My Nix Configuration

[marvin.services] Enable anubis

pyrox.dev 67559496 aeb14f56

verified
+14 -2
lib/data/services.toml
···
# Schema:
# port: what port the service uses internally, int
# host: What host the service runs on
-
# extUrl: if needed, the externally accessible domain name of the service
+
# extUrl: (optional) the externally accessible domain name of the service
+
# anubis: What port the anubis service for this domain will use, int
+
# tsHost: (optional) What Tailscale host this service will run on, for services only available via Tailscale.
+
# # Should only be set if this is available externally, if at all, since TS-only services aren't able to be scraped.
[authentik]
port = 6908
host = "marvin"
extUrl = "auth.pyrox.dev"
+
anubis = 8401
[buildbot-server]
port = 6915
···
port = 6904
host = "marvin"
extUrl = "git.pyrox.dev"
+
anubis = 8402
[grafana]
port = 6914
host = "marvin"
extUrl = "stats.pyrox.dev"
+
anubis = 8403
[iceshrimp]
port = 6923
···
port = 8096
host = "marvin"
extUrl = "media.pyrox.dev"
+
anubis = 8404
[matrix-server]
port = 6922
···
port = 6903
host = "marvin"
extUrl = "rss.pyrox.dev"
+
anubis = 8405
[nextcloud]
port = 6926
host = "marvin"
extUrl = "cloud.pyrox.dev"
+
anubis = 8406
[nextcloud-imaginary]
port = 6928
···
port = 6927
host = "marvin"
extUrl = "office.pyrox.dev"
+
anubis = 8407
[pinchflat]
port = 6930
···
port = 6929
host = "marvin"
extUrl = "plan.cs2a.club"
+
anubis = 8408
[prosody]
host = "marvin"
···
[redlib]
port = 6901
host = "marvin"
-
extUrl = "reddit.pyrox.dev"
+
tsHost = "reddit"
[scrutiny]
port = 6931
···
port = 6912
host = "marvin"
extUrl = "bw.pyrox.dev"
+
anubis = 8409
[webmentiond]
port = 6925
+15
packages/anubis-files/default.nix
···
+
{
+
stdenv,
+
...
+
}:
+
stdenv.mkDerivationNoCC {
+
pname = "pyronet-anubis-files";
+
version = "1.0.0";
+
+
src = ./src;
+
+
installPhase = ''
+
mkdir $out
+
install -t $out $src/*
+
'';
+
}
+10
packages/anubis-files/src/policies/authentik.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
- import: (data)/common/keep-internet-working.yaml
+
- name: allow-authentik-applications
+
path_regex: ^/application/o/.*$
+
action: ALLOW
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+10
packages/anubis-files/src/policies/forgejo.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
- import: (data)/common/keep-internet-working.yaml
+
- import: (data)/apps/gitea-rss-feeds.yaml
+
- import: (data)/crawlers/internet-archive.yaml
+
- import: (data)/crawlers/kagibot.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+7
packages/anubis-files/src/policies/grafana.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
- import: (data)/common/keep-internet-working.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+7
packages/anubis-files/src/policies/miniflux.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
- import: (data)/common/keep-internet-working.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+13
packages/anubis-files/src/policies/nextcloud-office.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
+
# Allow requests from the nextcloud server to bypass checks
+
- name: allow-nextcloud-server
+
user_agent_regex: ^Nextcloud Server / richdocuments$
+
action: ALLOW
+
+
- import: (data)/common/keep-internet-working.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+24
packages/anubis-files/src/policies/nextcloud.yaml
···
+
bots:
