nomad

feat(git): anubis sidecar rss
created pr with 8.1 on 2026-06-25 · by 84351313
cmds
checkout latest patchset: 
ssh pr.in0rdr.ch print 8 | git am -3
checkout any patchset in a patch request: 
ssh pr.in0rdr.ch print 8.[rev] | git am -3
add changes to patch request: 
git format-patch main --stdout | ssh pr.in0rdr.ch pr add 8

Patchset 8.1 on 2026-06-25 · commit 47ddb97

→ feat(git): anubis sidecar
Andreas Gruhler 2026-03-27
 feat: RemoteIPProxyProtocol
Andreas Gruhler 2026-03-30
 fix: add podman net to trusted proxies
Andreas Gruhler 2026-03-31
 fix: ServerName in vHost
Andreas Gruhler 2026-04-01
 feat: change RemoteIPInternalProxy
Andreas Gruhler 2026-04-01
 feat: change RemoteIPInternalProxy
Andreas Gruhler 2026-04-01
feat(git): anubis sidecar
Andreas Gruhler 2026-03-27
Semantic diff summary
0 added, 0 modified, 0 signature changed, 0 removed across 0 analyzed files (2 files skipped: unsupported file type)
+43 -1 hcl/default/git/git.nomad #
......@@ -1,6 +1,10 @@
11 job "git" {
22 datacenters = ["dc1"]
33
4+ vault {
5+ role = "anubis"
6+ }
7+
48 priority = 80
59
610 constraint {
......@@ -32,9 +36,12 @@ job "git" {
3236 }
3337
3438 network {
39+ port "anubis" {
40+ static = 44328
41+ to = 8923
42+ }
3543 port "stagit" {
3644 to = 443
37- static = 44328
3845 }
3946 port "smarthttp" {
4047 to = 443
......@@ -117,5 +124,40 @@ job "git" {
117124 cpu = 100
118125 }
119126 }
127+
128+ task "anubis" {
129+ driver = "podman"
130+
131+ config {
132+ image = "docker://ghcr.io/techarohq/anubis:v1.15.0"
133+ volumes = [
134+ # mount the templated config from the task directory to the container
135+ "local/challenge-any.yml:/etc/anubis/challenge-any.yml",
136+ ]
137+ }
138+
139+ template {
140+ destination = "${NOMAD_TASK_DIR}/challenge-any.yml"
141+ data = file("./templates/challenge-any.yml.tmpl")
142+ }
143+
144+ template {
145+ destination = "${NOMAD_SECRETS_DIR}/default.env"
146+ env = true
147+ data = <<EOT
148+DIFFICULTY=4
149+TARGET=http://{{ env "NOMAD_ADDR_stagit" }}
150+HS512_SECRET="{{with secret "kv/anubis"}}{{index .Data.data.HS512_SECRET}}{{end}}"
151+COOKIE_DYNAMIC_DOMAIN=True
152+POLICY_FNAME=/etc/anubis/challenge-any.yml
153+EOT
154+ }
155+
156+ resources {
157+ memory = 128
158+ memory_max = 256
159+ cpu = 200
160+ }
161+ }
120162 }
121163 }
+12 -0 hcl/default/git/templates/challenge-any.yml.tmpl #
......@@ -0,0 +1,12 @@
1+bots:
2+ - name: any
3+ action: CHALLENGE
4+ user_agent_regex: .*
5+
6+status_codes:
7+ CHALLENGE: 403
8+ DENY: 403
9+
10+thresholds: []
11+
12+dnsbl: false
Back to top