From c82140c347eb2d5f4bfff06c2eb4a8120d17bd69 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Sun, 7 Jun 2026 15:44:20 +0100
Subject: [PATCH] Protect forgejo with anubis

---
 ansible/roles/forgejo/files/anubis.yml        |  4 ++++
 .../roles/forgejo/files/docker-compose.yml    | 24 +++++++++++++++----
 ansible/roles/forgejo/tasks/main.yml          |  8 +++++++
 3 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 ansible/roles/forgejo/files/anubis.yml

diff --git a/ansible/roles/forgejo/files/anubis.yml b/ansible/roles/forgejo/files/anubis.yml
new file mode 100644
index 0000000..37c6a1b
--- /dev/null
+++ b/ansible/roles/forgejo/files/anubis.yml
@@ -0,0 +1,4 @@
+bots:
+  - import: (data)/meta/default-config.yaml
+  - import: (data)/clients/docker-client.yaml
+  - import: (data)/clients/git.yaml
diff --git a/ansible/roles/forgejo/files/docker-compose.yml b/ansible/roles/forgejo/files/docker-compose.yml
index 967cc17..32537da 100644
--- a/ansible/roles/forgejo/files/docker-compose.yml
+++ b/ansible/roles/forgejo/files/docker-compose.yml
@@ -21,10 +21,6 @@ services:
     depends_on:
       - db
       - redis
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.forgejo.rule=Host(`git.theorangeone.net`)
-      - traefik.http.services.forgejo-forgejo.loadbalancer.server.port=3000
     networks:
       - default
       - traefik
@@ -44,6 +40,26 @@ services:
     volumes:
       - /mnt/speed/dbs/redis/gitea:/data
 
+  anubis:
+    image: ghcr.io/techarohq/anubis:latest
+    user: "{{ docker_user.id }}:{{ docker_user.id }}"
+    restart: unless-stopped
+    environment:
+      - TARGET=http://forgejo:3000
+      - OG_PASSTHROUGH=true
+      - POLICY_FNAME=/anubis.yml
+    volumes:
+      - ./anubis.yml:/anubis.yml
+    networks:
+      - default
+      - traefik
+    depends_on:
+      - forgejo
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.forgejo.rule=Host(`git.theorangeone.net`)
+      - traefik.http.services.forgejo-forgejo.loadbalancer.server.port=3000
+
 networks:
   traefik:
     external: true
diff --git a/ansible/roles/forgejo/tasks/main.yml b/ansible/roles/forgejo/tasks/main.yml
index ed9d63a..e4d11ba 100644
--- a/ansible/roles/forgejo/tasks/main.yml
+++ b/ansible/roles/forgejo/tasks/main.yml
@@ -17,6 +17,14 @@
     validate: docker compose -f %s config
   notify: restart gitea
 
+- name: Install anubis config
+  template:
+    src: files/anubis.yml
+    dest: /opt/gitea/anubis.yml
+    mode: "{{ docker_compose_file_mask }}"
+    owner: "{{ docker_user.name }}"
+  notify: restart gitea
+
 - name: Install config file
   template:
     src: files/app.ini