+
# Block scrapers and abusive cloud providers
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
+
# Allow android apps that I use
+
- name: allow-android-apps
+
user_agent_regex: Nextcloud-android|DAVx5|ICSx5
+
action: ALLOW
+
+
# Allow the Thunderbird Filelink app
+
- name: allow-thunderbird-filelink
+
user_agent_regex: ^Filelink for \*cloud.*$
+
action: ALLOW
+
+
# Allow anyone accessing the **authenticated** DAV endpoint.
+
- name: allow-dav
+
path_regex: ^/remote.php/dav/.*$
+
action: ALLOW
+
+
- import: (data)/common/keep-internet-working.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+7
packages/anubis-files/src/policies/planka.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
- import: (data)/common/keep-internet-working.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+16
packages/anubis-files/src/policies/vaultwarden.yaml
···
+
bots:
+
- import: (data)/bots/ai-robots-txt.yaml
+
- import: ../rules/block/alibaba-cloud.yaml
+
+
# Allow bitwarden apps
+
- name: allow-bitwarden-mobile
+
user_agent_regex: Bitwarden_Mobile
+
action: ALLOW
+
- name: allow-bitwarden-webext
+
user_agent_regex: Mozilla
+
action: ALLOW
+
+
- import: (data)/common/keep-internet-working.yaml
+
- import: ../rules/challenge/generic-browser.yaml
+
+
dnsbl: false
+828
packages/anubis-files/src/rules/block/alibaba-cloud.yaml
···
+
- name: alibaba-cloud
+
action: DENY
+
remote_addresses:
+
[
+
"45.196.28.0/24",
+
"161.117.128.0/17",
+
"8.209.42.0/23",
+
"47.89.125.0/24",
+
"8.222.48.0/20",
+
"47.79.16.0/21",
+
"149.129.16.0/23",
+
"8.212.0.0/17",
+
"47.89.0.0/19",
+
"47.240.128.0/17",
+
"8.213.176.0/20",
+
"47.77.8.0/22",
+
"47.79.96.0/19",
+
"47.246.198.0/23",
+
"47.91.128.0/17",
+
"47.89.104.0/21",
+
"47.89.102.0/24",
+
"8.222.96.0/19",
+
"170.33.31.0/24",
+
"8.215.168.0/24",
+
"8.222.40.0/21",
+
"47.235.1.0/24",
+
"240b:400f::/32",
+
"170.33.32.0/24",
+
"8.208.0.0/18",
+
"47.79.24.0/21",
+
"47.91.16.0/20",
+
"47.252.0.0/17",
+
"8.213.176.0/21",
+
"8.212.0.0/18",
+
"8.211.192.0/18",
+
"47.79.54.0/23",
+
"47.235.18.0/24",
+
"47.88.0.0/17",
+
"43.96.21.0/24",
+
"47.235.22.0/24",
+
"240b:4001::/33",
+
"47.79.64.0/20",
+
"139.95.4.0/23",
+
"47.254.128.0/19",
+
"47.81.64.0/18",
+
"47.77.128.0/18",
+
"240b:4009::/33",
+
"47.246.90.0/23",
+
"47.89.32.0/19",
+
"205.204.125.0/24",
+
"47.79.56.0/23",
+
"240b:400c:100::/41",
+
"47.235.26.0/23",
+
"8.209.64.0/19",
+
"8.222.16.0/20",
+
"47.235.12.0/23",
+
"116.251.64.0/18",
+
"139.95.64.0/24",
+
"47.235.31.0/24",
+
"8.208.32.0/19",
+
"240b:400c:f00::/48",
+
"47.235.6.0/24",
+
"47.246.160.0/21",
+
"47.246.196.0/22",
+
"2404:2280:3000::/37",
+
"47.74.0.0/21",
+
"240b:4007:8000::/33",
+
"47.91.0.0/20",
+
"2400:3200:baba::/48",
+
"198.11.137.0/24",
+
"47.84.168.0/21",
+
"240b:4006:1020::/44",
+
"149.129.192.0/18",
+
"8.219.40.0/21",
+
"43.96.3.0/24",
+
"240b:4004::/32",
+
"47.77.64.0/20",
+
"47.83.48.0/21",
+
"47.77.104.0/21",
+
"240b:4001:8000::/33",
+
"43.96.5.0/24",
+
"240b:400c:180::/41",
+
"43.96.25.0/24",
+
"47.77.96.0/21",
+
"8.211.160.0/19",
+
"47.245.32.0/19",
+
"8.215.0.0/16",
+
"47.79.32.0/20",
+
"8.213.160.0/21",
+
"47.74.0.0/19",
+
"43.96.4.0/24",
+
"170.33.75.0/24",
+
"8.211.128.0/18",
+
"8.217.0.0/16",
+
"47.81.0.0/19",
+
"47.82.96.0/19",
+
"47.83.56.0/21",
+
"203.107.64.0/24",
