Update anubis deployment to better protect my git hosting

README.md

@@ -10,14 +10,15 @@ an out-of-repository signing key.
 Anubis is used for:
 
 - repository and API paths belonging to the current third-party mirror owners;
+- selected oversized public `feedc0de` forks (at least 512 MiB);
 - the complete `EFeru` owner subtree, including the owner page itself;
 - comparison pages under every owner, including `feedc0de`.
 
 The existing catch-all Gitea route remains unprotected, so login, about,
-explore, owner pages other than `EFeru`, and every `feedc0de/*` repository
-remain unchanged outside their comparison pages.
+explore, owner pages other than `EFeru`, and ordinary `feedc0de/*`
+repositories remain unchanged outside their comparison pages.
 
-Proof-of-work difficulty is 6 and authorization cookies expire after one hour.
+Proof-of-work difficulty is 5 and authorization cookies expire after one hour.
 Each additional difficulty level multiplies expected work by 16. Solve time is
 random and depends on the client's CPU and browser.
 
@@ -123,5 +124,7 @@ but is not changed by CI.
 
 The mirror-owner list was generated from Gitea's public repository API on
 2026-08-31. Add newly created third-party mirror owners to both `robots.txt`
-and the two owner expressions in `anubis.yaml`. Comparison pages are matched
-generically and need no owner-list maintenance.
+and the two owner expressions in `anubis.yaml`. Public `feedc0de` forks at or
+above the documented size threshold must be added to both their specific route
+expressions and `robots.txt`. Comparison pages are matched generically and
+need no owner-list maintenance.

anubis.yaml

@@ -206,6 +206,19 @@ spec:
           name: legacy-gitea-service
           port: http
           passHostHeader: true
+    # These public feedc0de forks are at least 512 MiB. Protect their complete
+    # web and Git HTTP surface from automated bulk scraping while leaving the
+    # smaller personal repositories directly accessible.
+    - kind: Rule
+      priority: 200
+      match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/feedc0de/(arduino-esp32|dolphin|esp-idf|homeassistant-core|qt-creator|source-sdk-2013|wolfssl)(/|$)`)
+      middlewares:
+        - name: gitea-anubis
+      services:
+        - kind: Service
+          name: legacy-gitea-service
+          port: http
+          passHostHeader: true
     - kind: Rule
       priority: 200
       match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/(Bodmer|DigiLive|EFeru|Ferdi265|HowardHinnant|Kistler-Group|Links2004|LogBlock|Makuna|PaulStoffregen|PostgreSQL-For-Wordpress|TartanLlama|TuxCoding|ValveSoftware|actions|adafruit|airgradienthq|arminwinkt|bblanchon|bbulkow|boostorg|catchorg|docker|dolphin-emu|espressif|fmtlib|getsentry|h2zero|hilch|home-assistant|jbagg|khoih-prog|lucianoforks|lucysrausch|me-no-dev|microsoft|moritzsternemann|mpusz|multimediamike|opentrafficmap|papnkukn|platformio|qt-creator|ramottamado|romixlab|rook|semaf|smarty-php|vikt0rm|wolfSSL|yath)/[^/]+(/|$)`)
@@ -216,6 +229,16 @@ spec:
           name: legacy-gitea-service
           port: http
           passHostHeader: true
+    - kind: Rule
+      priority: 200
+      match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/feedc0de/(arduino-esp32|dolphin|esp-idf|homeassistant-core|qt-creator|source-sdk-2013|wolfssl)(/|$)`)
+      middlewares:
+        - name: gitea-anubis
+      services:
+        - kind: Service
+          name: legacy-gitea-service
+          port: http
+          passHostHeader: true
     - kind: Rule
       priority: 200
       match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/[^/]+/[^/]+/compare(/|$)`)

robots.txt

@@ -1,8 +1,19 @@
 # Keep personal repositories and the rest of the Gitea site indexable while
-# excluding third-party mirrors and expensive comparison pages.
+# excluding third-party mirrors, oversized public forks, and expensive
+# comparison pages.
 User-agent: *
 Allow: /feedc0de/
 
+# Public feedc0de forks at least 512 MiB are not crawler targets. These are
+# retained for development; their upstream projects remain the public source.
+Disallow: /feedc0de/arduino-esp32/
+Disallow: /feedc0de/dolphin/
+Disallow: /feedc0de/esp-idf/
+Disallow: /feedc0de/homeassistant-core/
+Disallow: /feedc0de/qt-creator/
+Disallow: /feedc0de/source-sdk-2013/
+Disallow: /feedc0de/wolfssl/
+
 # Comparison pages are especially expensive for Gitea to generate, including
 # comparisons below the otherwise allowed feedc0de owner.
 Disallow: /*/*/compare/