This task documents the effort to get Anibus on XTools to help shield us from the armies of AI bots and web crawlers.
I successfully got Anubis runnging on a third-party wiki running on Ubuntu / Apache. Cloud VPS presents a different challenge, since TLS termination happens by the Cloud Services web proxy.
==== Environment
* Project [[ https://openstack-browser.toolforge.org/project/xtools | xtools ]], VPS instance [[ https://openstack-browser.toolforge.org/server/xtools-dev06.xtools.eqiad1.wikimedia.cloud | xtools-dev06.xtools.eqiad1.wikimedia.cloud ]]
* Debian Bullseye
* [[ https://anubis.techaro.lol/docs/admin/environments/apache/ | Apache ]] for routing requests to the application.
==== Progress
**Changes made in Horizon**
None! We need a web proxy pointing to port 80 and an ingress security group allowing traffic, which we already have on this instance.
**Apache configuration**
# Enable mod_headers with `sudo a2enmod headers`
# Enable mod_proxy_http with `sudo a2enmod proxy_http`
# Adjust the conf file to add Anubis as a reverse proxy:
```name=xtools.conf, lang=apache
# Forward traffic to Anubis
<VirtualHost *:80>
ServerAdmin tools-xtools@toolforge.org
ServerName xtools-dev.wmcloud.org
DocumentRoot /var/www/public
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
# These headers need to be set or else Anubis will
# throw an "admin misconfiguration" error.
SetEnvIf X-Forwarded-For "(.*)" saved_x_forwarded_for=$1
RequestHeader set "X-Real-Ip" "%{saved_x_forwarded_for}e"
ProxyPreserveHost On
ProxyRequests Off
ProxyVia Off
# Replace 9000 with the port Anubis listens on
ProxyPass / http://[::1]:9000/
ProxyPassReverse / http://[::1]:9000/
</VirtualHost>
# Tell apache to listen on port 3001 so that it can serve the actual website
Listen 0.0.0.0:3001
<VirtualHost *:3001>
DocumentRoot /var/www/public
ServerName xtools-dev.wmcloud.org
# Same config we normally use
# …
</VirtualHost>
```
4. Restart Apache with `sudo service apache2 restart`
**Installing Anubis**
I went with the [[ https://anubis.techaro.lol/docs/admin/native-install | native approach ]] and am using [[ https://wiki.debian.org/Alien | Alien ]] to build a Debian package from an RPM package:
```
$ sudo apt install alien
…
Setting up alien (8.95.4) ...
$ wget https://github.com/TecharoHQ/anubis/releases/download/v1.21.1/anubis-1.21.1-1.x86_64.rpm
…
2025-07-23 05:30:00 (125 MB/s) - 'anubis-1.21.1-1.x86_64.rpm' saved [12737057/12737057]
sudo
$ sudo alien -d anubis-1.21.1-1.x86_64.rpm
…
anubis_1.21.1-2_amd64.deb generated
$ sudo apt install ./anubis_1.21.1-2_amd64.deb
…
Setting up anubis (1.21.1-2) ...
```
**Running Anubis**
For initial testing, we can use:
```
$ anubis -bind=0.0.0.0:9000 -target=http://0.0.0.0:3001 -cookie-domain xtools-dev.wmcloud.org
```
For production, we'll want a systemd service:
```name=/etc/systemd/system/anubis.service, lang=ini
[Unit]
Description=Anubis Service
[Service]
User=root
Group=root
ExecStart=/usr/bin/anubis -bind 0.0.0.0:9000 -target=http://0.0.0.0:3001 -cookie-domain=xtools-dev.wmcloud.org
Restart=always
[Install]
WantedBy=multi-user.target
```
Enable and start the service:
# `sudo systemctl enable anubis`
# `sudo systemctl start anubis`
==== Conclusion
TBD