My Nix Configuration

[pkgs] anubis-files: rework to hopefully fix them

Changed files
+318 -122
packages
+54 -1
packages/anubis-files/src/policies/default.yaml
···
bots:
- import: CUSTOM/policies/meta/base.yaml
-
- import: CUSTOM/policies/meta/openGraph.yaml
+
dnsbl: false
+
openGraph:
+
enabled: true
+
considerHost: false
+
ttl: 24h
+
status_codes:
+
CHALLENGE: 200
+
DENY: 200
+
thresholds:
+
- name: minimal-suspicion
+
expression: weight <= 0
+
action: ALLOW
+
- name: mild-suspicion
+
expression:
+
all:
+
- weight > 0
+
- weight < 10
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
+
algorithm: metarefresh
+
difficulty: 1
+
report_as: 1
+
- name: moderate-suspicion
+
expression:
+
all:
+
- weight >= 10
+
- weight < 20
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 2 # two leading zeros, very fast for most clients
+
report_as: 2
+
- name: mild-proof-of-work
+
expression:
+
all:
+
- weight >= 20
+
- weight < 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 4
+
report_as: 4
+
# For clients that are browser like and have gained many points from custom rules
+
- name: extreme-suspicion
+
expression: weight >= 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 6
+
report_as: 5
+53 -1
packages/anubis-files/src/policies/forgejo.yaml
···
bots:
- import: CUSTOM/policies/meta/base.yaml
-
- import: CUSTOM/policies/meta/openGraph.yaml
- import: (data)/clients/git.yaml
- import: (data)/apps/gitea-rss-feeds.yaml
dnsbl: false
+
openGraph:
+
enabled: true
+
considerHost: false
+
ttl: 24h
+
status_codes:
+
CHALLENGE: 200
+
DENY: 200
+
thresholds:
+
- name: minimal-suspicion
+
expression: weight <= 0
+
action: ALLOW
+
- name: mild-suspicion
+
expression:
+
all:
+
- weight > 0
+
- weight < 10
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
+
algorithm: metarefresh
+
difficulty: 1
+
report_as: 1
+
- name: moderate-suspicion
+
expression:
+
all:
+
- weight >= 10
+
- weight < 20
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 2 # two leading zeros, very fast for most clients
+
report_as: 2
+
- name: mild-proof-of-work
+
expression:
+
all:
+
- weight >= 20
+
- weight < 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 4
+
report_as: 4
+
# For clients that are browser like and have gained many points from custom rules
+
- name: extreme-suspicion
+
expression: weight >= 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 6
+
report_as: 5
+53 -113
packages/anubis-files/src/policies/meta/base.yaml
···
-
bots:
-
- import: (data)/bots/_deny-pathological.yaml
-
- import: (data)/bots/aggressive-brazilian-scrapers.yaml
-
- import: (data)/meta/ai-block-aggressive.yaml
-
- import: (data)/crawlers/_allow-good.yaml
-
- import: (data)/clients/x-firefox-ai.yaml
-
- import: (data)/common/keep-internet-working.yaml
-
-
- name: realistic-browser-catchall
-
expression:
-
all:
-
- '"User-Agent" in headers'
-
- '( userAgent.contains("Firefox") ) || ( userAgent.contains("Chrome") ) || ( userAgent.contains("Safari") )'
-
- '"Accept" in headers'
-
- '"Sec-Fetch-Dest" in headers'
-
- '"Sec-Fetch-Mode" in headers'
-
- '"Sec-Fetch-Site" in headers'
-
- '"Accept-Encoding" in headers'
-
- '( headers["Accept-Encoding"].contains("zstd") || headers["Accept-Encoding"].contains("br") )'
-
- '"Accept-Language" in headers'
-
action: WEIGH
-
weight:
-
adjust: -10
-
+
# keep-sorted start
+
- import: (data)/bots/_deny-pathological.yaml
+
- import: (data)/bots/aggressive-brazilian-scrapers.yaml
+
- import: (data)/clients/x-firefox-ai.yaml
+
- import: (data)/common/keep-internet-working.yaml
+
- import: (data)/common/rfc-violations.yaml
+
- import: (data)/crawlers/_allow-good.yaml
