diff --git a/IPAM.md b/IPAM.md index 71c3b08..88a77c1 100644 --- a/IPAM.md +++ b/IPAM.md @@ -75,11 +75,11 @@ Global DNS: `fant0mib0t.renoux.dev` | 222 | Gitea SSH | | | 2000 | Matrix | `matrix.fantomitechno.dev` | | 2010 | Tranquill PDS | `pds.fantomitechno.dev` | -| 2020,2021 | Mastodon | `mastodon.fantomitechno.dev` | +| 2020, 2021 | Mastodon | `mastodon.fantomitechno.dev` | | 3000 | Graphana | `graph.fantom.home` | | 3001, 3002, 3003 | Prometheus | | | 4000 | Tangled Knot | `knot.fantomitechno.dev` | -| 4005 | Gitea | `git.fantomitechno.dev` | +| 4005 | Gitea (Behind Anubis) | `git.fantomitechno.dev` | | 4010 | Tangled Spindle | `spindle.fantomitechno.dev` | | 4020, 4021 | Cryptpad | `drive.renoux.dev`, `drive.s.renoux.dev` | | 4030 | Kiwix | `kiwix.fantomitechno.dev`, `kiwix.renoux.dev` | diff --git a/docker/fant0mib0t/gitea/botPolicy.yaml b/docker/fant0mib0t/gitea/botPolicy.yaml new file mode 100644 index 0000000..a8d11c7 --- /dev/null +++ b/docker/fant0mib0t/gitea/botPolicy.yaml @@ -0,0 +1,82 @@ +## Anubis has the ability to let you import snippets of configuration into the main +## configuration file. This allows you to break up your config into smaller parts +## that get logically assembled into one big file. +## +## Of note, a bot rule can either have inline bot configuration or import a +## bot config snippet. You cannot do both in a single bot rule. +## +## Import paths can either be prefixed with (data) to import from the common/shared +## rules in the data folder in the Anubis source tree or will point to absolute/relative +## paths in your filesystem. If you don't have access to the Anubis source tree, check +## /usr/share/docs/anubis/data or in the tarball you extracted Anubis from. + +bots: + # You can import the entire default config with this macro: + - import: (data)/meta/default-config.yaml + +dnsbl: false + +status_codes: + CHALLENGE: 200 + DENY: 200 + +# The weight thresholds for when to trigger individual challenges. Any +# CHALLENGE will take precedence over this. +# +# A threshold has four configuration options: +# +# - name: the name that is reported down the stack and used for metrics +# - expression: A CEL expression with the request weight in the variable +# weight +# - action: the Anubis action to apply, similar to in a bot policy +# - challenge: which challenge to send to the user, similar to in a bot policy +# +# See https://anubis.techaro.lol/docs/admin/configuration/thresholds for more +# information. +thresholds: + # By default Anubis ships with the following thresholds: + - name: minimal-suspicion # This client is likely fine, its soul is lighter than a feather + expression: weight <= 0 # a feather weighs zero units + action: ALLOW # Allow the traffic through + # For clients that had some weight reduced through custom rules, give them a + # lightweight challenge. + - name: mild-suspicion + expression: + all: + - weight > 0 + - weight < 10 + action: CHALLENGE + challenge: + # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh + algorithm: metarefresh + difficulty: 1 + # For clients that are browser-like but have either gained points from custom rules or + # report as a standard browser. + - name: moderate-suspicion + expression: + all: + - weight >= 10 + - weight < 20 + action: CHALLENGE + challenge: + # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work + algorithm: fast + difficulty: 2 # two leading zeros, very fast for most clients + - name: mild-proof-of-work + expression: + all: + - weight >= 20 + - weight < 30 + action: CHALLENGE + challenge: + # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work + algorithm: fast + difficulty: 4 + # For clients that are browser like and have gained many points from custom rules + - name: extreme-suspicion + expression: weight >= 30 + action: CHALLENGE + challenge: + # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work + algorithm: fast + difficulty: 6 \ No newline at end of file diff --git a/docker/fant0mib0t/gitea/docker-compose.yml b/docker/fant0mib0t/gitea/docker-compose.yml index 2ba0788..5cbbad8 100644 --- a/docker/fant0mib0t/gitea/docker-compose.yml +++ b/docker/fant0mib0t/gitea/docker-compose.yml @@ -1,6 +1,29 @@ name: gitea services: - server: + anubis: + image: ghcr.io/techarohq/anubis:latest + container_name: anubis + environment: + BIND: ":8080" + DIFFICULTY: "4" + METRICS_BIND: ":9090" + SERVE_ROBOTS_TXT: "true" + TARGET: "http://gitea:30000" + POLICY_FNAME: "/data/cfg/botPolicy.yaml" + OG_PASSTHROUGH: "true" + OG_EXPIRY_TIME: "24h" + healthcheck: + test: ["CMD", "anubis", "--healthcheck"] + interval: 5s + timeout: 30s + retries: 5 + start_period: 500ms + ports: + - 127.0.0.1:4005:8080 + volumes: + - "./botPolicy.yaml:/data/cfg/botPolicy.yaml:ro" + + gitea: image: docker.gitea.com/gitea:1.26.4 container_name: gitea env_file: .env @@ -10,7 +33,6 @@ services: - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro ports: - - "127.0.0.1:4005:3000" - "222:22" depends_on: - db diff --git a/modules/caddy/fant0mib0t b/modules/caddy/fant0mib0t index e9da6f6..d20f036 100644 --- a/modules/caddy/fant0mib0t +++ b/modules/caddy/fant0mib0t @@ -41,6 +41,13 @@ spindle.fantomitechno.dev { reverse_proxy 127.0.0.1:4001 } +git.fantomitechno.dev { + import logging gitea + reverse_proxy 127.0.0.1:4005 { + header_up X-Real-Ip {remote_host} + } +} + hold.fantomitechno.dev { import logging hold reverse_proxy 127.0.0.1:4010 diff --git a/modules/cli-apps/ssh_config b/modules/cli-apps/ssh_config index e038357..29058f4 100644 --- a/modules/cli-apps/ssh_config +++ b/modules/cli-apps/ssh_config @@ -1,4 +1,9 @@ Host knot.fantomitechno.dev User git - Hostname 100.116.20.78 - Port 2222 + Hostname 172.16.20.10 + Port 22 + +Host git.fantomitechno.dev + User git + Hostname 172.16.20.20 + Port 222