+
"240b:4006:1020::/45",
+
"240b:4004::/33",
+
"47.242.0.0/15",
+
"47.80.128.0/17",
+
"8.215.0.0/17",
+
"240b:4000::/32",
+
"47.246.192.0/23",
+
"47.246.176.0/21",
+
"8.212.224.0/19",
+
"47.90.0.0/17",
+
"170.33.107.0/24",
+
"47.237.32.0/20",
+
"47.240.0.0/16",
+
"47.253.0.0/16",
+
"161.117.0.0/16",
+
"47.77.12.0/22",
+
"47.88.128.0/17",
+
"8.220.147.0/24",
+
"47.236.0.0/16",
+
"149.129.192.0/19",
+
"170.33.73.0/24",
+
"47.87.160.0/19",
+
"47.79.0.0/20",
+
"47.246.153.0/24",
+
"47.235.29.0/24",
+
"47.81.128.0/18",
+
"43.96.35.0/24",
+
"8.212.128.0/18",
+
"8.219.0.0/16",
+
"47.246.155.0/24",
+
"8.216.64.0/18",
+
"8.213.253.0/24",
+
"8.220.116.0/24",
+
"8.222.128.0/18",
+
"240b:400e:8000::/33",
+
"43.96.33.0/24",
+
"47.77.192.0/18",
+
"47.81.32.0/19",
+
"47.77.8.0/21",
+
"47.79.16.0/20",
+
"240b:400f:8000::/33",
+
"47.246.145.0/24",
+
"47.88.128.0/18",
+
"170.33.104.0/24",
+
"8.219.0.0/17",
+
"47.82.0.0/18",
+
"139.95.10.0/23",
+
"47.238.0.0/16",
+
"240b:4006:1002::/47",
+
"8.221.188.0/22",
+
"8.213.251.0/24",
+
"47.254.192.0/19",
+
"47.79.32.0/21",
+
"8.212.128.0/19",
+
"47.246.83.0/24",
+
"47.87.64.0/19",
+
"8.222.192.0/18",
+
"170.33.68.0/24",
+
"240b:400c:f01::/48",
+
"170.33.136.0/24",
+
"2400:b200:4101::/48",
+
"2401:8680:4100::/48",
+
"240b:400c::/32",
+
"47.89.92.0/22",
+
"8.223.128.0/18",
+
"47.89.124.0/23",
+
"47.74.32.0/19",
+
"47.244.0.0/17",
+
"43.96.80.0/24",
+
"8.211.104.0/21",
+
"8.213.224.0/19",
+
"47.86.0.0/17",
+
"8.222.64.0/21",
+
"240b:400e::/33",
+
"161.117.143.0/24",
+
"47.246.152.0/23",
+
"47.246.93.0/24",
+
"240b:4006:1010::/45",
+
"47.254.224.0/19",
+
"8.209.40.0/22",
+
"149.129.64.0/18",
+
"43.96.20.0/24",
+
"240b:4000:8000::/33",
+
"47.251.0.0/16",
+
"240b:4002::/32",
+
"8.222.16.0/21",
+
"203.107.66.0/24",
+
"8.222.24.0/21",
+
"47.89.128.0/19",
+
"240b:400c:8000::/33",
+
"8.218.128.0/17",
+
"8.216.128.0/17",
+
"47.91.128.0/18",
+
"8.221.64.0/18",
+
"2404:2280:4000::/36",
+
"8.211.80.0/21",
+
"8.217.128.0/17",
+
"8.220.229.0/24",
+
"170.33.66.0/24",
+
"47.237.0.0/16",
+
"47.235.28.0/23",
+
"170.33.74.0/24",
+
"47.90.64.0/18",
+
"47.246.82.0/23",
+
"8.209.38.0/23",
+
"240b:4005:8000::/33",
+
"8.220.128.0/18",
+
"139.95.14.0/23",
+
"8.216.192.0/18",
+
"8.218.0.0/16",
+
"47.91.192.0/18",
+
"8.221.48.0/21",
+
"149.129.8.0/21",
+
"43.91.0.0/16",
+
"8.223.64.0/18",
+
"8.216.148.0/24",
+
"8.222.80.0/21",
+
"2401:b180:4100::/48",
+
"47.91.0.0/19",
+
"47.246.154.0/24",
+
"47.246.152.0/24",
+
"47.250.64.0/18",
+
"8.216.128.0/18",
+
"170.33.72.0/24",
+
"139.95.12.0/23",
+
"240b:400c::/40",
+
"8.221.128.0/18",
+
"43.96.32.0/24",
+
"47.90.128.0/17",
+
"47.251.0.0/17",
+
"43.96.34.0/24",
+
"47.245.0.0/18",
+
"47.85.112.0/23",
+
"8.209.56.0/21",
+
"8.213.252.0/24",
+
"47.77.128.0/17",
+
"139.95.2.0/23",
+
"43.96.69.0/24",
+
"161.117.126.0/24",
+
"47.75.0.0/16",
+
"47.89.82.0/23",
+
"47.89.224.0/19",
+
"8.209.0.0/20",
+
"47.246.128.0/22",
+
"8.221.0.0/21",
+
"139.95.8.0/23",
+
"47.253.128.0/17",
+
"156.236.12.0/24",
+
"203.107.65.0/24",
+
"47.241.128.0/17",
+
"8.222.88.0/21",
+
"47.87.128.0/18",
+
"47.254.128.0/18",
+
"8.221.192.0/18",
+
"240b:4001::/32",
+
"47.235.16.0/24",
+
"240b:4007::/32",
+
"47.235.13.0/24",
+
"47.235.24.0/23",
+
"47.91.80.0/20",
+
"43.96.11.0/24",
+
"47.235.5.0/24",
+
"8.209.160.0/19",
