proxy: add Anubis bot protection#2017
Conversation
Route public dashboard traffic through an Anubis sidecar before it reaches the existing NGINX API and static-file handlers. Pin the stable v1.25.0 image and wait for its health check before starting the proxy.\n\nImport Anubis's default policy after an explicit allow rule for curl, wget, python-requests, and kci-dev user agents so documented API clients bypass browser challenges. Document the deployment and secure-cookie override. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
| volumes: | ||
| - ./anubis/botPolicy.yaml:/data/cfg/botPolicy.yaml:ro | ||
| healthcheck: | ||
| test: ["CMD", "anubis", "--healthcheck"] |
There was a problem hiding this comment.
Anubis does give you a nice metrics URL too, which we can wire into grafana in a later date (see how many bots/honeytraps it catches)
|
Can we deploy this to staging pre merge? (assuming it would not land in front of prod, given they share the server) |
Yes, as they are routed externally (host nginx), and anubis are injected between dashboard internal nginx and frontend |
Great! Then let's please see how it interacts with kci-dev , mobile and desktop 😁 |
3 participants
Route public dashboard traffic through an Anubis sidecar before it reaches the existing NGINX API and static-file handlers. Pin the stable v1.25.0 image and wait for its health check before starting the proxy.\n\nImport Anubis's default policy after an explicit allow rule for curl, wget, python-requests, and kci-dev user agents so documented API clients bypass browser challenges. Document the deployment and secure-cookie override.