+
+ 
+
### Gold Tier
diff --git a/VERSION b/VERSION
index a2b5571d..53cc1a6f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.24.0-pre1
+1.24.0
diff --git a/data/apps/qualys-ssl-labs.yml b/data/apps/qualys-ssl-labs.yml
index 2092051f..3a9ed386 100644
--- a/data/apps/qualys-ssl-labs.yml
+++ b/data/apps/qualys-ssl-labs.yml
@@ -3,5 +3,6 @@
- name: qualys-ssl-labs
action: ALLOW
remote_addresses:
- - 64.41.200.0/24
- - 2600:C02:1020:4202::/64
\ No newline at end of file
+ - 69.67.183.0/24
+ - 2600:C02:1020:4202::/64
+ - 2602:fdaa:c6:2::/64
\ No newline at end of file
diff --git a/data/botPolicies.yaml b/data/botPolicies.yaml
index 1288f635..ad7fb1aa 100644
--- a/data/botPolicies.yaml
+++ b/data/botPolicies.yaml
@@ -95,50 +95,6 @@ bots:
# weight:
# adjust: -10
- # Assert behaviour that only genuine browsers display. This ensures that Chrome
- # or Firefox versions
- - name: realistic-browser-catchall
- expression:
- all:
- - '"User-Agent" in headers'
- - '( userAgent.contains("Firefox") ) || ( userAgent.contains("Chrome") ) || ( userAgent.contains("Safari") )'
- - '"Accept" in headers'
- - '"Sec-Fetch-Dest" in headers'
- - '"Sec-Fetch-Mode" in headers'
- - '"Sec-Fetch-Site" in headers'
- - '"Accept-Encoding" in headers'
- - '( headers["Accept-Encoding"].contains("zstd") || headers["Accept-Encoding"].contains("br") )'
- - '"Accept-Language" in headers'
- action: WEIGH
- weight:
- adjust: -10
-
- # The Upgrade-Insecure-Requests header is typically sent by browsers, but not always
- - name: upgrade-insecure-requests
- expression: '"Upgrade-Insecure-Requests" in headers'
- action: WEIGH
- weight:
- adjust: -2
-
- # Chrome should behave like Chrome
- - name: chrome-is-proper
- expression:
- all:
- - userAgent.contains("Chrome")
- - '"Sec-Ch-Ua" in headers'
- - 'headers["Sec-Ch-Ua"].contains("Chromium")'
- - '"Sec-Ch-Ua-Mobile" in headers'
- - '"Sec-Ch-Ua-Platform" in headers'
- action: WEIGH
- weight:
- adjust: -5
-
- - name: should-have-accept
- expression: '!("Accept" in headers)'
- action: WEIGH
- weight:
- adjust: 5
-
# Generic catchall rule
- name: generic-browser
user_agent_regex: >-
diff --git a/data/meta/default-config.yaml b/data/meta/default-config.yaml
index 9658e389..73e8a0d2 100644
--- a/data/meta/default-config.yaml
+++ b/data/meta/default-config.yaml
@@ -79,50 +79,6 @@
# weight:
# adjust: -10
-# Assert behaviour that only genuine browsers display. This ensures that Chrome
-# or Firefox versions
-- name: realistic-browser-catchall
- expression:
- all:
- - '"User-Agent" in headers'
- - '( userAgent.contains("Firefox") ) || ( userAgent.contains("Chrome") ) || ( userAgent.contains("Safari") )'
- - '"Accept" in headers'
- - '"Sec-Fetch-Dest" in headers'
- - '"Sec-Fetch-Mode" in headers'
- - '"Sec-Fetch-Site" in headers'
- - '"Accept-Encoding" in headers'
- - '( headers["Accept-Encoding"].contains("zstd") || headers["Accept-Encoding"].contains("br") )'
- - '"Accept-Language" in headers'
- action: WEIGH
- weight:
- adjust: -10
-
-# The Upgrade-Insecure-Requests header is typically sent by browsers, but not always
-- name: upgrade-insecure-requests
- expression: '"Upgrade-Insecure-Requests" in headers'
- action: WEIGH
- weight:
- adjust: -2
-
-# Chrome should behave like Chrome
-- name: chrome-is-proper
- expression:
- all:
- - userAgent.contains("Chrome")
- - '"Sec-Ch-Ua" in headers'
- - 'headers["Sec-Ch-Ua"].contains("Chromium")'
- - '"Sec-Ch-Ua-Mobile" in headers'
- - '"Sec-Ch-Ua-Platform" in headers'
- action: WEIGH
- weight:
- adjust: -5
-
-- name: should-have-accept
- expression: '!("Accept" in headers)'
- action: WEIGH
- weight:
- adjust: 5
-
# Generic catchall rule
- name: generic-browser
user_agent_regex: >-
diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md
index 1b6f50a1..95b30098 100644
--- a/docs/docs/CHANGELOG.md
+++ b/docs/docs/CHANGELOG.md
@@ -12,8 +12,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
- Bump minimum Go version to 1.25.5.
