Anyone with experience using anubis on their lemmy server, have a good config?

I've recently added anubis to lemmy.ml, and it seems to be working well.

I have a PR to add anubis to lemmy-ansible (our main installation method), and I could use some help tweaking / optimizing its botPolicy.yaml config, for federated services.

Anyone with experience running anubis, this would be much appreciated.

Adding an optional anubis config by dessalines · Pull Request #285 · LemmyNet/lemmy-ansible

A docker deploy for ansible. Contribute to LemmyNet/lemmy-ansible development by creating an account on GitHub.

GitHub (github.com)

https://lemmy.nz/ and https://quokk.au/ are running Anubis, and so those admins may be able to offer insight

Do we have an equivalent service on lemmy.ca? (I don't know anything about net security and am just curious)

I regularly encounter images not loading from quock.au. No idea if they've got that under control now but that is the most visible issue every instance fights with. Gonna ne great when we have a recommended configuration for Lemmy.

We are not running Anubis, although we do block a large number of AI/LLM companies through IP addresses. Each time we block a new one, it makes a noticeable difference in the performance graphs.

@poVoq@slrpnk.net

Yep, essentially the botPolicy.yaml there could be a collectively developed anubis config, based on what works best.

Sure. I have found that the default botPolicy works fine for blocking the AI bots, but blocks federation.

At the reverse proxy level:

if ($request_method = POST) {
    proxy_pass http://nodebb; 
}

Because Anubis can't filter by HTTP method, unless I am mistaken. This just broadly allows all incoming activities. If you want to get specific, limit it to your shared inbox or individual user inboxes via regular expression or something. I didn't find that it was necessary.

As for botPolicies.yaml

  # Allow /inbox
  - name: allow-ap-headers
    headers_regex:
      Accept: application/ld\+json; profile="https://www.w3.org/ns/activitystreams"
      Accept: application/activity\+json
    action: ALLOW

  - name: allow-assets
    path_regex: /assets
    action: ALLOW

The former allows those specific AP headers (it is naive, some AP impls. send slight variations of those two headers.

The latter allows our uploads.