anubis-mirror/lib/policy/config/testdata/good/git_client.json at eae3a7b5e47f60366afeea63d860e9b7e02b3d4a - anubis-mirror - Gitea - 2ari.ca

arian/anubis-mirror

mirror of https://github.com/TecharoHQ/anubis.git synced 2026-04-09 10:08:45 +00:00

Files

Xe Iaso eae3a7b5e4 feat(lib/policy): add support for CEL checkers

This adds the ability for administrators to use Common Expression
Language[0] (CEL) for more advanced check logic than Anubis previously
offered.

These can be as simple as:

```yaml
- name: allow-api-routes
  action: ALLOW
  expression:
    and:
    - '!(method == "HEAD" || method == "GET")'
    - path.startsWith("/api/")
```

or get as complicated as:

```yaml
- name: allow-git-clients
  action: ALLOW
  expression:
    and:
    - userAgent.startsWith("git/") || userAgent.contains("libgit") || userAgent.startsWith("go-git") || userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-")
    - >
      "Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"
```

Internally these are compiled and evaluated with cel-go[1]. This also
leaves room for extensibility should that be desired in the future. This
will intersect with #338 and eventually intersect with TLS fingerprints
as in #337.

[0]: https://cel.dev/
[1]: https://github.com/google/cel-go

Signed-off-by: Xe Iaso <me@xeiaso.net>

2025-04-27 22:25:49 -04:00

14 lines

312 B

JSON

Raw Blame History

 {
   "bots": [
     {
       "name": "allow-git-clients",
       "action": "ALLOW",
       "expression": {
         "and": [
           "userAgent.startsWith(\"git/\") || userAgent.contains(\"libgit\")",
           "\"Git-Protocol\" in headers && headers[\"Git-Protocol\"] == \"version=2\""
         ]
       }
     }
   ]
 }