At the reverse proxy level:

if ($request_method = POST) {
    proxy_pass http://nodebb; 
}

Because Anubis can't filter by HTTP method, unless I am mistaken. This just broadly allows all incoming activities. If you want to get specific, limit it to your shared inbox or individual user inboxes via regular expression or something. I didn't find that it was necessary.

As for botPolicies.yaml

  # Allow /inbox
  - name: allow-ap-headers
    headers_regex:
      Accept: application/ld\+json; profile="https://www.w3.org/ns/activitystreams"
      Accept: application/activity\+json
    action: ALLOW

  - name: allow-assets
    path_regex: /assets
    action: ALLOW

The former allows those specific AP headers (it is naive, some AP impls. send slight variations of those two headers.

The latter allows our uploads.