+
"47.246.88.0/23",
+
"47.77.4.0/22",
+
"156.236.17.0/24",
+
"8.209.224.0/19",
+
"14.1.115.0/24",
+
"149.129.96.0/19",
+
"47.254.192.0/18",
+
"47.245.192.0/18",
+
"8.208.0.0/16",
+
"47.83.0.0/16",
+
"47.87.96.0/19",
+
"47.252.64.0/18",
+
"47.89.192.0/18",
+
"47.89.122.0/24",
+
"47.85.114.0/23",
+
"2404:2280:1000::/36",
+
"47.81.128.0/17",
+
"47.246.147.0/24",
+
"47.87.64.0/18",
+
"47.235.9.0/24",
+
"47.52.0.0/17",
+
"47.246.156.0/22",
+
"47.246.96.0/22",
+
"47.74.0.0/18",
+
"8.214.0.0/17",
+
"47.246.192.0/22",
+
"47.246.150.0/24",
+
"43.91.0.0/17",
+
"170.33.138.0/24",
+
"8.213.0.0/18",
+
"47.90.192.0/18",
+
"47.85.0.0/16",
+
"47.235.24.0/22",
+
"47.235.16.0/23",
+
"47.85.128.0/17",
+
"103.81.186.0/23",
+
"8.221.0.0/18",
+
"43.96.7.0/24",
+
"47.79.56.0/21",
+
"240b:4013::/32",
+
"47.89.108.0/22",
+
"47.235.28.0/24",
+
"47.246.82.0/24",
+
"47.91.48.0/20",
+
"185.78.106.0/23",
+
"47.84.160.0/21",
+
"140.205.1.0/24",
+
"47.88.43.0/24",
+
"47.83.32.0/21",
+
"47.91.64.0/19",
+
"43.96.100.0/24",
+
"43.96.72.0/24",
+
"47.87.0.0/18",
+
"8.210.0.0/16",
+
"47.88.192.0/18",
+
"47.88.42.0/24",
+
"170.33.92.0/24",
+
"149.129.32.0/19",
+
"47.52.128.0/17",
+
"47.246.108.0/22",
+
"8.221.56.0/21",
+
"47.253.0.0/17",
+
"110.76.23.0/24",
+
"170.33.65.0/24",
+
"240b:4006::/48",
+
"47.245.0.0/19",
+
"47.77.64.0/19",
+
"8.209.39.0/24",
+
"47.77.96.0/20",
+
"47.80.128.0/18",
+
"170.33.83.0/24",
+
"47.77.32.0/19",
+
"8.212.64.0/18",
+
"43.96.40.0/24",
+
"2400:b200:4102::/48",
+
"43.96.81.0/24",
+
"8.214.0.0/16",
+
"161.117.128.0/24",
+
"43.96.75.0/24",
+
"8.215.160.0/24",
+
"47.77.0.0/22",
+
"47.239.0.0/16",
+
"47.89.76.0/22",
+
"47.82.14.0/23",
+
"43.91.128.0/17",
+
"47.89.88.0/22",
+
"47.79.8.0/21",
+
"240b:4004:8000::/33",
+
"47.246.140.0/22",
+
"43.96.74.0/24",
+
"161.117.127.0/24",
+
"8.212.192.0/19",
+
"240b:4006:1000::/44",
+
"47.80.192.0/18",
+
"47.79.48.0/21",
+
"47.254.64.0/18",
+
"47.246.144.0/23",
+
"47.246.92.0/24",
+
"47.246.66.0/24",
+
"47.246.150.0/23",
+
"47.91.96.0/20",
+
"47.89.98.0/23",
+
"47.77.80.0/20",
+
"8.210.240.0/24",
+
"8.213.0.0/17",
+
"47.250.99.0/24",
+
"47.88.41.0/24",
+
"47.80.32.0/19",
+
"47.250.0.0/17",
+
"43.96.8.0/24",
+
"14.1.112.0/22",
+
"240b:4006:1008::/45",
+
"8.211.224.0/19",
+
"47.84.144.0/21",
+
"47.88.109.0/24",
+
"2400:3200::/48",
+
"47.56.0.0/16",
+
"8.220.192.0/18",
+
"8.223.0.0/17",
+
"8.222.72.0/21",
+
"47.246.69.0/24",
+
"240b:4002:8000::/33",
+
"43.96.66.0/24",
+
"47.246.92.0/23",
+
"47.246.136.0/22",
+
"205.204.117.0/24",
+
"8.222.80.0/20",
+
"47.85.112.0/22",
+
"47.79.128.0/19",
+
"240b:400d:8000::/33",
+
"170.33.64.0/24",
+
"8.222.56.0/21",
+
"240b:400d::/33",
+
"8.222.64.0/20",
+
"47.75.128.0/17",
+
"8.209.48.0/21",
+
"47.57.0.0/16",
+
"139.95.0.0/23",
+
"47.79.192.0/18",
+
"170.33.30.0/24",
+
"47.77.152.0/21",
+
"8.212.192.0/18",
+
"8.213.128.0/19",
+
"47.77.6.0/23",
+
"47.246.32.0/22",
+
"140.205.122.0/24",
+
"47.244.0.0/16",
+
"47.246.158.0/23",
+
"8.209.192.0/19",
+
"170.33.77.0/24",
+
"8.216.69.0/24",
+
"8.213.192.0/19",
+
"47.77.16.0/22",
+
"47.235.10.0/24",
+
"202.144.199.0/24",
+
"47.254.0.0/17",
+
"43.98.128.0/17",
+
"240b:400c::/41",
+
"47.250.128.0/17",
+
"47.89.101.0/24",
+
"47.90.128.0/18",
+
"240b:4013:8000::/33",
+
"8.209.44.0/23",
+
"240b:400c:80::/41",
+
"161.117.129.0/24",
