fix(default-config): must-accept-rule on browsers only

TIL docker clients don't include the Accept header all the time. I would
have thought they did that. Oops.

Closes: #1346
Signed-off-by: Xe Iaso <me@xeiaso.net>

data/botPolicies.yaml

@@ -134,7 +134,10 @@ bots:
       adjust: -5
 
   - name: should-have-accept
-    expression: '!("Accept" in headers)'
+    expression:
+      all:
+        - userAgent.contains("Mozilla")
+        - '!("Accept" in headers)'
     action: WEIGH
     weight:
       adjust: 5

data/meta/default-config.yaml

@@ -118,7 +118,10 @@
     adjust: -5
 
 - name: should-have-accept
-  expression: '!("Accept" in headers)'
+  expression:
+    all:
+      - userAgent.contains("Mozilla")
+      - '!("Accept" in headers)'
   action: WEIGH
   weight:
     adjust: 5

docs/docs/CHANGELOG.md

@@ -27,6 +27,7 @@ Anubis is back and better than ever! Lots of minor fixes with some big ones inte
 - Add support to simple Valkey/Redis cluster mode
 - Open Graph passthrough now reuses the configured target Host/SNI/TLS settings, so metadata fetches succeed when the upstream certificate differs from the public domain. ([1283](https://github.com/TecharoHQ/anubis/pull/1283))
 - Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.
+- Refine the check that ensures the presence of the Accept header to avoid breaking docker clients.
 
 ### Dataset poisoning
 

internal/headers.go

@@ -100,6 +100,9 @@ func XForwardedForToXRealIP(next http.Handler) http.Handler {
 			ip := xff.Parse(xffHeader)
 			slog.Debug("setting X-Real-Ip from X-Forwarded-For", "to", ip, "x-forwarded-for", xffHeader)
 			r.Header.Set("X-Real-Ip", ip)
+			if addr, err := netip.ParseAddr(ip); err == nil {
+				r = r.WithContext(context.WithValue(r.Context(), realIPKey{}, addr))
+			}
 		}
 
 		next.ServeHTTP(w, r)

internal/honeypot/naive/naive.go

@@ -7,6 +7,7 @@ import (
 	"log/slog"
 	"math/rand/v2"
 	"net/http"
+	"net/netip"
 	"time"
 
 	"github.com/TecharoHQ/anubis/internal"
@@ -152,9 +153,7 @@ func (i *Impl) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	realIP, _ := internal.RealIP(r)
 	if !realIP.IsValid() {
-		lg.Error("the real IP is somehow invalid, bad middleware stack?")
+		realIP = netip.MustParseAddr(r.Header.Get("X-Real-Ip"))
-		http.Error(w, "The cake is a lie", http.StatusTeapot)
-		return
 	}
 
 	network, ok := internal.ClampIP(realIP)