1
---
2
# Instance: nossa
3
---
4
apiVersion: v1
5
data:
6
policy.yml: |
7
bots:
8
- import: (data)/bots/_deny-pathological.yaml
9
- import: (data)/bots/aggressive-brazilian-scrapers.yaml
10
- import: (data)/meta/ai-block-aggressive.yaml
11
- import: (data)/crawlers/_allow-good.yaml
12
- import: (data)/clients/x-firefox-ai.yaml
13
- import: (data)/common/keep-internet-working.yaml
14
- name: countries-with-aggressive-scrapers
15
action: WEIGH
16
geoip:
17
countries:
18
- BR
19
- CN
20
weight:
21
adjust: 10
22
- name: aggressive-asns-without-functional-abuse-contact
23
action: WEIGH
24
asns:
25
match:
26
- 13335
27
- 136907
28
- 45102
29
weight:
30
adjust: 10
31
- name: generic-browser
32
user_agent_regex: Mozilla|Opera
33
action: WEIGH
34
weight:
35
adjust: 10
36
dnsbl: false
37
openGraph:
38
enabled: true
39
considerHost: false
40
ttl: 24h
41
status_codes:
42
CHALLENGE: 200
43
DENY: 200
44
store:
45
backend: memory
46
parameters: {}
47
thresholds:
48
- name: minimal-suspicion
49
expression: weight <= 0
50
action: ALLOW
51
- name: mild-suspicion
52
expression:
53
all:
54
- weight > 0
55
- weight < 10
56
action: CHALLENGE
57
challenge:
58
algorithm: metarefresh
59
difficulty: 1
60
report_as: 1
61
- name: moderate-suspicion
62
expression:
63
all:
64
- weight >= 10
65
- weight < 20
66
action: CHALLENGE
67
challenge:
68
algorithm: fast
69
difficulty: 2
70
report_as: 2
71
- name: extreme-suspicion
72
expression: weight >= 20
73
action: CHALLENGE
74
challenge:
75
algorithm: fast
76
difficulty: 4
77
report_as: 4
78
immutable: true
79
kind: ConfigMap
80
metadata:
81
labels:
82
app.kubernetes.io/managed-by: timoni
83
app.kubernetes.io/name: nossa
84
app.kubernetes.io/version: 0.0.0-devel
85
name: nossa-anubis-env-8abfe282
86
namespace: nossa
87
---
88
apiVersion: v1
89
data:
90
CONTEXT_LINK_TITLE: kivikakk.ee
91
CONTEXT_LINK_URL: https://kivikakk.ee
92
DATABASE_PRIMARY_DATABASE: nossa
93
DATABASE_PRIMARY_HOSTNAME: postgres.postgres-cassax.svc.cassax.hrzn.ee
94
DATABASE_PRIMARY_SSL_VERIFY_NONE: "1"
95
MIX_ENV: prod
96
NOSSA_GIT_ROOT: /app/storage/git
97
NOSSA_MAX_BODY_LENGTH: "1000000000"
98
NOSSA_SNAME: nossa
99
OPEN_LISTENER: "1"
100
PHX_HOST: nossa.ee
101
PORT: "80"
102
TELEMETRY_PORT: "81"
103
immutable: true
104
kind: ConfigMap
105
metadata:
106
labels:
107
app.kubernetes.io/managed-by: timoni
108
app.kubernetes.io/name: nossa
109
app.kubernetes.io/version: 0.0.0-devel
110
name: nossa-env-94f732c3
111
namespace: nossa
112
---
113
apiVersion: v1
114
kind: Service
115
metadata:
116
labels:
117
app.kubernetes.io/managed-by: timoni
118
app.kubernetes.io/name: nossa
119
app.kubernetes.io/version: 0.0.0-devel
120
name: nossa
121
namespace: nossa
122
spec:
123
ports:
124
- name: ingress
125
port: 80
126
protocol: TCP
127
targetPort: anubis
128
- name: metrics
129
port: 81
130
protocol: TCP
131
targetPort: metrics
132
- name: anubis-metrics
133
port: 9090
134
protocol: TCP
135
targetPort: anubis-metrics
