From c480e681c14428742c9aa50cd62c71d029c429f7 Mon Sep 17 00:00:00 2001
From: Haonan Chen <chn@chn.moe>
Date: Tue, 6 Jan 2026 09:46:37 +0800
Subject: [PATCH] modules.services.gitea: remove anubis, use simple js

---
 modules/services/gitea.nix | 27 ++++++++++++++++-----------
 nixpkgs                    |  2 +-
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index 1b92316d..2d8f6492 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -57,16 +57,21 @@ inputs:
           "cron.gc_lfs" = { ENABLED = true; SCHEDULE = "@monthly"; NUMBER_TO_CHECK_PER_REPO = 0; };
         };
       };
-      anubis.instances.gitea.settings =
-      {
-        OG_PASSTHROUGH = true;
-        TARGET = "http://127.0.0.1:3002";
-        BIND_NETWORK = "tcp";
-        BIND = "127.0.0.1:3003";
-        WEBMASTER_EMAIL = "chn@chn.moe";
-        SERVE_ROBOTS_TXT = true;
-        METRICS_BIND = "/run/anubis/anubis-gitea/anubis-metrics.sock";
-      };
+      # prevent AI web crawlers
+      # https://her.esy.fun/posts/0031-how-i-protect-my-forgejo-instance-from-ai-web-crawlers/index.html
+      nginx.virtualHosts."https:${gitea.hostname}".locations."/".extraConfigPre =
+      ''
+        if ($http_user_agent ~* "git/|git-lfs/") {
+              set $bypass_cookie 1;
+        }
+        if ($cookie_Yogsototh_opens_the_door = "1") {
+              set $bypass_cookie 1;
+        }
+        if ($bypass_cookie != 1) {
+          add_header Content-Type text/html always;
+          return 418 '<script>document.cookie = "Yogsototh_opens_the_door=1; Path=/;"; window.location.reload();</script>';
+        }
+      '';
     };
     nixos =
     {
@@ -78,7 +83,7 @@ inputs:
       };
       services =
       {
-        nginx.https.${gitea.hostname}.location."/".proxy.upstream = "http://127.0.0.1:3003";
+        nginx.https.${gitea.hostname}.location."/".proxy.upstream = "http://127.0.0.1:3002";
         postgresql.instances.gitea = {};
       };
     };
diff --git a/nixpkgs b/nixpkgs
index d7f3d874..d8ca282f 160000
--- a/nixpkgs
+++ b/nixpkgs
@@ -1 +1 @@
-Subproject commit d7f3d87456d890459fac2f3e3723340d60de10bb
+Subproject commit d8ca282fc00c0e33bf31241f5240179250af82c9