rules or # report as a standard browser. - name: moderate-suspicion expression: all: - weight >= 10 - weight < 20 action: CHALLENGE challenge: # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work algorithm: fast difficulty: 2 # two leading zeros, very fast for most clients report_as: 2 # For clients that are browser like and have gained many points from custom rules - name: extreme-suspicion expression: weight >= 20 action: CHALLENGE challenge: # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work algorithm: fast difficulty: 4 report_as: 4

services: # Anubis service for personal site protection anubis-001-personal-site: image: ghcr.io/techarohq/anubis:latest restart: unless-stopped container_name: anubis network_mode: host volumes: - "./botPolicy.yaml:/botPolicy.yaml:ro" environment: TARGET: "http://127.0.0.1:5019" COOKIE_DOMAIN: "travisshears.com" SERVE_ROBOTS_TXT: "true" BIND: "127.0.0.1:5018" METRICS_BIND: "127.0.0.1:5020" POLICY_FNAME: "/botPolicy.yaml"

server { server_name travisshears.com; access_log /var/log/nginx/travisshears.pre-anubis.com.access.log json_logs; error_log /var/log/nginx/travisshears.pre-anubis.com.error.log; proxy_set_header Origin $http_origin; proxy_set_header HOST $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Http-Version $server_protocol; client_max_body_size 25M; location / { limit_except GET HEAD OPTIONS { proxy_pass personal-site-url } proxy_pass http://anubis-001; } ... } server { if ($host = travisshears.com) { return 301 https://$host$request_uri; } listen 80; listen [::]:80 ; server_name travisshears.com; return 404; } server { server_name travisshears.com; listen 127.0.0.1:5019; access_log /var/log/nginx/travisshears.post-anubis.com.access.log json_logs; error_log /var/log/nginx/travisshears.post-anubis.com.error.log; # Get the visiting IP from the TLS termination server set_real_ip_from unix:; real_ip_header X-Real-IP; location / { proxy_pass personal-site-url } } upstream anubis-001 { server 127.0.0.1:5018; keepalive 30; }