From ed997285239fae5f65ef837192c9647a4d5b2dcb Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Sun, 18 Oct 2026 21:23:14 +0200
Subject: [PATCH] Add Anubis Argo CD application

---
 apps/anubis/values.yaml      | 142 +++++++++++++++++++++++++++++++++++
 bootstrap/anubis.yaml        |  26 +++++++
 bootstrap/kustomization.yaml |   1 +
 bootstrap/project.yaml       |   4 +
 4 files changed, 173 insertions(+)
 create mode 100644 apps/anubis/values.yaml
 create mode 100644 bootstrap/anubis.yaml

diff --git a/apps/anubis/values.yaml b/apps/anubis/values.yaml
new file mode 100644
index 0000000..8d9ce1c
--- /dev/null
+++ b/apps/anubis/values.yaml
@@ -0,0 +1,142 @@
+fullnameOverride: gitea-anubis
+
+target: " "
+publicUrl: https://code.brunner.ninja
+redirectDomains: code.brunner.ninja
+cookieDomain: code.brunner.ninja
+cookieExpirationTime: 1h
+serveRobotsTxt: false
+
+signingSecret:
+  name: gitea-anubis-key
+  key: ED25519_PRIVATE_KEY_HEX
+
+policy:
+  create: true
+  existingConfigMap: ""
+  content: |
+    bots:
+      - import: (data)/bots/_deny-pathological.yaml
+      - import: (data)/bots/aggressive-brazilian-scrapers.yaml
+      - import: (data)/meta/ai-block-aggressive.yaml
+      - import: (data)/crawlers/xai.yaml
+      - name: browser-proof-of-work
+        user_agent_regex: Mozilla|Opera
+        action: CHALLENGE
+        challenge:
+          algorithm: fast
+          difficulty: 6
+      - name: non-browser-proof-of-work
+        expression: "true"
+        action: CHALLENGE
+        challenge:
+          algorithm: fast
+          difficulty: 6
+
+    status_codes:
+      CHALLENGE: 200
+      DENY: 403
+
+    honeypot:
+      enabled: true
+      implementation: naive
+
+    store:
+      backend: memory
+      parameters: {}
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 750m
+    memory: 256Mi
+
+traefik:
+  middleware:
+    enabled: true
+    nameOverride: gitea-anubis
+    trustForwardHeader: true
+    maxResponseBodySize: 1048576
+  ingressRoute:
+    enabled: true
+    nameOverride: code-brunner-ninja-anubis
+    entryPoints:
+      - websecure
+    routes:
+      - kind: Rule
+        priority: 500
+        match: Host(`code.brunner.ninja`) && (ClientIP(`10.0.0.0/8`) || ClientIP(`172.16.0.0/12`) || ClientIP(`192.168.0.0/16`) || ClientIP(`fc00::/7`))
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
+      - kind: Rule
+        priority: 400
+        match: Host(`code.brunner.ninja`) && PathPrefix(`/.within.website`)
+        services:
+          - kind: Service
+            name: gitea-anubis
+            port: http
+      - kind: Rule
+        priority: 200
+        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/(Bodmer|DigiLive|EFeru|Ferdi265|HowardHinnant|Kistler-Group|Links2004|LogBlock|Makuna|PaulStoffregen|PostgreSQL-For-Wordpress|TartanLlama|TuxCoding|ValveSoftware|actions|adafruit|airgradienthq|arminwinkt|bblanchon|bbulkow|boostorg|catchorg|docker|dolphin-emu|espressif|fmtlib|getsentry|h2zero|hilch|home-assistant|jbagg|khoih-prog|lucianoforks|lucysrausch|me-no-dev|microsoft|moritzsternemann|mpusz|multimediamike|opentrafficmap|papnkukn|platformio|qt-creator|ramottamado|romixlab|rook|semaf|smarty-php|vikt0rm|wolfSSL|yath)/[^/]+(/|$)`)
+        middlewares:
+          - name: gitea-anubis
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
+      - kind: Rule
+        priority: 200
+        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/feedc0de/(arduino-esp32|dolphin|esp-idf|homeassistant-core|qt-creator|source-sdk-2013|wolfssl)(/|$)`)
+        middlewares:
+          - name: gitea-anubis
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
+      - kind: Rule
+        priority: 200
+        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/(Bodmer|DigiLive|EFeru|Ferdi265|HowardHinnant|Kistler-Group|Links2004|LogBlock|Makuna|PaulStoffregen|PostgreSQL-For-Wordpress|TartanLlama|TuxCoding|ValveSoftware|actions|adafruit|airgradienthq|arminwinkt|bblanchon|bbulkow|boostorg|catchorg|docker|dolphin-emu|espressif|fmtlib|getsentry|h2zero|hilch|home-assistant|jbagg|khoih-prog|lucianoforks|lucysrausch|me-no-dev|microsoft|moritzsternemann|mpusz|multimediamike|opentrafficmap|papnkukn|platformio|qt-creator|ramottamado|romixlab|rook|semaf|smarty-php|vikt0rm|wolfSSL|yath)/[^/]+(/|$)`)
+        middlewares:
+          - name: gitea-anubis
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
+      - kind: Rule
+        priority: 200
+        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/feedc0de/(arduino-esp32|dolphin|esp-idf|homeassistant-core|qt-creator|source-sdk-2013|wolfssl)(/|$)`)
+        middlewares:
+          - name: gitea-anubis
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
+      - kind: Rule
+        priority: 200
+        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/[^/]+/[^/]+/compare(/|$)`)
+        middlewares:
+          - name: gitea-anubis
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
+      - kind: Rule
+        priority: 200
+        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/[^/]+/[^/]+/compare(/|$)`)
+        middlewares:
+          - name: gitea-anubis
+        services:
+          - kind: Service
+            name: legacy-gitea-service
+            port: http
+            passHostHeader: true
diff --git a/bootstrap/anubis.yaml b/bootstrap/anubis.yaml
new file mode 100644
index 0000000..e0d97d6
--- /dev/null
+++ b/bootstrap/anubis.yaml
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: anubis
+  namespace: argocd
+spec:
+  project: homelab
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: anubis
+    targetRevision: 1.0.0
+    helm:
+      releaseName: anubis
+      valueFiles:
+      - $values/apps/anubis/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index d9422ee..5b07d3c 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -8,6 +8,7 @@ resources:
 - sealed-secrets.yaml
 - immich-sync.yaml
 - immichframe.yaml
+- anubis.yaml
 - metallb-project.yaml
 - metallb.yaml
 - brgkepler-com.yaml
diff --git a/bootstrap/project.yaml b/bootstrap/project.yaml
index 3dd6ec2..6cfa0a7 100644
--- a/bootstrap/project.yaml
+++ b/bootstrap/project.yaml
@@ -33,5 +33,9 @@ spec:
     kind: PrometheusRule
   - group: monitoring.coreos.com
     kind: ServiceMonitor
+  - group: traefik.io
+    kind: IngressRoute
+  - group: traefik.io
+    kind: Middleware
   - group: bitnami.com
     kind: SealedSecret