+- Add iplist2rule tool that lets admins turn an IP address blocklist into an Anubis ruleset.
+- Add Polish locale ([#1292](https://github.com/TecharoHQ/anubis/pull/1309))
-## v1.24.0 [pre1]: Y'shtola Rhul
+
+
+## v1.24.0: Y'shtola Rhul
Anubis is back and better than ever! Lots of minor fixes with some big ones interspersed.
@@ -27,6 +31,14 @@ Anubis is back and better than ever! Lots of minor fixes with some big ones inte
- Add support to simple Valkey/Redis cluster mode
- Open Graph passthrough now reuses the configured target Host/SNI/TLS settings, so metadata fetches succeed when the upstream certificate differs from the public domain. ([1283](https://github.com/TecharoHQ/anubis/pull/1283))
- Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.
+- Refine the check that ensures the presence of the Accept header to avoid breaking docker clients.
+- Removed rules intended to reward actual browsers due to abuse in the wild.
+
+### Dataset poisoning
+
+Anubis has the ability to engage in [dataset poisoning attacks](https://www.anthropic.com/research/small-samples-poison) using the [dataset poisoning subsystem](./admin/honeypot/overview.mdx). This allows every Anubis instance to be a honeypot to attract and flag abusive scrapers so that no administrator action is required to ban them.
+
+There is much more information about this feature in [the dataset poisoning subsystem documentation](./admin/honeypot/overview.mdx). Administrators that are interested in learning how this feature works should consult that documentation.
### Deprecate `report_as` in challenge configuration
diff --git a/docs/docs/admin/environments/nginx.mdx b/docs/docs/admin/environments/nginx.mdx
index 74a07d22..df31bd50 100644
--- a/docs/docs/admin/environments/nginx.mdx
+++ b/docs/docs/admin/environments/nginx.mdx
@@ -1,5 +1,7 @@
# Nginx
+import CodeBlock from "@theme/CodeBlock";
+
Anubis is intended to be a filter proxy. The way to integrate this with nginx is to break your configuration up into two parts: TLS termination and then HTTP routing. Consider this diagram:
```mermaid
@@ -36,110 +38,26 @@ These examples assume that you are using a setup where your nginx configuration
Assuming that we are protecting `anubistest.techaro.lol`, here's what the server configuration file would look like:
-```nginx
-# /etc/nginx/conf.d/server-anubistest-techaro-lol.conf
+import anubisTest from "!!raw-loader!./nginx/server-anubistest-techaro-lol.conf";
-# HTTP - Redirect all HTTP traffic to HTTPS
-server {
- listen 80;
- listen [::]:80;
-
- server_name anubistest.techaro.lol;
-
- location / {
- return 301 https://$host$request_uri;
- }
-}
-
-# TLS termination server, this will listen over TLS (https) and then
-# proxy all traffic to the target via Anubis.
-server {
- # Listen on TCP port 443 with TLS (https) and HTTP/2
- listen 443 ssl;
- listen [::]:443 ssl;
- http2 on;
-
- location / {
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Http-Version $server_protocol;
- proxy_pass http://anubis;
- }
-
- server_name anubistest.techaro.lol;
-
- ssl_certificate /path/to/your/certs/anubistest.techaro.lol.crt;
- ssl_certificate_key /path/to/your/certs/anubistest.techaro.lol.key;
-}
-
-# Backend server, this is where your webapp should actually live.
-server {
- listen unix:/run/nginx/nginx.sock;
-
- server_name anubistest.techaro.lol;
- root "/srv/http/anubistest.techaro.lol";
- index index.html;
-
- # Get the visiting IP from the TLS termination server
- set_real_ip_from unix:;
- real_ip_header X-Real-IP;
-
- # Your normal configuration can go here
- # location .php { fastcgi...} etc.
-}
-```
+
+
### Gold Tier
diff --git a/docs/docs/user/known-instances.md b/docs/docs/user/known-instances.md
index ddbc52ba..9b24282c 100644
--- a/docs/docs/user/known-instances.md
+++ b/docs/docs/user/known-instances.md
@@ -4,67 +4,83 @@ title: List of known websites using Anubis
This page contains a non-exhaustive list with all websites using Anubis.
-- { paragraph }
+ } +") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + var templ_7745c5c3_Var5 string + templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(paragraph) + if templ_7745c5c3_Err != nil { + return templ.Error{Err: templ_7745c5c3_Err, FileName: `page.templ`, Line: 29, Col: 16} + } + _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5)) + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "
") + if templ_7745c5c3_Err != nil { + return templ_7745c5c3_Err + } + } + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "