aboutsummaryrefslogtreecommitdiff
path: root/docs
AgeCommit message (Collapse)AuthorFilesLines
2025-04-02dependabot: enable (#189)Patrick Linnane1-0/+1
* dependabot: enable Signed-off-by: Patrick Linnane <patrick@linnane.io> * dependabot: group updates Signed-off-by: Patrick Linnane <patrick@linnane.io> --------- Signed-off-by: Patrick Linnane <patrick@linnane.io> Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-04-01workflows: fix zizmor findings (part 1) (#190)Patrick Linnane1-0/+1
Signed-off-by: Patrick Linnane <patrick@linnane.io>
2025-04-01ci: add `zizmor` (#188)Patrick Linnane1-0/+1
Signed-off-by: Patrick Linnane <patrick@linnane.io>
2025-04-01various: fix minor typos (#187)Patrick Linnane1-0/+1
Signed-off-by: Patrick Linnane <patrick@linnane.io>
2025-03-31docs: document ED25519_PRIVATE_KEY_HEX_FILE (#186)Talya Connor1-15/+16
2025-03-31cmd/anubis: support ED25519_PRIVATE_KEY_HEX_FILE (#185)Talya Connor1-0/+1
2025-03-31lib/anubis: actually check the result with the correct difficulty (#180)Henri Vasserman1-0/+13
* cmd/anubis actually check the result with the correct difficulty * chore: changelog * test(cmd/anubis): make test check for difficulty * lib: add regression test for CVE-2025-24369 Signed-off-by: Xe Iaso <me@xeiaso.net> * bump VERSION and CHANGELOG Tracks #181 Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-31web/js: Added a wait with button continue + 30 second auto continue after ↵Cyra Westmere1-0/+1
30s if you click "Why am I seeing this? (#166) * web/js: update page to allow users to read the "Why am I seeing this?", complete with a button to send them through after challenge completed, and a 30s timeout that does the same. * .gitignore: added .DS_store. * docs/docs/CHANGELOG: added to the Unreleased section as requested in code quality guidelines * web: pushing index_templ.go alongside this update. * package.json: added postcss to dependencies list. * package-lock: added postcss to dependencies * Revert "package-lock: added postcss to dependencies" This reverts commit bf02e7ba56e8bf8705821d4f4864c66b1ef614bf. * Revert "package.json: added postcss to dependencies list." This reverts commit 1a38c63049dc75099dc652ed725c7862eef4b3e4. * web/js: OG comments are important --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-30Fix: Correct typo in challenge page title (main) (#174)Jason Cameron1-0/+1
- Fixed a typo in the challenge page title, removing an unnecessary backslash. - Updated the index page title to "Making sure you're not a bot!". Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-30fix(tests): disable integration tests on Windows due to posix feature ↵Jason Cameron1-0/+1
reliance (#169) Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-29fix(logs): Correctly format listener address (#162)Jason Cameron1-0/+1
* fix: Correctly format listener address (https://github.com/TecharoHQ/anubis/issues/93) Handle addresses that include a hostname, not just ports. If the address starts with a colon, assume it's just a port and prefix it with "http://localhost". Otherwise, prefix the entire address with "http://". This ensures that the listener URL is correctly formatted regardless of whether it includes a hostname or just a port. Signed-off-by: Jason Cameron <git@jasoncameron.dev> * chore(docs): add changelog entry Signed-off-by: Jason Cameron <git@jasoncameron.dev> --------- Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-29web/js: Add LibreJS banner to Anubis JavaScript to allow LibreJS users to ↵Fijxu1-0/+1
run the challenge (#161) * web/js: add project license in the JavaScript used by Anubis This will allow LibreJS users to pass the captcha without problems without having to whitelist anubis manually. * Update docs/docs/CHANGELOG.md Co-authored-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Fijxu <fijxu@nadeko.net> --------- Signed-off-by: Fijxu <fijxu@nadeko.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-29Debug tool for benchmarking proof-of-work algorithms (#155)jae beller1-0/+1
* cmd/anubis: add a debug option for benchmarking hashrate Having the ability to benchmark different proof-of-work implementations is useful for extending Anubis. This adds a flag `--debug-benchmark-js` (and its associated environment variable `DEBUG_BENCHMARK_JS`) for serving a tool to do so. Internally, a there is a new policy action, "DEBUG_BENCHMARK", which serves the benchmarking tool instead of a challenge. The flag then replaces all bot rules with a special rule matching every request to that action. The benchmark page makes heavy use of inline styles, because currently all global styles are shared across all pages. This could be fixed, but I wanted to avoid major changes to the templates. * web/js: add signal for aborting an active proof-of-work algorithm Both proof-of-work algorithms now take an optional `AbortSignal`, which immediately terminates all workers and returns `false` if aborted before the challenge is complete. * web/js: add algorithm comparison to the benchmark page "Compare:" is added to the benchmark page for testing the relative performance between two algorithms. Since benchmark runs generally have high variance, it may take a while for the averages to converge on a stable difference. --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-29Add periodic cleanup job for DecayMap (#8) (#158)Jason Cameron1-1/+1