+
"47.91.64.0/20",
+
"8.209.36.0/24",
+
"8.221.8.0/21",
+
"47.82.32.0/19",
+
"47.77.4.0/23",
+
"47.79.72.0/21",
+
"8.212.160.0/19",
+
"170.33.80.0/24",
+
"47.246.156.0/23",
+
"8.220.192.0/19",
+
"47.246.68.0/24",
+
"47.254.160.0/19",
+
"47.82.56.0/21",
+
"8.223.128.0/17",
+
"47.74.128.0/18",
+
"47.77.24.0/23",
+
"170.33.93.0/24",
+
"47.89.72.0/23",
+
"47.84.152.0/21",
+
"240b:400e::/32",
+
"149.129.224.0/19",
+
"2400:b200:4103::/48",
+
"47.87.32.0/19",
+
"47.86.0.0/16",
+
"47.235.4.0/24",
+
"139.95.6.0/23",
+
"47.252.67.0/24",
+
"47.246.123.0/24",
+
"47.81.96.0/19",
+
"43.96.10.0/24",
+
"8.223.0.0/18",
+
"240b:4005::/32",
+
"47.246.130.0/23",
+
"47.91.96.0/19",
+
"240b:400b::/33",
+
"47.246.132.0/23",
+
"8.213.184.0/21",
+
"47.246.124.0/24",
+
"8.209.64.0/18",
+
"2404:2280:3000::/36",
+
"47.89.78.0/23",
+
"47.250.128.0/18",
+
"47.79.128.0/20",
+
"240b:4011::/33",
+
"47.244.128.0/17",
+
"47.246.151.0/24",
+
"8.211.226.0/24",
+
"47.88.135.0/24",
+
"47.80.0.0/18",
+
"43.96.88.0/24",
+
"47.235.6.0/23",
+
"205.204.111.0/24",
+
"240b:4006:1000::/45",
+
"47.250.0.0/18",
+
"47.89.76.0/23",
+
"47.89.99.0/24",
+
"8.211.0.0/17",
+
"47.89.123.0/24",
+
"8.209.128.0/19",
+
"47.246.160.0/20",
+
"43.99.0.0/16",
+
"47.236.0.0/15",
+
"240b:400e:fffe::/48",
+
"47.80.96.0/19",
+
"47.246.184.0/21",
+
"47.235.8.0/24",
+
"8.222.48.0/21",
+
"47.89.94.0/23",
+
"47.245.64.0/18",
+
"47.77.128.0/21",
+
"47.74.192.0/18",
+
"2404:2280:4000::/37",
+
"8.211.88.0/21",
+
"8.213.192.0/18",
+
"8.223.192.0/18",
+
"240b:4002::/33",
+
"149.129.64.0/19",
+
"47.241.0.0/16",
+
"240b:4006:1018::/45",
+
"8.216.0.0/17",
+
"149.129.0.0/21",
+
"47.254.0.0/18",
+
"8.220.64.0/18",
+
"43.96.22.0/24",
+
"170.33.33.0/24",
+
"47.91.32.0/19",
+
"47.246.76.0/22",
+
"47.246.68.0/23",
+
"47.246.146.0/23",
+
"47.254.113.0/24",
+
"47.89.128.0/18",
+
"47.77.144.0/21",
+
"47.89.104.0/22",
+
"8.211.96.0/21",
+
"47.80.0.0/19",
+
"47.246.104.0/22",
+
"47.80.64.0/18",
+
"161.117.0.0/17",
+
"170.33.88.0/24",
+
"47.77.2.0/23",
+
"47.241.0.0/17",
+
"47.79.224.0/19",
+
"170.33.105.0/24",
+
"47.82.12.0/23",
+
"47.246.146.0/24",
+
"8.213.144.0/20",
+
"43.99.0.0/17",
+
"47.89.88.0/23",
+
"8.220.64.0/19",
+
"47.89.90.0/23",
+
"47.235.19.0/24",
+
"8.215.128.0/17",
+
"47.235.21.0/24",
+
"47.81.192.0/18",
+
"8.211.0.0/18",
+
"47.246.72.0/22",
+
"8.211.64.0/18",
+
"203.107.68.0/24",
+
"59.82.136.0/23",
+
"8.209.44.0/22",
+
"8.209.36.0/23",
+
"47.89.0.0/18",
+
"8.216.0.0/18",
+
"47.246.104.0/21",
+
"240b:400b::/32",
+
"47.246.72.0/21",
+
"8.214.128.0/17",
+
"8.209.48.0/20",
+
"170.33.86.0/24",
+
"110.76.21.0/24",
+
"8.209.128.0/18",
+
"8.222.96.0/20",
+
"47.89.100.0/24",
+
"47.89.192.0/19",
+
"8.213.128.0/20",
+
"2400:b200:4100::/48",
+
"8.208.0.0/17",
+
"170.33.90.0/24",
+
"47.83.0.0/17",
+
"240b:400c:100::/40",
+
"170.33.82.0/24",
+
"8.222.32.0/21",
+
"47.246.86.0/23",
+
"47.52.0.0/16",
+
"47.79.192.0/19",
+
"2404:2280:1800::/37",
+
"8.222.112.0/20",
+
"170.33.24.0/24",
+
"47.89.92.0/23",
+
"47.78.0.0/17",
+
"47.84.0.0/16",
+
"240b:400b:8000::/33",
+
"8.209.38.0/24",
+
"47.235.7.0/24",
+
"47.235.23.0/24",
+
"47.237.34.0/24",
+
"47.79.144.0/20",
+
"43.96.71.0/24",
+
"5.181.224.0/23",
+
"47.246.88.0/22",
+
"47.246.96.0/21",
+
"47.82.0.0/19",
+
"8.209.40.0/23",
+
"47.77.48.0/20",
+
