Curious about no docker setup

[blackchandev]

Hello,
I'm curious how I could setup Anubis (and customize!) for an image board I run. I am not using docker, and my nginx needs to upgrade connection for WebSockets as well. In the docs all of this was stated as unsupported and that 'don't have enough real-world experience to know one way or another' which I would be happy to provide. I'm quite new to go so I only skimmed the cmd/anubis/main.go but it doesn't clue me in on how to setup nginx.
Or, am I misunderstanding something because most examples/usage of Anubis I see only show configuration for Docker and no 'server' or 'app' is present.

[Xe]

Anubis should work fine with websockets. I haven't tested it yet (probably can on stream today, around noon EDT is when I start streaming), but from my experience the Go standard library is almost always fine with websocket upgrades for reverse proxies. Worst case you can explicitly bypass Anubis in your nginx config.

At a high level though:

---
title: With Anubis installed
---

flowchart LR
    LB(Nginx)
    Anubis(Anubis)
    App(App)

    LB --> Anubis --> App

Loading

I dug up part of my autogenerated nginx config from my homelab Kubernetes cluster. Maybe this will help? I'm not an nginx expert anymore, sorry.

autogenerated nginx config snippet for git.xeserv.us

	server {
		server_name git.xeserv.us ;

		http2 on;

		listen 80 proxy_protocol ;
		listen [::]:80 proxy_protocol ;
		listen 443 proxy_protocol ssl;
		listen [::]:443 proxy_protocol ssl;

		set $proxy_upstream_name "-";

		ssl_certificate_by_lua_block {
			certificate.call()
		}

		location / {

			set $namespace      "gitea";
			set $ingress_name   "gitea";
			set $service_name   "git";
			set $service_port   "anubis";
			set $location_path  "/";
			set $global_rate_limit_exceeding n;

			rewrite_by_lua_block {
				lua_ingress.rewrite({
					force_ssl_redirect = false,
					ssl_redirect = true,
					force_no_ssl_redirect = false,
					preserve_trailing_slash = false,
					use_port_in_redirects = false,
					global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
				})
				balancer.rewrite()
				plugins.run()
			}

			# be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
			# will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
			# other authentication method such as basic auth or external auth useless - all requests will be allowed.
			#access_by_lua_block {
			#}

			header_filter_by_lua_block {
				lua_ingress.header()
				plugins.run()
			}

			body_filter_by_lua_block {
				plugins.run()
			}

			log_by_lua_block {
				balancer.log()

				plugins.run()
			}

			port_in_redirect off;
			set $balancer_ewma_score -1;
			set $proxy_upstream_name "gitea-git-anubis";
			set $proxy_host          $proxy_upstream_name;
			set $pass_access_scheme  $scheme;

			set $pass_server_port    $proxy_protocol_server_port;

			set $best_http_host      $http_host;
			set $pass_port           $pass_server_port;

			set $proxy_alternative_upstream_name "";

			client_max_body_size                    2048g;

			proxy_set_header Host                   $best_http_host;

			# Pass the extracted client certificate to the backend

			# Allow websocket connections
			proxy_set_header                        Upgrade           $http_upgrade;

			proxy_set_header                        Connection        $connection_upgrade;

			proxy_set_header X-Request-ID           $req_id;
			proxy_set_header X-Real-IP              $remote_addr;

			proxy_set_header X-Forwarded-For        $remote_addr;

			proxy_set_header X-Forwarded-Host       $best_http_host;
			proxy_set_header X-Forwarded-Port       $pass_port;
			proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
			proxy_set_header X-Forwarded-Scheme     $pass_access_scheme;

			proxy_set_header X-Scheme               $pass_access_scheme;

			# Pass the original X-Forwarded-For
			proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

			# mitigate HTTPoxy Vulnerability
			# https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
			proxy_set_header Proxy                  "";

			# Custom headers to proxied server

			proxy_connect_timeout                   5s;
			proxy_send_timeout                      60s;
			proxy_read_timeout                      60s;

			proxy_buffering                         off;
			proxy_buffer_size                       4k;
			proxy_buffers                           4 4k;

			proxy_max_temp_file_size                1024m;

			proxy_request_buffering                 on;
			proxy_http_version                      1.1;

			proxy_cookie_domain                     off;
			proxy_cookie_path                       off;

			# In case of errors try the next upstream server before returning an error
			proxy_next_upstream                     error timeout;
			proxy_next_upstream_timeout             0;
			proxy_next_upstream_tries               3;

			# Custom Response Headers

			proxy_pass http://upstream_balancer;

			proxy_redirect                          off;

		}

	}

I'll work on it. I'm focusing on the low-hanging fruit of docker-based setups right now because that's what I have the most professional experience with. I plan to make binary packages available, but I am one person and have to pay my capitalism bills.

setup Anubis (and customize!) for an image board I run

If you do customize Anubis' branding, I'd kindly ask (not enforce, these are words on the Internet, not word of law) that you donate to the project because I need to eat and the price of food has been increasing. I'd also love to not have to work on my dayjob and would love to fight bots full time, but I can't do that if I can't afford rent.

[blackchandev]

Ah thank you for the reply! Regarding customizing it I just wanted to change the logo to something else, I would retain the notice.

