anubis: bot-challenge proxy in front of the guarded vhosts (two-tier chain)

Bots and AI scrapers hit the SSO-fronted vhosts and eat Authentik auth
work for 403s. Anubis verifies clients first: DENY for known AI scraper
UAs, JS challenge for everyone else; verified traffic resumes the normal
Authentik forward_auth chain on Caddy's internal listener (:8016).

Chain: client -> Caddy (TLS) -> Anubis :8923 (verify) -> Caddy :8016
(auth + routing resumes; Host survives both hops) -> app. Reverse-proxy
through Anubis, not forward_auth: at the pinned tag a CHALLENGE answers
HTTP 200 + HTML, and forward_auth treats 200 as "authenticated" — the
page would pass through unchallenged. Exempt by construction (never
routed through Anubis): plex (plain HTTP legacy), auth.* (IdP login
must be reachable ungated), gitea (git smart-HTTP clients cannot solve
JS challenges), and every app with its own login.

Pinned ghcr.io/TecharoHQ/anubis:v1.13.0 — the tag was source-verified
before pinning: at this tag the policy parser is JSON-only with a
minimal bots[] schema (no imports, no CEL expressions), flags are the
config surface via flagenv (TARGET/POLICY_FNAME map to --target/
--policy-fname), and the image's exec-form HEALTHCHECK is inherited by
the quadlet unit (dodges the v1 generator's HealthCmd space-split quirk).

Rollback nuance: stopping anubis 502s everything behind the chain (the
public listeners proxy through it); a true rollback is reverting the
Caddyfile and redeploying, not just systemctl --user stop anubis.

scripts/deploy-plan.py

@@ -246,7 +246,7 @@ def services_for_path(path: str, target: str) -> set[str]:
         if len(parts) >= 2 and parts[1] == "Containerfile.comfyui":
             _add(services, "comfyui")
             return services
-        if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes"}:
+        if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis"}:
             _add(services, parts[1])
             return services
         if len(parts) >= 2 and parts[1] == "searxng":

scripts/deploy-remote.sh

@@ -550,6 +550,22 @@ deploy_authentik() {
     systemctl --user start authentik-worker.service
 }
 
+deploy_anubis() {
+    # Anubis is the bot-challenge proxy in front of the guarded vhosts.
+    # The image lives on ghcr.io; pull once, then the unit runs it from
+    # local storage (Pull=never keeps boots off the registry).
+    if ! podman image inspect ghcr.io/TecharoHQ/anubis:v1.13.0 >/dev/null 2>&1; then
+        podman pull ghcr.io/TecharoHQ/anubis:v1.13.0
+    fi
+    cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    # No enable: generated units cannot be enabled on this host (v1 quadlet
+    # generator); boot persistence comes from [Install] in the unit file.
+    # restart, not start: policy.json is parsed at process start only (no
+    # reload signal exists), so every redeploy must cycle the process.
+    systemctl --user restart anubis.service
+    wait_container_healthy anubis 60 || return 1
+}
 
 deploy_llm_large() {
     relink_unit frank-default-large
@@ -604,6 +620,7 @@ deploy_service() {
         authentik-postgres|authentik-server|authentik-worker)
             deploy_authentik
             ;;
+        anubis) deploy_anubis ;;
         frank-default-large) deploy_llm_large ;;
         frank-default-small) deploy_llm_small ;;
         frank-default-npu) deploy_llm_npu ;;

scripts/deploy.sh

@@ -118,7 +118,7 @@ valid_service() {
         dankclaw:comfyui|dankclaw:hermes|dankclaw:hermes-dashboard|\
         dankclaw:hermes-webui|dankclaw:prometheus|dankclaw:grafana|dankclaw:loki|dankclaw:alloy|\
         dankclaw:node-exporter|dankclaw:authentik-postgres|dankclaw:authentik-server|\
-        dankclaw:authentik-worker|dankclaw:caddy|dankclaw:homepage|\
+        dankclaw:authentik-worker|dankclaw:anubis|dankclaw:caddy|dankclaw:homepage|\
         dankclaw:frank-default-large|dankclaw:frank-default-npu|\
         dankserver:mariadb|dankserver:redis|dankserver:romm|dankserver:copyparty|\
         dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\

scripts/test-changed.sh

@@ -120,6 +120,17 @@ for path in "${CHANGED[@]}"; do
             add_test tests/searxng_quadlet.bats
             add_test tests/deployment_scoping.bats
             ;;
+        # Anubis is a quadlet + Caddyfile pair: the chain (public listener ->
+        # anubis:8923 -> internal :8016 listener) spans both, so any change
+        # under the service dir must re-run the caddyfile seam too. This case
+        # precedes the dankclaw/*/quadlet/*.container fallback below, which
+        # would otherwise swallow it into unrelated seams.
+        dankclaw/anubis/*)
+            add_test tests/anubis.bats
+            add_test tests/caddyfile.bats
+            add_test tests/homepage_caddy.bats
+            add_test tests/deployment_scoping.bats
+            ;;
         # Quadlets live under dankclaw/<svc>/quadlet/ (reorganized out of the
         # top-level dankclaw/*.container globs above). Map the whole subtree so
         # changes to the pihole, open-webui, searxng, and gitea quadlets hit