Differential D3908 Diff 10586 roles/paas-docker/anubis/files/policies.yaml

Changeset View

Standalone View

roles/paas-docker/anubis/files/policies.yaml

This file was added.

				# -------------------------------------------------------------
				# Anubis — Bot policies
				derecksonUnsubmitted Not Done Inline Actions Should be re conciliated with content in P390 currently deployed on Dwellers. dereckson: Should be re conciliated with content in P390 currently deployed on Dwellers.
				derecksonUnsubmitted Not Done Inline Actions Add the usual header here. Anything in files directory should start by that template header: https://devcentral.nasqueron.org/source/snippets/browse/main/salt/file.conf (lines 1-14 are always used, lines 16-18 are only useful when we want to divide a long configuration in sections). There are several goals we want to achieve: if we want to edit the final file on a server, we are reminded it's auto-generated by Salt, so that we need to modify it here, not manually source file gives us the path where to edit, here it will say roles/paas-docker/anubis/files/policies.yaml for example dereckson: Add the usual header here. Anything in files directory should start by that template header…
				# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
				# Project: Nasqueron
				# License: Trivial work, not eligible to copyright
				# Source file: roles/paas-docker/anubis/files/policies.yaml
				# -------------------------------------------------------------
				#
				# <auto-generated>
				# This file is managed by our rOPS SaltStack repository.
				#
				# Changes to this file may cause incorrect behavior
				# and will be lost if the state is redeployed.
				# </auto-generated>

				# Anubis botPolicies.yaml
				# Reconiciliated with P390

				bots:
				- import: (data)/bots/_deny-pathological.yaml
				- import: (data)/bots/aggressive-brazilian-scrapers.yaml
				- import: (data)/meta/ai-block-aggressive.yaml
				- import: (data)/crawlers/_allow-good.yaml
				- import: (data)/clients/x-firefox-ai.yaml
				- import: (data)/common/keep-internet-working.yaml

				- name: low-load-average
				action: WEIGH
				expression: load_15m <= 2.0
				weight:
				adjust: -10

				- name: realistic-browser-catchall
				expression:
				all:
				- '"User-Agent" in headers'
				- '( userAgent.contains("Firefox") ) \|\| ( userAgent.contains("Chrome") ) \|\| ( userAgent.contains("Safari") )'
				- '"Accept" in headers'
				- '"Sec-Fetch-Dest" in headers'
				- '"Sec-Fetch-Mode" in headers'
				- '"Sec-Fetch-Site" in headers'
				- '"Accept-Encoding" in headers'
				- '( headers["Accept-Encoding"].contains("zstd") \|\| headers["Accept-Encoding"].contains("br") )'
				- '"Accept-Language" in headers'
				action: WEIGH
				weight:
				adjust: -10

				- name: upgrade-insecure-requests
				expression: '"Upgrade-Insecure-Requests" in headers'
				action: WEIGH
				weight:
				adjust: -2

				- name: chrome-is-proper
				expression:
				all:
				- userAgent.contains("Chrome")
				- '"Sec-Ch-Ua" in headers'
				- 'headers["Sec-Ch-Ua"].contains("Chromium")'
				- '"Sec-Ch-Ua-Mobile" in headers'
				- '"Sec-Ch-Ua-Platform" in headers'
				action: WEIGH
				weight:
				adjust: -5

				- name: should-have-accept
				expression: '!("Accept" in headers)'
				action: WEIGH
				weight:
				adjust: 5

				- name: generic-browser
				user_agent_regex: >-
				Mozilla\|Opera
				action: WEIGH
				weight:
				adjust: 10

				dnsbl: false

				status_codes:
				CHALLENGE: 200
				DENY: 200

				store:
				backend: memory
				parameters: {}

				thresholds:
				- name: minimal-suspicion
				expression: weight <= 0
				action: CHALLENGE
				challenge:
				algorithm: fast
				difficulty: 4

				- name: mild-suspicion
				expression:
				all:
				- weight > 0
				- weight < 10
				action: CHALLENGE
				challenge:
				algorithm: metarefresh
				difficulty: 1

				- name: moderate-suspicion
				expression:
				all:
				- weight >= 10
				- weight < 20
				action: CHALLENGE
				challenge:
				algorithm: fast
				difficulty: 2

				- name: mild-proof-of-work
				expression:
				all:
				- weight >= 20
				- weight < 30
				action: CHALLENGE
				challenge:
				algorithm: fast
				difficulty: 4

				- name: extreme-suspicion
				expression: weight >= 30
				action: CHALLENGE
				challenge:
				algorithm: fast
				difficulty: 6