This task documents the wondrous effort to get Anibus on XTools to help shield us from the armies of bots.
I successfully got Anubis runnging on a third-party wiki running on Ubuntu / Apache. Cloud VPS will present quite a different challenge.
==== Environment
* Project [[ https://openstack-browser.toolforge.org/project/xtools | xtools ]], VPS instance [[ https://openstack-browser.toolforge.org/server/xtools-dev06.xtools.eqiad1.wikimedia.cloud | xtools-dev06.xtools.eqiad1.wikimedia.cloud ]]
* Debian Bullseye
* [[ https://anubis.techaro.lol/docs/admin/environments/apache/ | Apache ]] for routing requests to the application.
==== Progress
**Changes made in Horizon**
* Change `xtools-dev.wmcloud.org` web proxy to point to port 9000 (not sure if should use HTTPS or not)
* Add a new security group to the xtools-dev06 instance that has an Ingress port 9000, and another with port 443 (I don't know what I'm doing so I'm attempting both)
** Both rules exist for IPv4 (allowlisting 172.16.0.0/17) and IPv6 (allowlisting 2a02:ec80:a000::/56)
**Apache configuration**
First enable mod_headers with `sudo a2enmod headers`
Then adjust the conf file to add Anubis as a reverse proxy:
```name=xtools.conf, lang=apache
# HTTPS listener that forwards to Anubis
<IfModule mod_proxy.c>
<VirtualHost *:443>
ServerAdmin tools-xtools@toolforge.org
ServerName xtools-dev.wmcloud.org
DocumentRoot /var/www/public
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# These headers need to be set or else Anubis will
# throw an "admin misconfiguration" error.
#RequestHeader set "X-Real-Ip" expr=%{X-Forwarded-For}
#RequestHeader set X-Forwarded-Proto "https"
#RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"
#ProxyPreserveHost On
#ProxyRequests Off
#ProxyVia Off
# Replace 9000 with the port Anubis listens on
ProxyPass / http://[::1]:9000/
ProxyPassReverse / http://[::1]:9000/
</VirtualHost>
</IfModule>
# Tell apache to listen on port 3001 so that it can serve the actual website
Listen [::1]:3001
<VirtualHost *:3001>
DocumentRoot /var/www/public
ServerName xtools-dev.wmcloud.org
# Same config we normally use
# …
</VirtualHost>
```
**Installing Anubis**
I went with the [[ https://anubis.techaro.lol/docs/admin/native-install | native approach ]] and am using [[ https://wiki.debian.org/Alien | Alien ]] to build a Debian package from an RPM package:
```
$ sudo apt install alien
…
Setting up alien (8.95.4) ...
$ wget https://github.com/TecharoHQ/anubis/releases/download/v1.21.1/anubis-1.21.1-1.x86_64.rpm
…
2025-07-23 05:30:00 (125 MB/s) - 'anubis-1.21.1-1.x86_64.rpm' saved [12737057/12737057]
sudo
$ sudo alien -d anubis-1.21.1-1.x86_64.rpm
…
anubis_1.21.1-2_amd64.deb generated
$ sudo apt install ./anubis_1.21.1-2_amd64.deb
…
Setting up anubis (1.21.1-2) ...
```
**Running Anubis**
I think we'll eventually want a systemd service for this. For now, I've been testing with:
```
$ anubis -bind localhost:9000 -target localhost:3001 -cookie-domain xtools-dev.wmcloud.org
```
==== Conclusion
TBD