"8.209.16.0/20",
+
"240b:4009::/32",
+
"47.246.176.0/20",
+
"47.250.192.0/18",
+
"47.246.168.0/21",
+
"47.89.160.0/19",
+
"8.222.32.0/20",
+
"223.5.5.0/24",
+
"47.81.0.0/18",
+
"47.89.96.0/24",
+
"47.77.0.0/23",
+
"43.96.24.0/24",
+
"8.221.128.0/17",
+
"47.246.144.0/24",
+
"47.246.125.0/24",
+
"240b:400e:ffff::/48",
+
"47.84.0.0/17",
+
"170.33.106.0/24",
+
"156.227.20.0/24",
+
"170.33.35.0/24",
+
"240b:4006:1028::/45",
+
"170.33.78.0/24",
+
"198.11.128.0/18",
+
"8.210.0.0/17",
+
"47.83.40.0/21",
+
"47.89.80.0/23",
+
"43.98.0.0/16",
+
"47.88.0.0/18",
+
"47.89.74.0/23",
+
"43.96.67.0/24",
+
"47.79.48.0/20",
+
"2404:2280:3800::/37",
+
"47.235.11.0/24",
+
"8.220.160.0/19",
+
"43.96.84.0/24",
+
"8.221.208.0/21",
+
"139.95.18.0/23",
+
"47.246.84.0/22",
+
"47.77.16.0/21",
+
"170.33.69.0/24",
+
"47.78.128.0/17",
+
"8.220.96.0/19",
+
"8.209.0.0/19",
+
"240b:400d::/32",
+
"205.204.102.0/23",
+
"47.87.128.0/19",
+
"47.83.128.0/17",
+
"8.218.0.0/17",
+
"47.235.10.0/23",
+
"8.208.128.0/17",
+
"170.33.137.0/24",
+
"8.209.37.0/24",
+
"8.220.128.0/19",
+
"47.79.112.0/20",
+
"47.243.0.0/16",
+
"47.246.196.0/23",
+
"170.33.79.0/24",
+
"47.252.0.0/18",
+
"47.87.0.0/19",
+
"2404:2280:2000::/36",
+
"47.79.58.0/23",
+
"170.33.34.0/24",
+
"47.246.132.0/22",
+
"240b:4012::/48",
+
"47.91.112.0/20",
+
"47.77.32.0/20",
+
"240b:4005::/33",
+
"8.222.8.0/21",
+
"47.246.194.0/23",
+
"2404:2280:1000::/37",
+
"8.221.200.0/21",
+
"43.96.23.0/24",
+
"47.82.64.0/18",
+
"147.139.128.0/17",
+
"8.211.192.0/19",
+
"47.251.128.0/17",
+
"240b:4011::/32",
+
"8.222.0.0/20",
+
"47.235.12.0/24",
+
"43.99.128.0/17",
+
"47.246.80.0/24",
+
"47.246.67.0/24",
+
"47.246.122.0/24",
+
"156.245.1.0/24",
+
"8.210.128.0/17",
+
"8.213.64.0/18",
+
"45.199.179.0/24",
+
"47.235.0.0/22",
+
"47.246.136.0/21",
+
"8.213.164.0/22",
+
"8.209.192.0/18",
+
"47.77.24.0/22",
+
"47.82.64.0/19",
+
"47.244.73.0/24",
+
"47.89.72.0/22",
+
"47.76.128.0/17",
+
"47.76.0.0/16",
+
"47.245.128.0/17",
+
"47.75.0.0/17",
+
"47.245.96.0/19",
+
"47.235.20.0/24",
+
"47.79.52.0/23",
+
"47.79.80.0/20",
+
"47.82.32.0/21",
+
"47.251.224.0/22",
+
"47.74.128.0/17",
+
"223.6.6.0/24",
+
"47.246.128.0/23",
+
"147.139.128.0/18",
+
"47.246.84.0/23",
+
"240b:4007::/33",
+
"170.33.85.0/24",
+
"43.96.102.0/24",
+
"43.98.0.0/17",
+
"203.107.67.0/24",
+
"8.222.0.0/21",
+
"2404:2280:2800::/37",
+
"43.96.101.0/24",
+
"170.33.84.0/24",
+
"8.219.128.0/17",
+
"47.80.64.0/19",
+
"43.96.85.0/24",
+
"43.96.96.0/24",
+
"43.96.73.0/24",
+
"47.246.100.0/22",
+
"47.79.60.0/23",
+
"47.77.26.0/23",
+
"8.222.128.0/17",
+
"161.117.138.0/24",
+
"47.235.18.0/23",
+
"47.235.0.0/23",
+
"240b:4006:1010::/44",
+
"47.76.0.0/17",
+
"8.221.216.0/21",
+
"47.82.8.0/23",
+
"2404:2280:4800::/37",
+
"170.33.29.0/24",
+
"47.245.128.0/18",
+
"47.79.80.0/21",
+
"47.89.221.0/24",
+
"198.11.184.0/21",
+
"240b:4009:8000::/33",
+
"8.215.162.0/23",
+
"8.211.128.0/19",
+
"47.79.83.0/24",
+
"2408:4009:500::/48",
+
"47.81.64.0/19",
+
"8.208.0.0/19",
+
"47.240.0.0/17",
+
"47.79.64.0/21",
+
"47.90.0.0/18",
+
"43.96.70.0/24",
+
"149.129.0.0/20",
+
"240b:400c::/33",
+
"2408:4000:1000::/48",
+
"170.33.76.0/24",
+
"205.204.96.0/19",
+
"47.88.64.0/18",
+
"8.209.96.0/19",
+
"47.79.104.0/21",
+
"47.82.10.0/23",
+
"47.79.88.0/21",
+
"47.245.64.0/19",
+
"139.95.16.0/23",
+
