feat: anubis geoip

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [traefik](https://github.com/containous/traefik) | patch | `v3.7.16` -> `v3.7.17` |

> ❗ **Important**
>
> Release Notes retrieval for this PR were skipped because no github.com credentials were available.
> If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes).

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: #154
Co-authored-by: Renovate Bot <renovate@coopcloud.tech>

.env.sample

@@ -236,6 +236,13 @@ WRITE_TIMEOUT=0s
 ## Anubis metrics
 #COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
 
+## Enable Anubis GeoIP detection
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-geoip.yml"
+# YAML list of blocked ASNs
+#ANUBIS_GEOIP_BLOCKED_ASNS='[13335,136907,45102]'
+# YAML list of blocked countries
+#ANUBIS_GEOIP_BLOCKED_COUNTRIES='[BR,CN,VN]'
+
 ## Enable onion service support
 #ONION_ENABLED=1
 
@@ -259,3 +266,4 @@ WRITE_TIMEOUT=0s
 #RATE_LIMIT_AVERAGE=100
 #RATE_LIMIT_BURST=200
 #RATE_LIMIT_PERIOD=1s
+

.gitea/CODEOWNERS

@@ -1 +1,2 @@
+.*anubis.* @fauno
 * @coop-cloud/traefik-maintainers

abra.sh

@@ -1,4 +1,4 @@
 export TRAEFIK_YML_VERSION=v37
 export FILE_PROVIDER_YML_VERSION=v14
 export ENTRYPOINT_VERSION=v5
-export ANUBIS_YML_VERSION=v1
+export ANUBIS_YML_VERSION=v2

anubis.yml.tmpl

@@ -1,7 +1,35 @@
 bots:
+{{ if eq (env "ANUBIS_GEOIP_ENABLED") "true" }}
+{{ if ne (env "ANUBIS_GEOIP_BLOCKED_ASNS") "" }}
+- name: blocked-asns
+  action: WEIGH
+  asns:
+    match: {{ env "ANUBIS_GEOIP_BLOCKED_ASNS" }}
+  weight:
+    adjust: 10
+{{ end }}
+{{ if ne (env "ANUBIS_GEOIP_BLOCKED_COUNTRIES") "" }}
+- name: countries-with-aggressive-scrapers
+  action: WEIGH
+  geoip:
+    countries: {{ env "ANUBIS_GEOIP_BLOCKED_COUNTRIES" }}
+  weight:
+    adjust: 10
+{{ end }}
+{{ end }}
 - import: (data)/meta/default-config.yaml
 {{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
 metrics:
   bind: ":9090"
   network: "tcp"
 {{ end }}
+{{ if eq (env "ANUBIS_GEOIP_ENABLED") "true" }}
+geoip:
+  asn:
+    path: /var/lib/anubis/GeoLite2-ASN.mmdb
+  country:
+    path: /var/lib/anubis/GeoLite2-Country.mmdb
+logging:
+  sink: stdio
+  asn: true
+{{ end }}

compose.anubis-geoip.yml

@@ -0,0 +1,10 @@
+---
+version: "3.8"
+services:
+  anubis:
+    environment:
+      ANUBIS_GEOIP_ENABLED: "true"
+    volumes:
+      - "anubis-geoip:/var/lib/anubis/:ro"
+volumes:
+  anubis-geoip:

compose.anubis.yml

@@ -7,7 +7,7 @@ services:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
       - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.28.1"
+    image: "ghcr.io/techarohq/anubis:v1.28.2"
     environment:
       BIND: ":8080"
       TARGET: " "

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.16"
+    image: "traefik:v3.7.17"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -57,7 +57,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.5.0+v3.7.16"
+        - "coop-cloud.${STACK_NAME}.version=6.5.1+v3.7.17"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"