fix: don't generate the basic auth password

.env.sample

@@ -223,8 +223,9 @@ WRITE_TIMEOUT=0s
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO
 
+## Anubis metrics
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
+#SECRET_BASIC_AUTH_VERSION=v1 # generate=false
+
 ## Enable onion service support
 #ONION_ENABLED=1
-
-## Keep access logs
-#COMPOSE_FILE="$COMPOSE_FILE:compose.access-log.yml"

README.md

@@ -72,6 +72,11 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
+If you want to collect Prometheus metrics for Anubis, for instance with
+[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section
+and insert the basic auth password as a secret.  The username will be
+"admin".
+
 ## Enabling onion service
 
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).

abra.sh

@@ -1,3 +1,4 @@
-export TRAEFIK_YML_VERSION=v33
+export TRAEFIK_YML_VERSION=v32
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
+export ANUBIS_YML_VERSION=v1

anubis.yml.tmpl

@@ -0,0 +1,10 @@
+bots:
+- import: (data)/meta/default-config.yaml
+{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
+metrics:
+  bind: ":9090"
+  network: "tcp"
+  basicAuth:
+    username: "admin"
+    password: "{{ secret "basic_auth" }}"
+{{ end }}

compose.access-log.yml

@@ -1,10 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    environment:
-      ACCESS_LOG_ENABLED: "true"
-    volumes:
-      - "access-logs:/var/log/"
-volumes:
-  access-logs:

compose.anubis-metrics.yml

@@ -0,0 +1,18 @@
+---
+version: "3.8"
+services:
+  anubis:
+    environment:
+      ANUBIS_METRICS_ENABLED: "true"
+    secrets:
+    - "basic_auth"
+    deploy:
+      labels:
+      - "prometheus.io/scrape=true"
+      - "prometheus.io/port=9090"
+      - "prometheus.io/path=/metrics"
+      - "prometheus.io/auth=basic"
+secrets:
+  basic_auth:
+    external: true
+    name: "${STACK_NAME}_basic_auth_${SECRET_BASIC_AUTH_VERSION}"

compose.anubis.yml

@@ -19,6 +19,10 @@ services:
       OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
       SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
       SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
+      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
+    configs:
+    - source: anubis_yml
+      target: /data/cfg/botPolicy.yaml
     networks:
     - proxy
     deploy:
@@ -29,3 +33,8 @@ services:
       - "traefik.http.routers.anubis.entrypoints=web-secure"
       - "traefik.http.services.anubis.loadbalancer.server.port=8080"
       - "traefik.http.routers.anubis.service=anubis"
+configs:
+  anubis_yml:
+    name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
+    file: anubis.yml.tmpl
+    template_driver: golang

traefik.yml.tmpl

@@ -6,21 +6,6 @@ log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
 
-{{ if eq (env "ACCESS_LOG_ENABLED") "true" }}
-accessLog:
-  format: "json"
-  filePath: "/var/log/access_log.jsonl"
-  fields:
-    defaultMode: "keep"
-    headers:
-      defaultMode: "keep"
-      names:
-        Authorization: "drop"
-        Cookie: "drop"
-    queryParameters:
-      defaultMode: "keep"
-{{ end }}
-
 providers:
   swarm:
     endpoint: "tcp://socket-proxy:2375"