"47.77.20.0/22",
+
"240b:400f::/33",
+
"47.235.2.0/23",
+
"8.221.0.0/17",
+
"8.213.160.0/22",
+
"8.215.169.0/24",
+
"170.33.81.0/24",
+
"47.89.124.0/24",
+
"47.235.30.0/24",
+
"47.79.62.0/23",
+
"43.96.68.0/24",
+
"47.246.120.0/24",
+
"8.221.192.0/21",
+
"8.221.184.0/22",
+
"47.77.136.0/21",
+
"8.220.224.0/19",
+
"156.240.76.0/23",
+
"8.208.141.0/24",
+
"2404:2280:2000::/37",
+
"47.84.128.0/17",
+
"47.85.0.0/17",
+
"8.217.0.0/17",
+
"47.89.84.0/24",
+
"47.238.0.0/15",
+
"47.86.128.0/17",
+
"240b:4011:8000::/33",
+
"240b:4006:1000::/47",
+
"47.246.134.0/23",
+
"47.79.96.0/20",
+
"47.79.0.0/21",
+
"47.89.103.0/24",
+
"47.89.97.0/24",
+
"240b:4000::/33",
+
"47.242.0.0/16",
+
"47.56.0.0/15",
+
"47.91.32.0/20",
+
"147.139.192.0/18",
+
"240b:4013::/33",
+
"47.79.40.0/21",
+
"8.209.46.0/23",
+
"47.82.48.0/21",
+
"47.82.40.0/21",
+
"47.87.192.0/22",
+
"47.87.192.0/23",
+
"47.87.194.0/23",
+
"47.87.196.0/22",
+
"47.87.196.0/23",
+
"47.87.198.0/23",
+
"240b:400c:ffff::/48",
+
"47.87.208.0/23",
+
"47.87.210.0/23",
+
"47.87.208.0/22",
+
"47.87.222.0/23",
+
"47.87.216.0/23",
+
"47.87.200.0/23",
+
"47.87.220.0/23",
+
"47.87.216.0/22",
+
"47.87.224.0/22",
+
"47.87.204.0/22",
+
"47.87.212.0/23",
+
"47.87.226.0/23",
+
"47.87.200.0/22",
+
"47.87.206.0/23",
+
"43.100.0.0/16",
+
"47.87.212.0/22",
+
"47.87.218.0/23",
+
"47.87.214.0/23",
+
"43.100.0.0/15",
+
"47.87.204.0/23",
+
"47.87.220.0/22",
+
"43.101.0.0/16",
+
"47.87.224.0/23",
+
"47.87.202.0/23",
+
]
+4
packages/anubis-files/src/rules/challenge/generic-browser.yaml
···
+
- name: generic-browser
+
user_agent_regex: >-
+
Mozilla|Opera
+
action: CHALLENGE
+25
systems/x86_64-linux/marvin/services/anubis.nix
···
+
{
+
config,
+
...
+
}:
+
{
+
config = {
+
services.anubis.defaultOptions = {
+
enable = true;
+
extraFlags = "-metrics-bind \"\"";
+
settings = {
+
BIND_NETWORK = "tcp";
+
SERVE_ROBOTS_TXT = true;
+
COOKIE_DOMAIN = "pyrox.dev";
+
ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-key.path;
+
OG_PASSTHROUGH = true;
+
OG_CACHE_CONSIDER_HOST = true;
+
};
+
};
+
age.secrets.anubis-key = {
+
file = ./secrets/anubis-key.age;
+
user = "anubis";
+
group = "anubis";
+
};
+
};
+
}
+14 -2
systems/x86_64-linux/marvin/services/authentik.nix
···
-
{ config, lib, ... }:
+
{
+
config,
+
lib,
+
pkgs,
+
...
+
}:
let
d = lib.py.data.services.authentik;
in
{
virtualisation.oci-containers.containers =
let
-
authentikVersion = "2024.10";
+
authentikVersion = "2025.4";
base = {
environmentFiles = [ config.age.secrets.authentik-env.path ];
extraOptions = [ "--network=authentik" ];
···
file = ./secrets/authentik-env.age;
owner = "thehedgehog";
group = "misc";
+
};
+
services.anubis.instances.authentik = {
+
settings = {
+
BIND = ":${toString d.anubis}";
+
POLICY_FNAME = "${pkgs.py.anubis-files}/policies/authentik.yaml";
+
TARGET = "http://localhost:${toString d.port}";
+
};
};
}
+7
systems/x86_64-linux/marvin/services/git.nix
···
file = ./secrets/forgejo-secret-key.age;
};
};
+
services.anubis.instances.forgejo = {
+
settings = {
+
BIND = ":${toString d.anubis}";
+
POLICY_FNAME = "${pkgs.py.anubis-files}/policies/forgejo.yaml";
+
TARGET = "http://localhost:${toString d.port}";
+
};
+
};
}
+13 -1
systems/x86_64-linux/marvin/services/grafana.nix
···
-
{ config, lib, ... }:
+
{
+
config,
+
lib,
+
pkgs,
+
...