[blackchandev]

Anubis should work fine with websockets. I haven't tested it yet (probably can on stream today, around noon EDT is when I start streaming), but from my experience the Go standard library is almost always fine with websocket upgrades for reverse proxies. Worst case you can explicitly bypass Anubis in your nginx config.

At a high level though:

---
title: With Anubis installed
---

flowchart LR
    LB(Nginx)
    Anubis(Anubis)
    App(App)

    LB --> Anubis --> App

Loading

I dug up part of my autogenerated nginx config from my homelab Kubernetes cluster. Maybe this will help? I'm not an nginx expert anymore, sorry.

autogenerated nginx config snippet for git.xeserv.us

	server {
		server_name git.xeserv.us ;

		http2 on;

		listen 80 proxy_protocol ;
		listen [::]:80 proxy_protocol ;
		listen 443 proxy_protocol ssl;
		listen [::]:443 proxy_protocol ssl;

		set $proxy_upstream_name "-";

		ssl_certificate_by_lua_block {
			certificate.call()
		}

		location / {

			set $namespace      "gitea";
			set $ingress_name   "gitea";
			set $service_name   "git";
			set $service_port   "anubis";
			set $location_path  "/";
			set $global_rate_limit_exceeding n;

			rewrite_by_lua_block {
				lua_ingress.rewrite({
					force_ssl_redirect = false,
					ssl_redirect = true,
					force_no_ssl_redirect = false,
					preserve_trailing_slash = false,
					use_port_in_redirects = false,
					global_throttle = { namespace = "", limit = 0, window_size = 0, key = { }, ignored_cidrs = { } },
				})
				balancer.rewrite()
				plugins.run()
			}

			# be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
			# will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
			# other authentication method such as basic auth or external auth useless - all requests will be allowed.
			#access_by_lua_block {
			#}

			header_filter_by_lua_block {
				lua_ingress.header()
				plugins.run()
			}

			body_filter_by_lua_block {
				plugins.run()
			}

			log_by_lua_block {
				balancer.log()

				plugins.run()
			}

			port_in_redirect off;
			set $balancer_ewma_score -1;
			set $proxy_upstream_name "gitea-git-anubis";
			set $proxy_host          $proxy_upstream_name;
			set $pass_access_scheme  $scheme;

			set $pass_server_port    $proxy_protocol_server_port;

			set $best_http_host      $http_host;
			set $pass_port           $pass_server_port;

			set $proxy_alternative_upstream_name "";

			client_max_body_size                    2048g;

			proxy_set_header Host                   $best_http_host;

			# Pass the extracted client certificate to the backend

			# Allow websocket connections
			proxy_set_header                        Upgrade           $http_upgrade;

			proxy_set_header                        Connection        $connection_upgrade;

			proxy_set_header X-Request-ID           $req_id;
			proxy_set_header X-Real-IP              $remote_addr;

			proxy_set_header X-Forwarded-For        $remote_addr;

			proxy_set_header X-Forwarded-Host       $best_http_host;
			proxy_set_header X-Forwarded-Port       $pass_port;
			proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
			proxy_set_header X-Forwarded-Scheme     $pass_access_scheme;

			proxy_set_header X-Scheme               $pass_access_scheme;

			# Pass the original X-Forwarded-For
			proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

			# mitigate HTTPoxy Vulnerability
			# https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
			proxy_set_header Proxy                  "";

			# Custom headers to proxied server

			proxy_connect_timeout                   5s;
			proxy_send_timeout                      60s;
			proxy_read_timeout                      60s;

			proxy_buffering                         off;
			proxy_buffer_size                       4k;
			proxy_buffers                           4 4k;

			proxy_max_temp_file_size                1024m;

			proxy_request_buffering                 on;
			proxy_http_version                      1.1;

			proxy_cookie_domain                     off;
			proxy_cookie_path                       off;

			# In case of errors try the next upstream server before returning an error
			proxy_next_upstream                     error timeout;
			proxy_next_upstream_timeout             0;
			proxy_next_upstream_tries               3;

			# Custom Response Headers

			proxy_pass http://upstream_balancer;

			proxy_redirect                          off;

		}

	}

I'll work on it. I'm focusing on the low-hanging fruit of docker-based setups right now because that's what I have the most professional experience with. I plan to make binary packages available, but I am one person and have to pay my capitalism bills.

setup Anubis (and customize!) for an image board I run

If you do customize Anubis' branding, I'd kindly ask (not enforce, these are words on the Internet, not word of law) that you donate to the project because I need to eat and the price of food has been increasing. I'd also love to not have to work on my dayjob and would love to fight bots full time, but I can't do that if I can't afford rent.

I ran Anubis deb package with nginx, had to change my setup a little, but web sockets worked without issue.

[Xe]

Nice! Really happy to hear things worked out. Do you have any feedback for the native packaging or docs so I can make it better for the next person using it?

[blackchandev]

Hi,
I followed the docs, but the issues I faced were strictly nginx config problems (passing headers correctly etc.) because I used a setup TLS (nginx) -> Anubis -> Rev. Proxy (nginx) -> web server. I think adding a note for such setups to remind admins to correctly pass headers would be nice.