Installing anubis

Discuss Advanced use case
1

Hi all,

Just getting started with yunohost and thought it was worth sharing getting anubis working

curl -O -L https://github.com/TecharoHQ/anubis/releases/download/v${ver}/anubis_1.28.2_amd64.deb

sudo apt install ./anubis_1.28.2_amd64.deb

sudo sed -i -e 's+DynamicUser=yes+DynamicUser=no\nUser=www-data\nGroup=www-data+' /usr/lib/systemd/system/anubis@.service

Then add to /etc/yunohost/hooks.d/conf_regen/97-nginx_anubis -

#!/bin/sh

action=$1
pending_dir=$4
socketdir=/var/lib/nginx/anubis

if [ "${action}" != "pre" ]
then
	exit 0
fi

mkdir -p ${socketdir}
chown www-data:www-data ${socketdir}

oldIFS=${IFS}
IFS=,
for domain in ${YNH_DOMAINS}
do
	# nginix config

	configfile=${pending_dir}/../nginx/etc/nginx/conf.d/${domain}.conf
	sed -i "/ssl_certificate_key/a\\
\\
    location /yunohost {\\
        proxy_set_header Host \$http_host;\\
        proxy_set_header X-Real-IP \$remote_addr;\\
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;\\
        proxy_set_header X-Forwarded-Proto \$scheme;\\
        proxy_set_header X-Forwarded-Server \$host;\\
        proxy_pass http://unix:${socketdir}/${domain}-to-nginx.sock;\\
    }\\
\\
    location / {\\
        proxy_set_header Host \$http_host;\\
        proxy_set_header X-Real-IP \$remote_addr;\\
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;\\
        proxy_set_header X-Forwarded-Proto \$scheme;\\
        proxy_set_header X-Forwarded-Server \$host;\\
        proxy_pass http://unix:${socketdir}/${domain}-from-nginx.sock;\\
    }\\
}\\
server {\\
    listen unix:${socketdir}/${domain}-to-nginx.sock;\\
    server_name ${domain};\\
\\
    # Get the visiting IP from the TLS termination server\\
    set_real_ip_from unix:;\\
    real_ip_header X-Real-IP;\\
" ${configfile}

	if [ ! -f /etc/anubis/${domain}.env ]
	then
		echo "BIND=/var/lib/nginx/anubis/${domain}-from-nginx.sock
BIND_NETWORK=unix
DIFFICULTY=4
METRICS_BIND=:9090
SERVE_ROBOTS_TXT=0
POLICY_FNAME=/etc/anubis/${domain}.botPolicies.yaml
TARGET=unix:/var/lib/nginx/anubis/${domain}-to-nginx.sock
SLOG_LEVEL=INFO" > /etc/anubis/${domain}.env
		cp /usr/share/doc/anubis/botPolicies.yaml /etc/anubis/${domain}.botPolicies.yaml
		systemctl enable --now anubis@${domain}.service
	fi
done
IFS=${oldIFS}

Should be close at least …

2

Oh, the following is needed for wordpress in /var/www/wordpress/wp-config.php -

/**If we got HTTPS from Nginx, we must reply the same way */
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
    $_SERVER['SERVER_PORT'] = 443;
    define('FORCE_SSL_ADMIN', true);
}
/**When replying make sure the reply HOST is set to Nginx Rerverse Proxy address, not us */
if ( isset($_SERVER['HTTP_X_FORWARDED_HOST']) )
{
        $_SERVER['HTTP_HOST'] = $_SERVER['HTTP_X_FORWARDED_HOST'];
}
3

@plord Thanks :tada: i added a link to this topic into the anubis/iocaine ticket.

4

Will this edit survive an app upgrade? Or should it be repeated every time after upgrading? Thanks!