+
}:
let
d = lib.py.data.services.grafana;
a = lib.py.data.services.authentik;
···
file = ./secrets/grafana-smtp-password.age;
owner = "grafana";
group = "grafana";
+
};
+
};
+
services.anubis.instances.grafana = {
+
settings = {
+
BIND = ":${toString d.anubis}";
+
POLICY_FNAME = "${pkgs.py.anubis-files}/policies/grafana.yaml";
+
TARGET = "http://localhost:${toString d.port}";
};
};
}
+1 -1
systems/x86_64-linux/marvin/services/iceshrimp.nix
···
};
};
};
-
age.secrets = {
+
age.secrets = lib.mkIf config.services.iceshrimp.enable {
iceshrimp-secret-config = {
inherit (config.services.iceshrimp) group;
file = ./secrets/iceshrimp-secret-config.age;
+7
systems/x86_64-linux/marvin/services/nextcloud/default.nix
···
owner = "nextcloud";
group = "nextcloud";
};
+
services.anubis.instances.nextcloud = {
+
settings = {
+
BIND = ":${toString d.anubis}";
+
POLICY_FNAME = "${pkgs.py.anubis-files}/policies/nextcloud.yaml";
+
TARGET = "http://localhost:${toString d.port}";
+
};
+
};
}
+8 -1
systems/x86_64-linux/marvin/services/nextcloud/office.nix
···
-
{ lib, ... }:
+
{ lib, pkgs, ... }:
let
d = lib.py.data.services.nextcloud-office;
in
···
host = "https://cloud.pyrox.dev:443";
}
];
+
};
+
services.anubis.instances.nextcloud-office = {
+
settings = {
+
BIND = ":${toString d.anubis}";
+
POLICY_FNAME = "${pkgs.py.anubis-files}/policies/nextcloud-office.yaml";
+
TARGET = "http://localhost:${toString d.port}";
+
};
};
}
+14 -1
systems/x86_64-linux/marvin/services/planka.nix
···
-
{ config, lib, ... }:
+
{
+
config,
+
lib,
+
pkgs,
+
...
+
}:
let
dataDir = "/var/lib/planka";
d = lib.py.data.services.planka;
···
owner = "thehedgehog";
group = "misc";
};
+
services.anubis.instances.planka = {
+
settings = {
+
BIND = ":${toString d.anubis}";
+
POLICY_FNAME = "${pkgs.py.anubis-files}/policies/planka.yaml";
+
TARGET = "http://localhost:${toString d.port}";
+
};
+
};
+
}
+20
systems/x86_64-linux/marvin/services/secrets/anubis-key.age
···
+
age-encryption.org/v1
+
-> ssh-ed25519 iqBxIA 0nhVhc10cQVe6R565JAHib/nXjCJz30CkP8stgrr2H8
+
UZvBZgQSA0RJoXhgub7bvONXH7Tr4fyLngYaeV0RaiI
+
-> ssh-rsa fFaiTA
+
KTErOmc2adbOX4BDCpbGCSxi2P507OhPJygCguq32e8MpEQtUQM39ryS24z2iPko
+
JefAkJDFz7MnF3FrlsQhs0Tn68XFKWNU6/qcduWsrn0mFkF+UTWylg4LifOmfaxh
+
iGUkUzSsneZHpnJRYX7nI2e2dV6FD++Dm2fOjyBQpOZemas3qb8jM4t8SbtUCkOB
+
tarqwI3R60xdwlv4UnoIQgnALdKkQ/2p/tBSQV2i47iCMo2ksHC57Q8FqfsMBRbF
+
1QPfvaSKS+85mkkew9qhGCTiI9CTPMJ1LytFPrN7hYvwWJEdqBXQplaGnK/Z3v6A
+
riKcb2z7uB5fL37DmEtESejxMVdo8AeJRhBKWNf065wve5UjvVE3NNver/F+aiOW
+
nhPZPD5uwv8G4Bu5jStBSeceqkwdxqagnqWE4HqNB/MUshOehEbjdSHVxcNslsu+
+
ay4lCudcIbWUgfD3fTQO8sVBral6Z42DgZ1DDgzDGzw4CAw2s7iu1gVL19yr+KkZ
+
L1sLVdTKAKEvTMsmDLtC8hEnU5LzOhw/+6zu+jCEpiAM1tdLiZXAbXtX70qfFoG0
+
vdrmNxkKMqeBQ6mOIx2HtIGfZaEZac9psbT71aU8g0oHa0GVIoj/6s13kOxDe4V7
+
SyKVhTN/uRSzePWyjNtikK4A8I2+A1wh705hBo11cq0
+
-> ssh-ed25519 wpmdHA Zr0B8acivkr2BMIZhSUWzkXKlGi1JFQESG6/WQ279is
+
wyCREE9Va/xD+Fyjn+iYDvXNNHs3Jasz7CZ7jVuRmC0
+
--- riW/wZBclVd4FZPODjzrhFo3UoMSsvMp257fOv86tRg
+
]�
+
0���c��Q,��*$���L�Z��1"L&�d}%a ��c3�B�.�'���tKƖď-]*t����L��B%�8S���F���N����/�.a��
+1
systems/x86_64-linux/marvin/services/secrets/secrets.nix
···
];
in
{
+
"anubis-key.age".publicKeys = marvinDefault;
"authentik-env.age".publicKeys = marvinDefault;
"buildbot-worker-password.age".publicKeys = marvinDefault;
"buildbot-gitea-token.age".publicKeys = marvinDefault;