This repository maintains a portable Helm chart for Anubis, using its official container image. The chart owns the Deployment, Service, policy wiring, health probes, metrics port, and optional Traefik and Prometheus integrations. Cluster-specific values remain outside the chart.

Install from the public Helm repository

helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install anubis brunner.ninja/anubis \
  --namespace anubis --create-namespace \
  --values my-values.yaml --wait

The signing Secret named by signingSecret.name must already exist. The chart references it but never stores or generates its private key. Start from examples/forward-auth-values.yaml.

For the author's homelab, Argo CD consumes this chart from the public homelab-gitops Anubis application.

LAN and CI bypass

The homelab values send clients in private address ranges directly to Gitea, without Anubis middleware. The higher-priority trusted route includes Git HTTP, action downloads, API requests, and comparisons. The Anubis endpoint is a separate route. ClientIP matches the connection peer rather than a client-supplied forwarded-IP header, so source-address preservation remains part of that cluster's trust boundary.

Protected internet routes

The homelab uses Anubis for third-party mirror owners, selected oversized public forks, their API paths, and comparison pages. Its remaining Gitea route stays unprotected. Proof-of-work difficulty is 6 and authorization cookies expire after one hour. These are deployment choices in GitOps, not chart defaults.

Repository contents

chart/: the portable application-owned Helm chart.
examples/forward-auth-values.yaml: a reusable Traefik example.
install.sh: a portable local-chart installer.
robots.txt: the matching host-level Gitea crawler policy.
test.sh: Helm lint and rendered relationship tests.
.gitea/workflows/deploy.yml: chart validation, publication, and GitOps promotion.

Install the local chart

Create the signing Secret, edit a values file, then run:

VALUES_FILE=./my-values.yaml NAMESPACE=anubis ./install.sh

The installer also accepts RELEASE_NAME. It does not assume a particular Kubernetes context; selecting and verifying the target cluster is the operator's responsibility.

Validate locally

./test.sh

This lints the chart and asserts important relationships in default and Traefik-enabled rendered output. It requires Helm and Ruby.

Releases and GitOps promotion

Chart Git tags version this chart repository: v1.0.0 publishes chart version 1.0.0; later commits publish immutable versions such as 1.0.0-1-g41627abcdef. Chart.yaml.appVersion independently records the exact upstream Anubis image release tested by the chart.

Every push and pull request is validated. A successful current main build publishes to the indexed https://brunner.ninja/charts repository, then updates only Anubis's chart targetRevision in homelab-gitops. CI requires PACKAGE_USERNAME, PACKAGE_TOKEN, and GITOPS_TOKEN; it deliberately has no Kubernetes credentials. Argo CD alone reconciles the cluster.

Gitea robots.txt

The included robots.txt is a host-level example for Gitea's custom public directory. The chart and CI do not install it.

Scope maintenance

The mirror-owner list was generated from Gitea's public repository API on 2026-08-31. Add newly created third-party mirror owners to both robots.txt and the relevant cluster-specific route expressions. Keep selected large-fork routes and robots.txt in sync. Comparison paths are matched generically.