Best way to implement Anubis?

1

Hi, I’d like to protect my website deployed on fly.io with Anubis (GitHub - TecharoHQ/anubis: Weighs the soul of incoming HTTP requests using proof-of-work to stop AI crawlers). Wanted to start a discussion here on the best way to do this.

the implementation is here: Making sure you're not a bot!

i have a pretty simple app, it’s a next.js app

fly.toml:

[build]
  dockerfile = 'Dockerfile'

[deploy]
  strategy = "immediate"
  wait_timeout = "5m"

[http_service]
  internal_port = 3000
  force_https = true
  auto_stop_machines = 'off'
  auto_start_machines = true
  min_machines_running = 1
  processes = ['app']

[vm]
  memory = '256mb'
  cpu_kind = 'shared'
  cpus = 1

Dockerfile

# syntax = docker/dockerfile:1

ARG NODE_VERSION=22
FROM node:${NODE_VERSION}-slim AS base
LABEL fly_launch_runtime="Next.js"

# Next.js app lives here
WORKDIR /app

# Throw-away build stage to reduce size of final image
FROM base AS build

# Install packages needed to build node modules
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y build-essential node-gyp

# Install node modules
COPY .npmrc package-lock.json package.json ./
RUN npm ci --include=dev

# Copy application code
COPY . .

# Build application
## fly.io
RUN --mount=type=secret,id=ALL_SECRETS \
    eval "$(base64 -d /run/secrets/ALL_SECRETS)" && \
    npx next build --experimental-build-mode compile

# Remove development dependencies
RUN npm prune --omit=dev

# Final stage for app image
FROM base

# Copy built application
COPY --from=build /app /app

# Start the server by default, this can be overwritten at runtime
CMD [ "npm", "run", "start" ]
2

If connections have souls, I regard that as an excessive faith in our AI overlords. :zany_face:

3

I’ve not heard of this project, nor used it, but based on your Installation link, I’d add this as another app, and then have it forward requests to your real app through the private network. You can create a new TOML file with an env var TARGET pointing to your yourappname.internal IPv6 address. You’d need to ensure that your app is listening on IPv6 rather than v4.

1 Like
4

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.