136
selector:
137
app.kubernetes.io/name: nossa
138
type: ClusterIP
139
---
140
apiVersion: apps/v1
141
kind: Deployment
142
metadata:
143
labels:
144
app.kubernetes.io/managed-by: timoni
145
app.kubernetes.io/name: nossa
146
app.kubernetes.io/version: 0.0.0-devel
147
name: nossa
148
namespace: nossa
149
spec:
150
replicas: 1
151
selector:
152
matchLabels:
153
app.kubernetes.io/name: nossa
154
template:
155
metadata:
156
annotations:
157
enbi.hrzn.ee/nixbuild-flakeUrl: git+https://nossa.ee/~talya/nossa?rev=a6e4ee6e48990f0394d1529f1dbc0ceeac24036d
158
enbi.hrzn.ee/nixbuild-imageTag: nossa.ee/talya/nossa:a6e4ee6e48990f0394d1529f1dbc0ceeac24036d
159
enbi.hrzn.ee/nixbuild-packageName: nossa-docker-stream-layered
160
labels:
161
app.kubernetes.io/name: nossa
162
spec:
163
affinity:
164
nodeAffinity:
165
requiredDuringSchedulingIgnoredDuringExecution:
166
nodeSelectorTerms:
167
- matchExpressions:
168
- key: kubernetes.io/os
169
operator: In
170
values:
171
- linux
172
- key: kubernetes.io/hostname
173
operator: In
174
values:
175
- kala
176
containers:
177
- env:
178
- name: DATABASE_PRIMARY_USERNAME
179
valueFrom:
180
secretKeyRef:
181
key: username
182
name: nossa.nossa.postgres.credentials.postgresql.acid.zalan.do
183
- name: DATABASE_PRIMARY_PASSWORD
184
valueFrom:
185
secretKeyRef:
186
key: password
187
name: nossa.nossa.postgres.credentials.postgresql.acid.zalan.do
188
- name: NODE_NAME
189
valueFrom:
190
fieldRef:
191
fieldPath: spec.nodeName
192
- name: SECRET_KEY_BASE
193
valueFrom:
194
secretKeyRef:
195
key: secret-key-base
196
name: env-secret-20250812-022747
197
- name: RELEASE_COOKIE
198
valueFrom:
199
secretKeyRef:
200
key: release-cookie
201
name: env-secret-20250812-022747
202
- name: SMTP_HOST
203
valueFrom:
204
fieldRef:
205
fieldPath: status.hostIP
206
envFrom:
207
- configMapRef:
208
name: nossa-env-94f732c3
209
image: nossa.ee/talya/nossa:a6e4ee6e48990f0394d1529f1dbc0ceeac24036d
210
imagePullPolicy: Never
211
livenessProbe:
212
initialDelaySeconds: 5
213
periodSeconds: 5
214
tcpSocket:
215
port: http
216
name: nossa
217
ports:
218
- containerPort: 80
219
name: http
220
protocol: TCP
221
- containerPort: 81
222
name: metrics
223
protocol: TCP
224
readinessProbe:
225
httpGet:
226
path: /~talya/nossa
227
port: http
228
initialDelaySeconds: 5
229
periodSeconds: 10
230
resources:
231
requests:
232
cpu: 10m
233
memory: 32Mi
234
securityContext:
235
allowPrivilegeEscalation: false
236
capabilities:
237
add:
238
- CHOWN
239
- NET_BIND_SERVICE
240
- SETGID
241
- SETUID
242
drop:
243
- ALL
244
privileged: false
245
volumeMounts:
246
- mountPath: /app/storage
247
name: pvs
248
- env:
249
- name: BIND
250
value: :8080
251
- name: DIFFICULTY
252
value: "5"
253
- name: ED25519_PRIVATE_KEY_HEX
254
valueFrom:
255
secretKeyRef:
256
key: ED25519_PRIVATE_KEY_HEX
257
name: anubis-20250816-070331
258
- name: METRICS_BIND
259
value: :9090
260
- name: SERVE_ROBOTS_TXT
261
value: "false"
262
