docs: update CHANGELOG

Signed-off-by: Xe Iaso <me@xeiaso.net>

data/botPolicies.yaml

@@ -212,14 +212,10 @@ thresholds:
         - weight < 20
     action: CHALLENGE
     challenge:
-      # https://anubis.techaro.lol/docs/admin/configuration/challenges/preact
-      #
-      # This challenge proves the client can run a webapp written with Preact.
-      # The preact webapp simply loads, calculates the SHA-256 checksum of the
-      # challenge data, and forwards that to the client.
-      algorithm: preact
-      difficulty: 1
-      report_as: 1
+      # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
+      algorithm: fast
+      difficulty: 2 # two leading zeros, very fast for most clients
+      report_as: 2
   - name: mild-proof-of-work
     expression:
       all:
@@ -229,8 +225,8 @@ thresholds:
     challenge:
       # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
       algorithm: fast
-      difficulty: 2 # two leading zeros, very fast for most clients
-      report_as: 2
+      difficulty: 4
+      report_as: 4
   # For clients that are browser like and have gained many points from custom rules
   - name: extreme-suspicion
     expression: weight >= 30
@@ -238,5 +234,5 @@ thresholds:
     challenge:
       # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
       algorithm: fast
-      difficulty: 4
-      report_as: 4
+      difficulty: 6
+      report_as: 6

docs/docs/CHANGELOG.md

@@ -31,6 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Update OpenRC service to truncate the runtime directory before starting Anubis.
 - Allow multiple consecutive slashes in a row in application paths ([#754](https://github.com/TecharoHQ/anubis/issues/754)).
 - Add option to set `targetSNI` to special keyword 'auto' to indicate that it should be automatically set to the request Host name ([424](https://github.com/TecharoHQ/anubis/issues/424)).
+- The Preact challenge has been removed from the default configuration. It will be deprecated in the future.
 
 ### Bug Fixes
 

lib/http.go

@@ -17,6 +17,7 @@ import (
 	"github.com/TecharoHQ/anubis/lib/localization"
 	"github.com/TecharoHQ/anubis/lib/policy"
 	"github.com/TecharoHQ/anubis/web"
+	"github.com/TecharoHQ/anubis/xess"
 	"github.com/a-h/templ"
 	"github.com/golang-jwt/jwt/v5"
 	"golang.org/x/net/publicsuffix"
@@ -282,6 +283,9 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if strings.HasPrefix(r.URL.Path, anubis.BasePrefix+anubis.StaticPath) {
 		s.mux.ServeHTTP(w, r)
 		return
+	} else if strings.HasPrefix(r.URL.Path, anubis.BasePrefix+xess.BasePrefix) {
+		s.mux.ServeHTTP(w, r)
+		return
 	}
 
 	s.maybeReverseProxyOrPage(w, r)

xess/xess.go

@@ -16,7 +16,8 @@ var (
 	//go:embed *.css static
 	Static embed.FS
 
-	URL = "/.within.website/x/xess/xess.css"
+	BasePrefix = "/.within.website/x/xess/"
+	URL        = "/.within.website/x/xess/xess.css"
 )
 
 func init() {