docs(admin/policy): document ReadWritePaths for logging to files

The default Anubis systemd configuration is very restrictive in
order to prevent any possible compromise of Anubis to be useful
by threat actors. As such, it assumes all logs will be pushed to
the system journal. Some administrators do not want Anubis' logs
to be pushed to the system journal and want Anubis to log to a
file instead.

This change documents how to set up ReadWritePaths in the Anubis
systemd configuration such that Anubis can lot to a file as
administrators expect.

Closes: #1468
Signed-off-by: Xe Iaso <me@xeiaso.net>

.github/workflows/docker-pr.yml

@@ -31,7 +31,7 @@ jobs:
           node-version: "24.11.0"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
 

.github/workflows/docker.yml

@@ -41,7 +41,7 @@ jobs:
           node-version: "24.11.0"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
 

.github/workflows/go-mod-tidy-check.yml

@@ -19,7 +19,7 @@ jobs:
 
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - name: Check go.mod and go.sum in main directory
         run: |

.github/workflows/go.yml

@@ -29,7 +29,7 @@ jobs:
           node-version: "24.11.0"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - name: Cache playwright binaries
         uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
@@ -61,4 +61,4 @@ jobs:
 
       - name: Govulncheck
         run: |
-          go tool govulncheck ./... ||:
+          go tool govulncheck ./...

.github/workflows/package-builds-stable.yml

@@ -30,7 +30,7 @@ jobs:
           node-version: "24.11.0"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - name: install node deps
         run: |

.github/workflows/package-builds-unstable.yml

@@ -31,7 +31,7 @@ jobs:
           node-version: "24.11.0"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - name: install node deps
         run: |

.github/workflows/smoke-tests.yml

@@ -39,7 +39,7 @@ jobs:
           node-version: "24.11.0"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
 

.github/workflows/ssh-ci.yml

@@ -37,7 +37,7 @@ jobs:
 
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "stable"
+          go-version: "1.25.4"
 
       - name: Run CI
         run: go run ./utils/cmd/backoff-retry bash test/ssh-ci/rigging.sh ${{ matrix.host }}

Makefile

@@ -24,6 +24,7 @@ build: assets
 lint: assets
 	$(GO) vet ./...
 	$(GO) tool staticcheck ./...
+	$(GO) tool govulncheck ./...
 
 prebaked-build:
 	$(GO) build -o ./var/anubis -ldflags "-X 'github.com/TecharoHQ/anubis.Version=$(VERSION)'" ./cmd/anubis

docs/docs/CHANGELOG.md

@@ -11,8 +11,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-- Fixed mixed tab/space indentation in Caddy documentation code block
-
 <!-- This changes the project to: -->
 
 ## v1.25.0: Necron

docs/docs/admin/environments/caddy.mdx

@@ -62,9 +62,9 @@ yourdomain.example.com {
   tls your@email.address
 
   reverse_proxy http://anubis:3000 {
-    header_up X-Real-Ip {remote_host}
+		header_up X-Real-Ip {remote_host}
-    header_up X-Http-Version {http.request.proto}
+		header_up X-Http-Version {http.request.proto}
-  }
+	}
 }
 ```