- name: TARGET
263
value: http://localhost:80
264
- name: POLICY_FNAME
265
value: /anubis-policy/policy.yml
266
image: ghcr.io/techarohq/anubis:latest
267
imagePullPolicy: Always
268
name: anubis
269
ports:
270
- containerPort: 8080
271
name: anubis
272
protocol: TCP
273
- containerPort: 9090
274
name: anubis-metrics
275
protocol: TCP
276
resources:
277
limits:
278
cpu: 750m
279
memory: 256Mi
280
requests:
281
cpu: 100m
282
memory: 256Mi
283
securityContext:
284
allowPrivilegeEscalation: false
285
capabilities:
286
drop:
287
- ALL
288
runAsGroup: 1000
289
runAsNonRoot: true
290
runAsUser: 1000
291
seccompProfile:
292
type: RuntimeDefault
293
volumeMounts:
294
- mountPath: /anubis-policy
295
name: anubis-policy
296
initContainers:
297
- command:
298
- /bin/nossa-epmd
299
- -d
300
image: nossa.ee/talya/nossa:a6e4ee6e48990f0394d1529f1dbc0ceeac24036d
301
imagePullPolicy: Never
302
livenessProbe:
303
initialDelaySeconds: 5
304
periodSeconds: 5
305
tcpSocket:
306
port: 4369
307
name: epmd
308
restartPolicy: Always
309
volumes:
310
- name: pvs
311
persistentVolumeClaim:
312
claimName: nossa
313
- configMap:
314
name: nossa-anubis-env-8abfe282
315
name: anubis-policy
316
---
317
apiVersion: v1
318
kind: PersistentVolumeClaim
319
metadata:
320
labels:
321
app.kubernetes.io/managed-by: timoni
322
app.kubernetes.io/name: nossa
323
app.kubernetes.io/version: 0.0.0-devel
324
name: nossa
325
namespace: nossa
326
spec:
327
accessModes:
328
- ReadWriteOnce
329
resources:
330
requests:
331
storage: 20Gi
332
---
333
apiVersion: gateway.envoyproxy.io/v1alpha1
334
kind: BackendTrafficPolicy
335
metadata:
336
name: nossa-backend
337
namespace: nossa
338
spec:
339
targetRefs:
340
- group: gateway.networking.k8s.io
341
kind: HTTPRoute
342
name: nossa
343
timeout:
344
http:
345
connectionIdleTimeout: 3600s
346
requestTimeout: 3600s
347
---
348
apiVersion: gateway.networking.k8s.io/v1
349
kind: HTTPRoute
350
metadata:
351
annotations:
352
external-dns.alpha.kubernetes.io/hostname: nossa.ee.
353
external-dns.alpha.kubernetes.io/ttl: 24h
354
labels:
355
app.kubernetes.io/managed-by: timoni
356
app.kubernetes.io/name: nossa
357
app.kubernetes.io/version: 0.0.0-devel
358
name: nossa
359
namespace: nossa
360
spec:
361
hostnames:
362
- nossa.ee
363
parentRefs:
364
- name: eg
365
namespace: envoy-gateway-system
366
sectionName: https-nossa-ee
367
rules:
368
- backendRefs:
369
- name: nossa
370
port: 80
371
---
372
apiVersion: gateway.networking.k8s.io/v1
373
kind: HTTPRoute
374
metadata:
375
labels:
376
app.kubernetes.io/managed-by: timoni
377
app.kubernetes.io/name: nossa
378
app.kubernetes.io/version: 0.0.0-devel
379
name: nossa-www-redirect
380
namespace: nossa
381
spec:
382
hostnames:
383
- www.nossa.ee
384
parentRefs:
385
- name: eg
386
namespace: envoy-gateway-system
387
sectionName: https-www-nossa-ee
388
rules:
389
- filters:
390
- requestRedirect:
391
hostname: nossa.ee
392
statusCode: 301
393
type: RequestRedirect
394
