fullnameOverride: gitea-anubis

target: " "
publicUrl: https://code.brunner.ninja
redirectDomains: code.brunner.ninja
cookieDomain: code.brunner.ninja
cookieExpirationTime: 1h
serveRobotsTxt: false

signingSecret:
  name: gitea-anubis-key
  key: ED25519_PRIVATE_KEY_HEX

policy:
  create: true
  existingConfigMap: ""
  content: |
    bots:
      - import: (data)/bots/_deny-pathological.yaml
      - import: (data)/bots/aggressive-brazilian-scrapers.yaml
      - import: (data)/meta/ai-block-aggressive.yaml
      - import: (data)/crawlers/xai.yaml
      - name: browser-proof-of-work
        user_agent_regex: Mozilla|Opera
        action: CHALLENGE
        challenge:
          algorithm: fast
          difficulty: 6
      - name: non-browser-proof-of-work
        expression: "true"
        action: CHALLENGE
        challenge:
          algorithm: fast
          difficulty: 6

    status_codes:
      CHALLENGE: 200
      DENY: 403

    honeypot:
      enabled: true
      implementation: naive

    store:
      backend: memory
      parameters: {}

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 750m
    memory: 256Mi

traefik:
  middleware:
    enabled: true
    nameOverride: gitea-anubis
    trustForwardHeader: true
    maxResponseBodySize: 1048576
  ingressRoute:
    enabled: true
    nameOverride: code-brunner-ninja-anubis
    entryPoints:
      - websecure
    routes:
      - kind: Rule
        priority: 500
        match: Host(`code.brunner.ninja`) && (ClientIP(`10.0.0.0/8`) || ClientIP(`172.16.0.0/12`) || ClientIP(`192.168.0.0/16`) || ClientIP(`fc00::/7`))
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true
      - kind: Rule
        priority: 400
        match: Host(`code.brunner.ninja`) && PathPrefix(`/.within.website`)
        services:
          - kind: Service
            name: gitea-anubis
            port: http
      - kind: Rule
        priority: 200
        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/(Bodmer|DigiLive|EFeru|Ferdi265|HowardHinnant|Kistler-Group|Links2004|LogBlock|Makuna|PaulStoffregen|PostgreSQL-For-Wordpress|TartanLlama|TuxCoding|ValveSoftware|actions|adafruit|airgradienthq|arminwinkt|bblanchon|bbulkow|boostorg|catchorg|docker|dolphin-emu|espressif|fmtlib|getsentry|h2zero|hilch|home-assistant|jbagg|khoih-prog|lucianoforks|lucysrausch|me-no-dev|microsoft|moritzsternemann|mpusz|multimediamike|opentrafficmap|papnkukn|platformio|qt-creator|ramottamado|romixlab|rook|semaf|smarty-php|vikt0rm|wolfSSL|yath)/[^/]+(/|$)`)
        middlewares:
          - name: gitea-anubis
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true
      - kind: Rule
        priority: 200
        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/feedc0de/(arduino-esp32|dolphin|esp-idf|homeassistant-core|qt-creator|source-sdk-2013|wolfssl)(/|$)`)
        middlewares:
          - name: gitea-anubis
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true
      - kind: Rule
        priority: 200
        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/(Bodmer|DigiLive|EFeru|Ferdi265|HowardHinnant|Kistler-Group|Links2004|LogBlock|Makuna|PaulStoffregen|PostgreSQL-For-Wordpress|TartanLlama|TuxCoding|ValveSoftware|actions|adafruit|airgradienthq|arminwinkt|bblanchon|bbulkow|boostorg|catchorg|docker|dolphin-emu|espressif|fmtlib|getsentry|h2zero|hilch|home-assistant|jbagg|khoih-prog|lucianoforks|lucysrausch|me-no-dev|microsoft|moritzsternemann|mpusz|multimediamike|opentrafficmap|papnkukn|platformio|qt-creator|ramottamado|romixlab|rook|semaf|smarty-php|vikt0rm|wolfSSL|yath)/[^/]+(/|$)`)
        middlewares:
          - name: gitea-anubis
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true
      - kind: Rule
        priority: 200
        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/feedc0de/(arduino-esp32|dolphin|esp-idf|homeassistant-core|qt-creator|source-sdk-2013|wolfssl)(/|$)`)
        middlewares:
          - name: gitea-anubis
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true
      - kind: Rule
        priority: 200
        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/[^/]+/[^/]+/compare(/|$)`)
        middlewares:
          - name: gitea-anubis
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true
      - kind: Rule
        priority: 200
        match: Host(`code.brunner.ninja`) && PathRegexp(`(?i)^/api/v1/repos/[^/]+/[^/]+/compare(/|$)`)
        middlewares:
          - name: gitea-anubis
        services:
          - kind: Service
            name: legacy-gitea-service
            port: http
            passHostHeader: true