Anyone with experience using anubis on their lemmy server, have a good config?

[dessalines@lemmy.ml]

I've recently added anubis to lemmy.ml, and it seems to be working well.

I have a PR to add anubis to lemmy-ansible (our main installation method), and I could use some help tweaking / optimizing its botPolicy.yaml config, for federated services.

Anyone with experience running anubis, this would be much appreciated.

[otter@lemmy.ca]

https://lemmy.nz/ and https://quokk.au/ are running Anubis, and so those admins may be able to offer insight :)

[alabaster_mango@lemmy.ca]

Do we have an equivalent service on lemmy.ca? (I don't know anything about net security and am just curious)

[bjoern_tantau@swg-empire.de]

I regularly encounter images not loading from quock.au. No idea if they've got that under control now but that is the most visible issue every instance fights with. Gonna ne great when we have a recommended configuration for Lemmy.

[otter@lemmy.ca]

We are not running Anubis, although we do block a large number of AI/LLM companies through IP addresses. Each time we block a new one, it makes a noticeable difference in the performance graphs.

[ex_06@slrpnk.net]

@poVoq@slrpnk.net

[dessalines@lemmy.ml]

Yep, essentially the botPolicy.yaml there could be a collectively developed anubis config, based on what works best.

[julian@activitypub.space]

Sure. I have found that the default botPolicy works fine for blocking the AI bots, but blocks federation.

At the reverse proxy level:

if ($request_method = POST) {
    proxy_pass http://nodebb; 
}

Because Anubis can't filter by HTTP method, unless I am mistaken.

As for botPolicies.yaml

  # Allow /inbox
  - name: allow-ap-headers
    headers_regex:
      Accept: application/ld\+json; profile="https://www.w3.org/ns/activitystreams"
      Accept: application/activity\+json
    action: ALLOW

  - name: allow-assets
    path_regex: /assets
    action: ALLOW

The former allows those specific AP headers (it is naive, some AP impls. send slight variations of those two headers.

The latter allows our uploads.