* Add periodic cleanup job for DecayMap see https://github.com/TecharoHQ/anubis/issues/8 * Refactor: Improve DecayMap cleanup tests and add Len method - Refactored DecayMap cleanup tests to use the new Len method for more precise assertions. - Added a Len method to DecayMap to retrieve the number of entries. - Simplified conditional checks in Get method. * chore(changelog): add entry * fix(tests): Use Impl.expire for decaymap cleanup Signed-off-by: Jason Cameron <git@jasoncameron.dev> --------- Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-29cmd/containerbuild: use TrimSuffix instead of TrimRight (#157)Fijxu1-0/+1
Using TrimRight will remove all characters from `*dockerRepo` from right to left that match a character contained on `"/"+filepath.Base(*dockerRepo)` (the cutset) until it doesn't matches anymore. So for example, if `dockerRepo` is `example.com/fijxu/anubis`, and `"/"+filepath.Base(*dockerRepo)` is `/anubis`, it will remove `u/anubis` and not just `/anubis` from `dockerRepo` because `u` is a character inside the cutoff.
2025-03-29docs/developer/building-anubis: fix syntaxXe Iaso1-1/+1
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-29Show a progress bar for the probability of completing the proof of work ↵jae beller1-0/+1
challenge (#87) Since the challenge is done off of the main thread, there is no simple way to report the progress done towards completing it. This change adds a callback parameter, `progressCallback`, which is called with the most recently attempted nonce every ~1024 iterations (should this be configurable?). For the single-threaded "slow" algorithm, this is exactly every 1024 iterations. For the multi-threaded "fast" algorithm, threads take turns reporting in a round-robin as then notice they have passed a multiple of 1024. This complexity is to avoid individual threads falling behind their siblings due to the overhead of messaging the main thread. To minimize this overhead as much as possible, a regular number is sent instead of an object. With the new information provided by the callback, a hash rate display is added to the challenge page. This display is updated at most once per second and set with tabular numbers to avoid the constantly changing value being too visually distracting. * web: show a progress bar based on completion probability To provide more feedback to the user, the spinner is replaced with a progress bar of the probability the challenge is complete. Since it looks a little weird that a progress bar would fill up a quarter of the way and then jump to the end (even though the probability would make that happen 1 in 4 times), the bar is mapped with a quadratic easing function to move faster at the beginning and then slow down as the probability of redirection increases. If the probability exceeds 90%, a message appears letting the user know things are taking longer than expected and to continue being patient. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-29Add middleware to set Cache-Control header for challenge HTML (#132)Jason Cameron1-0/+1
* Add middleware to set Cache-Control header for challenge HTML * Add `NoStoreCache` middleware function in `internal/headers.go` to set Cache-Control: no-store header * Apply `NoStoreCache` middleware in `cmd/anubis/main.go` to set Cache-Control header for challenge HTML * docs: Add no-cache header information for challenge page * docs: Update changelog to reflect no-store Cache-Control header addition for challenge page * refactor: rename variable for clarity and update caching middleware in RenderIndex * chore: move changes to the unreleased section Signed-off-by: Jason Cameron <git@jasoncameron.dev> --------- Signed-off-by: Jason Cameron <jasoncameron.all@gmail.com> Signed-off-by: Jason Cameron <git@jasoncameron.dev>
2025-03-29docs/developer: add build directions for manually building Anubis (#154)Xe Iaso1-0/+41
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-28web/js: show more errors when some probable error cases happen (#151)Xe Iaso1-0/+1
Closes #150 This should hopefully make Anubis more self-describing when errors do happen so users can self-service.
