Setting up Anubis

Anubis is meant to sit between your reverse proxy (such as Nginx or Caddy) and your target service. One instance of Anubis must be used per service you are protecting.

Docker image conventions​

Anubis is shipped in the Docker repo ghcr.io/techarohq/anubis. The following tags exist for your convenience:

The Docker image runs Anubis as user ID 1000 and group ID 1000. If you are mounting external volumes into Anubis' container, please be sure they are owned by or writable to this user/group.

Anubis has very minimal system requirements. I suspect that 128Mi of ram may be sufficient for a large number of concurrent clients. Anubis may be a poor fit for apps that use WebSockets and maintain open connections, but I don't have enough real-world experience to know one way or another.

Native packages​

For more detailed information on installing Anubis with native packages, please read the native install directions.

Environment variables​

Anubis uses these environment variables for configuration:

For more detailed information on configuring Open Graph tags, please refer to the Open Graph Configuration page.

Using Base Prefix​

The BASE_PREFIX environment variable allows you to run Anubis behind a path prefix. This is useful when:

• You want to host multiple services on the same domain
• You're using a reverse proxy that routes based on path prefixes
• You need to integrate Anubis with an existing application structure

For example, if you set BASE_PREFIX=/myapp, Anubis will:

• Serve its challenge page at /myapp/ instead of /
• Serve its API endpoints at /myapp/.within.website/x/cmd/anubis/api/ instead of /.within.website/x/cmd/anubis/api/
• Serve its static assets at /myapp/.within.website/x/cmd/anubis/ instead of /.within.website/x/cmd/anubis/

When using this feature with a reverse proxy:

1. Configure your reverse proxy to route requests for the specified path prefix to Anubis
2. Set the BASE_PREFIX environment variable to match the path prefix in your reverse proxy configuration
3. Ensure that your reverse proxy preserves the path when forwarding requests to Anubis

Example with Nginx:

location /myapp/ {
    proxy_pass http://anubis:8923/myapp;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

With corresponding Anubis configuration:

BASE_PREFIX=/myapp

Key generation​

To generate an ed25519 private key, you can use this command:

openssl rand -hex 32

Alternatively here is a key generated by your browser:

Next steps​

To get Anubis filtering your traffic, you need to make sure it's added to your HTTP load balancer or platform configuration. See the environments category for detailed information on individual environments.

• Apache
• Docker compose
• Kubernetes
• Nginx
• Traefik