One issue with Anubis with this configuration is that with rootless-podman anubis doesn't get correct remote ip-address. This is due nginx doesn't get correct remote address in this flow.

One issue with Anubis with this configuration is that with rootless-podman anubis doesn't get correct remote ip-address. This is due nginx doesn't get correct remote address in this flow.

This should not be an issue in default use, as anubis doesn't do geo-ip/ASN-based filtering by default (https://anubis.techaro.lol/docs/admin/thoth#thoth-features)

My brain's still kind of coming back online so I haven't had a chance to really parse this, but I'm very excited about anything that helps with the spam situation! Thank you so much for working on it

I change the flow so that nginx uses anubis as subrequest autenticator (https://anubis.techaro.lol/docs/admin/configuration/subrequest-auth) to simplify how it is integrated in existing nginx configuration.

I squashed the commits so it only contains the subrequest authentication changes, so it doesn't confuse what is actually changing. Otherwise I think it works quite ok and with my limited testing I didn't have spotted any case where it would have stopped legitimate use.

I'm running into this issue creating the Anubis image locally:

bookwyrm-anubis-1  | {"time":"2026-01-22T22:43:29.117345339Z","level":"INFO","source":{"function":"main.main","file":"github.com/TecharoHQ/anubis/cmd/anubis/main.go","line":279},"msg":"starting up Anubis"}
bookwyrm-anubis-1  | {"time":"2026-01-22T22:43:29.117639089Z","level":"INFO","source":{"function":"main.main","file":"github.com/TecharoHQ/anubis/cmd/anubis/main.go","line":341},"msg":"loading policy file","fname":"/data/cfg/botPolicy.yaml"}
bookwyrm-anubis-1  | 2026/01/22 22:43:29 can't parse policy file: can't parse policy file /data/cfg/botPolicy.yaml: config is not valid:
bookwyrm-anubis-1  | store: configuration is invalid: bbolt: can't write to path

I'm running into this issue creating the Anubis image locally:

bookwyrm-anubis-1  | {"time":"2026-01-22T22:43:29.117345339Z","level":"INFO","source":{"function":"main.main","file":"github.com/TecharoHQ/anubis/cmd/anubis/main.go","line":279},"msg":"starting up Anubis"}
bookwyrm-anubis-1  | {"time":"2026-01-22T22:43:29.117639089Z","level":"INFO","source":{"function":"main.main","file":"github.com/TecharoHQ/anubis/cmd/anubis/main.go","line":341},"msg":"loading policy file","fname":"/data/cfg/botPolicy.yaml"}
bookwyrm-anubis-1  | 2026/01/22 22:43:29 can't parse policy file: can't parse policy file /data/cfg/botPolicy.yaml: config is not valid:
bookwyrm-anubis-1  | store: configuration is invalid: bbolt: can't write to path

hmmm.. looks like for some reason the anubis_data is not mounted to /data or something with the volume permissions are off :/

Does it make difference if you change the /data mount to something else and change the path accordingly in botPolicy.yaml file? Could be something different on volume definitions between podman and docker.

Other option is to try just take out the storage section in config and run it as memory storage. Which should be fine, it only means mostly that browsers are rechecked if anubis restarts.

How do I change it in the policy? It seems like it's loading that file from github?

How do I change it in the policy? It seems like it's loading that file from github?

it is the anubis/botPolicy.yaml file that has all the configs. It references to github to see what the defaults are,but it doesnt load things from there.

I'll add comment on changed files to highlight what to change.

@mouse-reeve let me know if you have still issues with this PR, I can also modify the PR changes to simplify it so it doesn't need separate volume.

Removing lines 11 to 14 in the botPolicy file got the anubis image running, but I'm hitting this error in nginx:

bookwyrm-nginx-1  | 2026/01/23 19:12:35 [emerg] 1#1: host not found in upstream "anubis:8000" in /etc/nginx/conf.d/default.conf:11
bookwyrm-nginx-1  | nginx: [emerg] host not found in upstream "anubis:8000" in /etc/nginx/conf.d/default.conf:11

Removing lines 11 to 14 in the botPolicy file got the anubis image running, but I'm hitting this error in nginx:

bookwyrm-nginx-1  | 2026/01/23 19:12:35 [emerg] 1#1: host not found in upstream "anubis:8000" in /etc/nginx/conf.d/default.conf:11
bookwyrm-nginx-1  | nginx: [emerg] host not found in upstream "anubis:8000" in /etc/nginx/conf.d/default.conf:11

that sounds strange, as docker/podman should resolve the container-name same with anubis what it does with web -container on upstreams. There are no other errors visible from anubis or nginx ?

One thing that could be, both web and anubis binds to 8000 port in this setup. If the docker enviroment pushes those both to local interfaces they could conflict. I'll try to check docker setup for myself to check if it works differently in this case than podman.

I was able to reproduce the problem, and issue is that I forgot to add the network: part in anubis service similar what nginx and other have.

So in podman it didn't matter but in docker it did, so it caused anubis and nginx ending up in different networks in docker side. I'll update the PR accordingly.

Rebased on top of current main, reworked config so it works correctly with docker also and removed persistent key/storage use, as I don't think we need it currently.

Removed the domain config from anubis and host in redirect so it works in dev-mode where port is defined and domain is localhost

just note for myself, currently goes haywire with dev-setup in nonstandard port, i.e. localhost:1333 directly.

Turns out nginx absolute_redirect on; setting seemed to cause the odd behaviour, when turning it off, things seems to work correctly with http://localhost:1333, reverse_proxy with ngrok and https setups.

Protection is not as tight as it could be, but I think in this case it is more compatible in all the flows and improves by default things. Setting REDIRECT_DOMAINS etc can be done each admin per site if they see the need for it.

I tried this again and I'm very sorry to report that I'm still getting

bookwyrm-nginx-1  | 2026/02/02 21:36:40 [emerg] 1#1: host not found in upstream "anubis:8000" in /etc/nginx/conf.d/default.conf:11
bookwyrm-nginx-1  | nginx: [emerg] host not found in upstream "anubis:8000" in /etc/nginx/conf.d/default.conf:11

Wait nevermind!! I just hadn't properly restarted. It seems to be working!