2025-03-28all: do not commit generated JS/CSS to source control (#148)Xe Iaso5-0/+106
Closes #125 Closes #40 Among other things, this moves all of the asset generation to run within the context of an npm script. Developer documentation stubs have been added so that people can get started more easily. The top-level Dockerfile (which is no longer used in production) has been removed as its presence has been causing confusion. This changeset will break it anyways. These changes will make for less "repo churn" as the static assets are built and rebuilt, at the cost of making the build step more complicated for downstream packagers. If this becomes a burden, we can explore making a "release tarball" that contains pre-massaged outputs.
2025-03-28Hide directory browsing on the static content (#85)Henri Vasserman1-0/+1
* Hide directory browsing on the static content * update changelog
2025-03-28Change how to make Anubis work without a reverse proxy (#86)Henri Vasserman2-0/+2
* Change how to make Anubis work without a reverse proxy * Apply suggestions from code review Co-authored-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Henri Vasserman <henv@hot.ee> * add support for unix sockets. * add env var docs * lib: fix tests Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Henri Vasserman <henv@hot.ee> Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-28data: disable DroneBL lookups by default (#147)Xe Iaso1-0/+2
Closes #109 This was a hack I did on stream. I thought this would have a positive effect, but a combination of real-world testing from people using Anubis in prod and gray-hat testing has proven this is an unfeature and is probably causing more harm than good at this stage. In the future I'll probably make the `dnsbl` block more flexible so that you can specify your own lists and rules around them. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-27version 1.15.0 (#144)v1.15.0Xe Iaso1-2/+15
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-27Apply bits of the cookie settings PR one by one (#140)Xe Iaso2-0/+5
Enables uses to change the cookie domain and partitioned flags. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-27docs: fix broken link to default policy file (#137)Hans59581-1/+1
2025-03-26Revert "lib/anubis: support setting extended cookie flags (#120)" (#134)Xe Iaso2-16/+12
This reverts commit e7cbd349f3ff96788dc7a8540d29808ca72e1c44.