+
- import: (data)/meta/ai-block-aggressive.yaml
+
# keep-sorted end
+
- name: realistic-browser-catchall
+
expression:
+
all:
+
- '"User-Agent" in headers'
+
- '( userAgent.contains("Firefox") ) || ( userAgent.contains("Chrome") ) || ( userAgent.contains("Safari") )'
+
- '"Accept" in headers'
+
- '"Sec-Fetch-Dest" in headers'
+
- '"Sec-Fetch-Mode" in headers'
+
- '"Sec-Fetch-Site" in headers'
+
- '"Accept-Encoding" in headers'
+
- '( headers["Accept-Encoding"].contains("zstd") || headers["Accept-Encoding"].contains("br") )'
+
- '"Accept-Language" in headers'
+
action: WEIGH
+
weight:
+
adjust: -10
# The Upgrade-Insecure-Requests header is typically sent by browsers, but not always
-
- name: upgrade-insecure-requests
-
expression: '"Upgrade-Insecure-Requests" in headers'
-
action: WEIGH
-
weight:
-
adjust: -2
-
-
# Chrome should behave like Chrome
-
- name: chrome-is-proper
-
expression:
-
all:
-
- userAgent.contains("Chrome")
-
- '"Sec-Ch-Ua" in headers'
-
- 'headers["Sec-Ch-Ua"].contains("Chromium")'
-
- '"Sec-Ch-Ua-Mobile" in headers'
-
- '"Sec-Ch-Ua-Platform" in headers'
-
action: WEIGH
-
weight:
-
adjust: -5
-
-
- name: should-have-accept
-
expression: '!("Accept" in headers)'
-
action: WEIGH
-
weight:
-
adjust: 5
-
-
# Generic catchall rule
-
- name: generic-browser
-
user_agent_regex: >-
-
Mozilla|Opera|Chrome|Chromium
-
action: WEIGH
-
weight:
-
adjust: 10
-
-
dnsbl: false
-
-
status_codes:
-
CHALLENGE: 200
-
DENY: 200
-
-
thresholds:
-
- name: minimal-suspicion
-
expression: weight <= 0
-
action: ALLOW
-
-
- name: mild-suspicion
-
expression:
-
all:
-
- weight > 0
-
- weight < 10
-
action: CHALLENGE
-
challenge:
-
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
-
algorithm: metarefresh
-
difficulty: 1
-
report_as: 1
-
-
- name: moderate-suspicion
-
expression:
-
all:
-
- weight >= 10
-
- weight < 20
-
action: CHALLENGE
-
challenge:
-
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
-
algorithm: fast
-
difficulty: 2 # two leading zeros, very fast for most clients
-
report_as: 2
-
-
- name: mild-proof-of-work
-
expression:
-
all:
-
- weight >= 20
-
- weight < 30
-
action: CHALLENGE
-
challenge:
-
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
-
algorithm: fast
-
difficulty: 4
-
report_as: 4
-
-
# For clients that are browser like and have gained many points from custom rules
-
- name: extreme-suspicion
-
expression: weight >= 30
-
action: CHALLENGE
-
challenge:
-
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
-
algorithm: fast
-
difficulty: 6
-
report_as: 5
+
- name: upgrade-insecure-requests
+
expression: '"Upgrade-Insecure-Requests" in headers'
+
action: WEIGH
+
weight:
+
adjust: -2
+
# Chrome should behave like Chrome
+
- name: chrome-is-proper
+
expression:
+
all:
+
- userAgent.contains("Chrome")
+
- '"Sec-Ch-Ua" in headers'
+
- 'headers["Sec-Ch-Ua"].contains("Chromium")'
+
- '"Sec-Ch-Ua-Mobile" in headers'
+
- '"Sec-Ch-Ua-Platform" in headers'
+
action: WEIGH
+
weight:
+
adjust: -5
+
- name: should-have-accept
+
expression: '!("Accept" in headers)'
+
action: WEIGH
+
weight:
+
adjust: 5
+
# Generic catchall rule
+
- name: generic-browser
+
user_agent_regex: >-
+
Mozilla|Opera|Chrome|Chromium
+
action: WEIGH
+
weight:
+
adjust: 10
-4
packages/anubis-files/src/policies/meta/openGraph.yaml
···
-
openGraph:
-
enabled: true
-
considerHost: false
-
ttl: 24h
+50 -1
packages/anubis-files/src/policies/nextcloud-office.yaml
···
bots:
- import: CUSTOM/policies/meta/base.yaml
-
- import: CUSTOM/policies/openGraph.yaml
# Allow requests from the nextcloud server to bypass checks
- name: allow-nextcloud-server
