Protect forgejo with anubis

ansible/roles/forgejo/files/anubis.yml

@@ -0,0 +1,4 @@
+bots:
+  - import: (data)/meta/default-config.yaml
+  - import: (data)/clients/docker-client.yaml
+  - import: (data)/clients/git.yaml

ansible/roles/forgejo/files/docker-compose.yml

@@ -21,10 +21,6 @@ services:
     depends_on:
       - db
       - redis
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.forgejo.rule=Host(`git.theorangeone.net`)
-      - traefik.http.services.forgejo-forgejo.loadbalancer.server.port=3000
     networks:
       - default
       - traefik
@@ -44,6 +40,26 @@ services:
     volumes:
       - /mnt/speed/dbs/redis/gitea:/data
 
+  anubis:
+    image: ghcr.io/techarohq/anubis:latest
+    user: "{{ docker_user.id }}:{{ docker_user.id }}"
+    restart: unless-stopped
+    environment:
+      - TARGET=http://forgejo:3000
+      - OG_PASSTHROUGH=true
+      - POLICY_FNAME=/anubis.yml
+    volumes:
+      - ./anubis.yml:/anubis.yml
+    networks:
+      - default
+      - traefik
+    depends_on:
+      - forgejo
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.forgejo.rule=Host(`git.theorangeone.net`)
+      - traefik.http.services.forgejo-forgejo.loadbalancer.server.port=3000
+
 networks:
   traefik:
     external: true

ansible/roles/forgejo/tasks/main.yml

@@ -17,6 +17,14 @@
     validate: docker compose -f %s config
   notify: restart gitea
 
+- name: Install anubis config
+  template:
+    src: files/anubis.yml
+    dest: /opt/gitea/anubis.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  notify: restart gitea
+
 - name: Install config file
   template:
     src: files/app.ini