anubis: pin v1.27.0, fleet-wide cookie domain, persistent signing key

- Image bump v1.13.0 -> v1.27.0 (deploy_anubis pull+tag updated; JSON
  policy schema unchanged at this release).
- COOKIE_DOMAIN=franksdank.cloud: the challenge cookie now covers all
  guarded *.franksdank.cloud vhosts — solve the PoW once, not per-host.
- ED25519_PRIVATE_KEY_HEX via host env file (0600) with gitea-style
  [Service] EnvironmentFile expansion: restarts no longer invalidate
  everyone's solved challenges.
- Scratch-verified v1.27.0 before pinning: policy loads, challenge/DENY/
  ALLOW all behave, X-Real-Ip now mandatory (chain always sets it).

dankclaw/anubis/quadlet/anubis.container

@@ -15,16 +15,21 @@
 # truth), but the unit runs it under a localhost/-aliased tag: on this host's
 # podman 5.7 quadlet path, registry-prefixed refs fail to resolve from local
 # storage at container create time ("image not known") even when present; the
-# localhost alias resolves (verified live 2026-08-28). v1.13.0 was
-# source-verified before pinning (policy parser is JSON-only at this tag,
-# flags are the config surface via flagenv: TARGET sets --target,
-# POLICY_FNAME sets --policy-fname). Upgrading = pull new tag, re-tag the
-# localhost alias, restart the unit; re-verify the policy schema first.
-# (the active Image= key lives in the [Container] section below)
+# localhost alias resolves (verified live 2026-08-28). v1.27.0 pinned 2026-09-02: --help
+# verified on the image itself (cookie-domain, ed25519-private-key-hex,
+# cookie-expiration-time default 168h, difficulty default 4); JSON policy
+# schema unchanged; X-Real-Ip is now REQUIRED (missing header => HTTP 500) —
+# the Caddy chain always sets it (bats seam enforces the header_up line).
+# Upgrading = pull new tag, re-tag the localhost alias, restart the unit.
 #
-# No secrets here: Anubis holds no credentials (memory store; challenge
-# cookies are client-side JWTs). A restart invalidates issued challenges —
-# users just re-challenge once. See serverAppConfigs-docs/Infrastructure/Anubis.md.
+# No secrets in this repo. COOKIE_DOMAIN makes the challenge cookie valid for
+# all *.franksdank.cloud vhosts: solve the proof-of-work once (e.g. on www)
+# and every guarded vhost honors it until expiry (default 168h, aligned with
+# authentik's 7-day session) or re-login. ED25519_PRIVATE_KEY_HEX pins the
+# JWT signing key (host file /home/dank/Containers/anubis/env, mode 0600,
+# gitea-style ${VAR} expansion via the [Service] EnvironmentFile): without
+# it every restart invalidates everyone's solved challenges. See
+# serverAppConfigs-docs/Infrastructure/Anubis.md.
 
 [Unit]
 Description=Anubis bot-challenge proxy container
@@ -33,7 +38,7 @@ Wants=network-online.target
 
 [Container]
 ContainerName=anubis
-Image=localhost/techarohq/anubis:v1.13.0
+Image=localhost/techarohq/anubis:v1.27.0
 Pull=never
 Network=dankclaw_default
 # flagenv maps env names to flag names (TARGET -> --target, POLICY_FNAME ->
@@ -41,6 +46,9 @@ Network=dankclaw_default
 # container DNS name resolves on dankclaw_default.
 Environment=TARGET=http://caddy:8016
 Environment=POLICY_FNAME=/policy/policy.json
+Environment=COOKIE_DOMAIN=franksdank.cloud
+EnvironmentFile=/home/dank/Containers/anubis/env
+Environment=ED25519_PRIVATE_KEY_HEX=${ED25519_PRIVATE_KEY_HEX}
 Volume=/home/dank/serverAppConfigs/dankclaw/anubis/policy.json:/policy/policy.json:ro
 # The image ships no HEALTHCHECK (distroless ko-build: entrypoint is
 # /ko-app/anubis, no shell in the image), so the probe is declared here.
@@ -54,6 +62,7 @@ HealthTimeout=5s
 HealthRetries=3
 
 [Service]
+EnvironmentFile=/home/dank/Containers/anubis/env
 Restart=always
 RestartSec=5
 

scripts/deploy-remote.sh

@@ -764,13 +764,13 @@ deploy_anubis() {
     # Anubis is the bot-challenge proxy in front of the guarded vhosts.
     # The image lives on ghcr.io; pull once, then the unit runs it from
     # local storage (Pull=never keeps boots off the registry).
-    if ! podman image exists ghcr.io/techarohq/anubis:v1.13.0; then
-        podman pull ghcr.io/techarohq/anubis:v1.13.0
+    if ! podman image exists ghcr.io/techarohq/anubis:v1.27.0; then
+        podman pull ghcr.io/techarohq/anubis:v1.27.0
     fi
     # The unit runs the localhost/ alias (see the unit file comment): this
     # host's podman quadlet path cannot resolve registry-prefixed refs from
     # local storage at create time. Tag first, then (re)create via deploy.
-    podman tag ghcr.io/techarohq/anubis:v1.13.0 localhost/techarohq/anubis:v1.13.0 2>/dev/null || true
+    podman tag ghcr.io/techarohq/anubis:v1.27.0 localhost/techarohq/anubis:v1.27.0 2>/dev/null || true
     cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
     systemctl --user daemon-reload
     # No enable: generated units cannot be enabled on this host (v1 quadlet