user_agent_regex: ^Nextcloud Server / richdocuments$
action: ALLOW
+
dnsbl: false
+
status_codes:
+
CHALLENGE: 200
+
DENY: 200
+
thresholds:
+
- name: minimal-suspicion
+
expression: weight <= 0
+
action: ALLOW
+
- name: mild-suspicion
+
expression:
+
all:
+
- weight > 0
+
- weight < 10
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
+
algorithm: metarefresh
+
difficulty: 1
+
report_as: 1
+
- name: moderate-suspicion
+
expression:
+
all:
+
- weight >= 10
+
- weight < 20
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 2 # two leading zeros, very fast for most clients
+
report_as: 2
+
- name: mild-proof-of-work
+
expression:
+
all:
+
- weight >= 20
+
- weight < 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 4
+
report_as: 4
+
# For clients that are browser like and have gained many points from custom rules
+
- name: extreme-suspicion
+
expression: weight >= 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 6
+
report_as: 5
+54 -1
packages/anubis-files/src/policies/nextcloud.yaml
···
bots:
- import: CUSTOM/profiles/meta/base.yaml
-
- import: CUSTOM/profiles/meta/openGraph.yaml
# Allow android apps that I use
- name: allow-android-apps
user_agent_regex: Nextcloud-android|DAVx5|ICSx5
···
- 'path.startsWith("/apps/theming/")'
# Public DAV endpoint
- 'path.startsWith("/public.php/dav/files/")'
+
dnsbl: false
+
openGraph:
+
enabled: true
+
considerHost: false
+
ttl: 24h
+
status_codes:
+
CHALLENGE: 200
+
DENY: 200
+
thresholds:
+
- name: minimal-suspicion
+
expression: weight <= 0
+
action: ALLOW
+
- name: mild-suspicion
+
expression:
+
all:
+
- weight > 0
+
- weight < 10
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
+
algorithm: metarefresh
+
difficulty: 1
+
report_as: 1
+
- name: moderate-suspicion
+
expression:
+
all:
+
- weight >= 10
+
- weight < 20
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 2 # two leading zeros, very fast for most clients
+
report_as: 2
+
- name: mild-proof-of-work
+
expression:
+
all:
+
- weight >= 20
+
- weight < 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 4
+
report_as: 4
+
# For clients that are browser like and have gained many points from custom rules
+
- name: extreme-suspicion
+
expression: weight >= 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 6
+
report_as: 5
+54 -1
packages/anubis-files/src/policies/vaultwarden.yaml
···
bots:
- import: CUSTOM/policies/meta/base.yaml
-
- import: CUSTOM/policies/meta/openGraph.yaml
# Allow bitwarden apps
- name: allow-bitwarden-mobile
user_agent_regex: Bitwarden_Mobile
···
- name: allow-bitwarden-webext
user_agent_regex: Mozilla
action: ALLOW
+
dnsbl: false
+
openGraph:
+
enabled: true
+
considerHost: false
+
ttl: 24h
+
status_codes:
+
CHALLENGE: 200
+
DENY: 200
+
thresholds:
+
- name: minimal-suspicion
+
expression: weight <= 0
+
action: ALLOW
+
- name: mild-suspicion
+
expression:
+
all:
+
- weight > 0
+
- weight < 10
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
+
algorithm: metarefresh
+
difficulty: 1
+
report_as: 1
+
- name: moderate-suspicion
+
expression:
+
all:
+
- weight >= 10
+
- weight < 20
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 2 # two leading zeros, very fast for most clients
+
report_as: 2
+
- name: mild-proof-of-work
+
expression:
+
all:
+
- weight >= 20
+
- weight < 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 4
+
report_as: 4
+
# For clients that are browser like and have gained many points from custom rules
+
- name: extreme-suspicion
+
expression: weight >= 30
+
action: CHALLENGE
+
challenge:
+
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+
algorithm: fast
+
difficulty: 6
+
report_as: 5