2025-03-26lib/anubis: support setting extended cookie flags (#120)Xe Iaso2-12/+16
* lib/anubis: support setting extended cookie flags Signed-off-by: Xe Iaso <me@xeiaso.net> * lib: use cookie name consistently Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-26fix(docs): Make dark mode diff lines readable (#130)Henri Vasserman2-2/+7
* fix(docs): Make dark mode diff lines readable If using dark mode, these lines are not legible at all. I separated the colors into variables and added more contrasting colors for the dark mode. * chore: add to changelog
2025-03-25cmd/anubis: allow setting key bytes in flag/envvar (#97)Xe Iaso4-12/+88
* cmd/anubis: allow setting key bytes in flag/envvar Docs are updated to generate a random key on load and when people press the recycle button. Signed-off-by: Xe Iaso <me@xeiaso.net> * review feedback fixups Signed-off-by: Xe Iaso <me@xeiaso.net> * Update cmd/anubis/main.go Signed-off-by: Xe Iaso <me@xeiaso.net> * Apply suggestions from code review Co-authored-by: Ryan Cao <70191398+ryanccn@users.noreply.github.com> Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Ryan Cao <70191398+ryanccn@users.noreply.github.com>
2025-03-25Linting and staticcheck fixes. (#101)Yulian Kuncheff1-0/+1
* Fix linting and staticcheck issues * Add changelog update * Remove SetNext
2025-03-23docs: minor updates (#98)soopyc2-2/+2
* use _ instead of * for italicized text by convention * remove mention of the `anubis` tag from /x/
2025-03-23lib: fix default difficulty (#96)Xe Iaso1-0/+1
Before this did not respect the difficulty flag and instead used difficulty 4. This has been fixed. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-22Refactor and split out things into cmd and lib (#77)Yulian Kuncheff1-0/+2
* Refactor anubis to split business logic into a lib, and cmd to just be direct usage. * Post-rebase fixes. * Update changelog, remove unnecessary one. * lib: refactor this This is mostly based on my personal preferences for how Go code should be laid out. I'm not sold on the package name "lib" (I'd call it anubis but that would stutter), but people are probably gonna import it as libanubis so it's likely fine. Packages have been "flattened" to centralize implementation with area of concern. This goes against the Java-esque style that many people like, but I think this helps make things simple. Most notably: the dnsbl client (which is a hack) is an internal package until it's made more generic. Then it can be made external. I also fixed the logic such that `go generate` works and rebased on main. * internal/test: run tests iff npx exists and DONT_USE_NETWORK is not set Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: install deps Signed-off-by: Xe Iaso <me@xeiaso.net> * .github/workflows: verbose go tests? Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: sleep 2 Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: nix this test so CI works Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: warmup per browser? Signed-off-by: Xe Iaso <me@xeiaso.net> * internal/test: disable for now :( Signed-off-by: Xe Iaso <me@xeiaso.net> * lib/anubis: do not apply bot rules if address check fails Closes #83 --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-22internal/test: introduce integration tests using Playwright (#81)Valentin Anger1-0/+1
2025-03-22Cleanup regex (#66)Dennis ten Hoove1-0/+1
* Cleanup regex Were were going overkill on the escape characters * Update docs/docs/CHANGELOG.md Co-authored-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Dennis ten Hoove <36002865+dennis1248@users.noreply.github.com> --------- Signed-off-by: Dennis ten Hoove <36002865+dennis1248@users.noreply.github.com> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-22fix: installation instructions and example (#75)Christian F. Coors2-2/+6
2025-03-21cmd/anubis: delete example RSS reader rule (#67)v1.14.2Xe Iaso1-0/+6
The example/default bot policy document had a rule to allow RSS readers through based on paths that end with ".rss", ".xml", ".atom", or ".json". Frameworks like Rails will treat these specially, meaning that going to /things/12345-whateverhaha.json could bypass Anubis. I checked the history of this rule and it was present in the original example policy file in Xe/x. This rule is likely a mistake and it has been removed. I think it was for making my blog still work with RSS readers. Thanks to Graham Sutherland for reporting this over email. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-21Add MojeekBot (#64)Dennis ten Hoove1-0/+2
* Add MojeekBot * Update docs/docs/CHANGELOG.md Co-authored-by: Xe Iaso <me@xeiaso.net> Signed-off-by: Dennis ten Hoove <36002865+dennis1248@users.noreply.github.com> --------- Signed-off-by: Dennis ten Hoove <36002865+dennis1248@users.noreply.github.com> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-21cmd/anubis: set X-Real-Ip based on X-Forwarded-For (#63)v1.14.1Xe Iaso1-0/+7
