Ccmeetsskynetfellowshipdefeatingsauron

https://cc.practices.tools/pad/p/laura-palmers-revenge

First attempt 30 Oct

(pad copy/paste below)

sudo tail -f /var/log/nginx/access.log
>> nginx + etherdot + wiki + pad + octomode 
sudo tail -f /var/log/nginx/error.log 



Anubis
(the thing with the anime girl which open a first page before the actual page, plus it also uses blacklists)
https://anubis.techaro.lol/docs/admin/installation
known peers using it:
> varia
    certain challenge levels: restrict/relaxed
    discussion on banning every IP out of netherlands (radical but radically cool)
    alex on Mastodon (https://post.lurk.org/deck/@catileptic@chaos.social) suggested using crowdsec to luke
> domainepublic.net

sometimes anubis is annoying for hand-made webpages, because you can't curl etc
curling a pad is possibly not working anymore?
or, opening a pad in a iframe might not work anymore?

INSTALL ANUBIS FOR THE WIKI
https://anubis.techaro.lol/docs/admin/installation
question: does wiki-to-print still work with anubis?

https://anubis.techaro.lol/docs/admin/native-install/

putting anubis deb file in the friend home folder:
cd /home/friend/
wget https://github.com/TecharoHQ/anubis/releases/download/v1.28.2/anubis_1.28.2_amd64.deb
sudo apt install ./anubis_1.28.2_amd64.deb 

copy default config file
sudo cp /etc/anubis/default.env /etc/anubis/wiki.env

sudo cp /usr/share/doc/anubis/botPolicies.yaml /etc/anubis/wiki.botPolicies.yaml

cd /etc/anubis/
sudo nano wiki.env

https://anubis.techaro.lol/docs/admin/installation/#environment-variables

- BIND: The network address that Anubis listens on. For unix, set this to a path: /run/anubis/instance.sock
- DIFFICULTY: The difficulty of the challenge, or the number of leading zeroes that must be in successful responses.
- METRIC_BIND: The legacy configuration value for the network address that Anubis serves Prometheus metrics on. Please migrate this to the policy file as soon as possible.
- SERVE_ROBOTS_TXT: If set true, Anubis will serve a default robots.txt file that disallows all known AI scrapers by name and then additionally disallows every scraper. This is useful if facts and circumstances make it difficult to change the underlying service to serve such a robots.txt file.
- TARGET: The URL of the service that Anubis should forward valid requests to. Supports Unix domain sockets, set this to a URI like so: unix:///path/to/socket.sock.

    > external URL: cc.practices.tools/wiki/

    > internal process: php-fpm socket


    checking nginx...

    sudo nano /etc/nginx/sites-available/default


    php runs on this sockets

    unix:/run/php/php8.4-fpm.sock

    if we use this for anubis, it will be active on all php connections

    let's try it....


    sudo nano /etc/anubis/wiki.env

    TARGET=unix:/run/php/php8.4-fpm.sock


sudo systemctl enable --now anubis@wiki.service


now test to see if it is running
curl http://localhost:9090/metrics
looks good

then setup nginx
https://anubis.techaro.lol/docs/admin/environments/nginx/

    (1) we are adding an anubis upstream at the bottom of the default conf


    upstream anubis {

      # Make sure this matches the values you set for `BIND` and `BIND_NETWORK`.

      # If this does not match, your services will not be protected by Anubis.


      # Try anubis first over a UNIX socket

      server unix:/run/anubis/nginx.sock;

      #server 127.0.0.1:8923;


      # Optional: fall back to serving the websites directly. This allows your

      # websites to be resilient against Anubis failing, at the risk of exposing

      # them to the raw internet without protection. This is a tradeoff and can

      # be worth it in some edge cases.

      #server unix:/run/nginx.sock backup;

    }


    (2) redirect /wiki/ to anubis

    location /wiki/ {

      proxy_set_header Host $host;

      proxy_set_header X-Real-IP $remote_addr;

      proxy_set_header X-TLS-SNI-Name $ssl_server_name;

      proxy_pass http://anubis;

    }


    (3) create a "nginx backend block" that anubis will point to


    # Backend server, this is where your webapp should actually live.

    server {

      listen unix:/run/nginx/nginx.sock;


      # Get the visiting IP from the TLS termination server

      set_real_ip_from unix:;

      real_ip_header X-Real-IP;


      rewrite ^/wiki/(?<pagename>.*)$ /wiki/index.php;

      alias /var/www/wiki/;

    }


    (4) we add http2 on at the top of the conf

    http2 on;


!!! we made a backup of the pre-anubis nginx config here: /etc/nginx/sites-available/default-withoutanubis

sudo nginx -t 


2026/10/30 12:14:15 [emerg] 1969123#1969123: "server" directive is not allowed here in /etc/nginx/sites-enabled/default:143
nginx: configuration file /etc/nginx/nginx.conf test failed


hmm....

we move the backend server block outside, at the bottom of the default conf

sudo nginx -t

2026/10/30 12:15:46 [emerg] 1969139#1969139: "alias" directive is not allowed here in /etc/nginx/sites-enabled/default:224
nginx: configuration file /etc/nginx/nginx.conf test failed

changing "alias" to "root"...

sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: [emerg] bind() to unix:/run/nginx/nginx.sock failed (2: No such file or directory)
nginx: configuration file /etc/nginx/nginx.conf test failed

hmm, yes, our setup does not match the anubis examples...

WHY?


- we are only applying anubis to the wiki, which comes off https://cc.practices.tools/wiki/
- we are not using a subdomain for the wiki 

    we do not use subdomains for the difference things we run on the server (wiki/pad/etherdot/octomode/wiki-to-print....) because we use one cc subdomain for everything. 

    the examples are based on the commonly used method to split nginx config files between services

- the examples use anubis on one full config file (not just a part of it, like we do with the wiki)

next steps we can take:

- we can ask luke if he set up anubis on a subfolder (so not a subdomain)? 
- ask the fedverse hivemind

for now: 

- we place the non-anubis config back, as default
- default-with-anubis still holds the changes we made today

sudo nginx -t
sudo systemctl reload nginx

that's it for today



iocaine
https://iocaine.madhouse-project.org/

superlowtech hacky alternatives
> titipi, did something similar with just a page that takes 3sec to go to the actual website (most bot don't go that far?)
- look on the titipi wiki if they documented what they did
https://titipi.org/wiki/index.php/Anticamera
would be interesting to find the git repo
feels very intentional and i love intentional software

Crowdsec
(list of IP you blacklist or whitelist)
https://github.com/crowdsecurity/crowdsec

crowdsec passes malicious IPs (also from a crowd-sourced database) to a blocklist

* https://docs.crowdsec.net/u/bouncers/nginx/
* https://docs.crowdsec.net/u/bouncers/firewall/

for monitoring:
* https://prometheus.io/



crawlers that are visiting CC
- Lightpanda/1.0 https://lightpanda.io/, headless browser