This triggers a SHAME release[0]. [0]: https://pridever.org/
2025-03-21stage v1.14.0 (#59)v1.14.0Xe Iaso1-0/+6
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-21Allow filtering by remote addresses (#52)Remilia Da Costa Faro2-0/+49
* Added the possibility to define rules for remote addresses * Added change in changelog * Added check for X-Real-Ip and X-Forwarded-For when checking for remote address filtering * cmd/anubis: refine IP filtering logic * Optimize the configuration so that the IP trie is created once at application start instead of dynamically being created every request. * Document the changes in the changelog and docs site. * Allow pure IP range filtering. * Allow user agent based IP range filtering. * Allow path based IP range filtering. * Create --debug-x-real-ip-default flag for testing Anubis locally without a HTTP load balancer. --------- Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-21cmd/anubis: explain why users are seeing Anubis (#55)Xe Iaso4-0/+37
* cmd/anubis: explain why users are seeing Anubis Closes #25 Closes #38 Also includes the beginnings of a "user guides" section in the docs for user-facing documentation. * Update docs/docs/user/known-broken-extensions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Xe Iaso <me@xeiaso.net> * cmd/anubis: fix indentation in index.templ Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-03-21cmd/anubis: configurable difficulty per-bot rule (#53)Xe Iaso3-0/+52
Closes #30 Introduces the "challenge" field in bot rule definitions: ```json { "name": "generic-bot-catchall", "user_agent_regex": "(?i:bot|crawler)", "action": "CHALLENGE", "challenge": { "difficulty": 16, "report_as": 4, "algorithm": "slow" } } ``` This makes Anubis return a challenge page for every user agent with "bot" or "crawler" in it (case-insensitively) with difficulty 16 using the old "slow" algorithm but reporting in the client as difficulty 4. This is useful when you want to make certain clients in particular suffer. Additional validation and testing logic has been added to make sure that users do not define "impossible" challenge settings. If no algorithm is specified, Anubis defaults to the "fast" algorithm. Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-21Add kagibot (#44)makeworld1-0/+1
* Add kagibot Signed-off-by: makeworld <25111343+makew0rld@users.noreply.github.com> * Update CHANGELOG.md Signed-off-by: makeworld <25111343+makew0rld@users.noreply.github.com> --------- Signed-off-by: makeworld <25111343+makew0rld@users.noreply.github.com> Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
2025-03-21general unix domain sockets support (#45)soopyc2-8/+12
* feat: allow binding to unix domain sockets this is useful when the user does not want to expose more tcp ports than needed. also simplifes configuration in some situation, like with nixos modules as the socket paths can be automatically configured. docs updated with additional configuration flags. Signed-off-by: Cassie Cheung <me@soopy.moe> * feat: graceful shutdown and cleanup on signal this is needed to clean up left-over unix sockets, else on the next boot listener panics with `address already in use`. Co-authored-by: cat <cat@gensokyo.uk> Signed-off-by: Cassie Cheung <me@soopy.moe> * feat: support unix socket upstream targets adds support for proxying unix socket upstreams, essentially allowing anubis to run without listening on tcp sockets at all*. *for metrics, neither prometheus and victoriametrics supports scraping from unix sockets. if metrics are desired, tcp sockets are still needed. Co-authored-by: cat <cat@gensokyo.uk> Signed-off-by: Cassie Cheung <me@soopy.moe> * docs: add changelog entry --------- Signed-off-by: Cassie Cheung <me@soopy.moe> Co-authored-by: cat <cat@gensokyo.uk>
2025-03-21Fix when hardwareConcurrency is undefined (#42)Callum Thomson1-0/+1
2025-03-20docs/design: add note on why anubis uses proof of workXe Iaso2-1/+36
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-03-20Explicitely define image sources in Dockerfile (#21)Dennis ten Hoove2-2/+4
* Explicitely define image sources Explicitely refering to docker.io will make the build succeed on software such as podman which does not default to docker.io as the standard image source * Dockerfiles: use the full legal docker.io/library name just in case Signed-off-by: Xe Iaso <me@xeiaso.net> * update CHANGELOG Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Co-authored-by: Xe Iaso <me@xeiaso.net>
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-01 11:23:46 +0000