Anubis policy configuration

Additional bot rules appended to the policy

Additional policy settings merged into the policy file

The policy file to use

Whether to include Anubis's default bot detection rules via the (data)/meta/default-config.yaml import

The policy file to use

An attribute set of Anubis instances

add will additionally listen for TLS connections. only will disable TLS connections. force will redirect non-TLS traffic to the TLS connection.

Anubis policy configuration in Nix syntax

The Wake-on-LAN policy to set for the device

Defines the SSL policies for use with Neo4j connectors

Anubis policy configuration

Key policy for zone signing keys

Key policy for key signing keys

Additional bot rules appended to the policy

Additional policy settings merged into the policy file

The mandatory base directory for cryptographic objects of this policy

The client authentication stance for this policy.

The name of private PKCS #8 key file for this policy to be found in the baseDirectory, or the absolute path to the key file

Restrict the allowed ciphers of this policy to those defined here

Makes this policy trust all remote parties

List of certificate policy OIDs the peer's certificate must have

Connection uniqueness policy to enforce

Restrict the TLS protocol versions of this policy to those defined here.

How strictly this policy should be enforced

Certificate revocation policy for CRL or OCSP revocation.

• A strict revocation policy fails if no revocation information is available, i.e. the certificate is not known to be unrevoked.
• ifuri fails only if a CRL/OCSP URI is available, but certificate revocation checking fails, i.e. there should be revocation information available, but it could not be obtained.
• The default revocation policy relaxed fails only if a certificate is revoked, i.e. it is explicitly known that it is bad

DEPRECATED, use driverOptions

install policy for the worker (always, if-not-present, never, prompt)

Default pull-policy for Docker images

Whether to include Anubis's default bot detection rules via the (data)/meta/default-config.yaml import

add will additionally listen for TLS connections. only will disable TLS connections. force will redirect non-TLS traffic to the TLS connection.

Specifies the policy to use for reconnecting to an unavailable LDAP server

Whether to enable this angrr policy.

A list of routing policy rules sections to be added to the unit

A set of policies to apply to the IPsec connections.

All policies to provision

Whether to enable this angrr policy.

The name of public X.509 certificate (chain) file in PEM format for this policy to be found in the baseDirectory, or the absolute path to the certificate file

Retention period for the GC roots matched by this policy.

The user under which Anubis is run

External filter program to further filter GC roots matched by this policy.

add will additionally listen for TLS connections. only will disable TLS connections. force will redirect non-TLS traffic to the TLS connection.

The group under which Anubis is run

The kernel routing table to add this interface's associated routes to

Allows the generation of a private key and associated self-signed certificate

Whether to enable this instance of Anubis.

A list of extra flags to be passed to Anubis.

The description of this policy

Priority of this policy

The address that Anubis listens to

Mark all wireguard packets originating from this interface with the given firewall mark

The kernel routing table to add this interface's associated routes to

Freeform configuration via environment variables for Anubis

Neo4j SSL policy for BOLT traffic

By default, all networks will get same priority group (0)

The mode can be "file" or "database" that defines where the ACL policies are stored and read from.

If the mode is set to "file", the path to a HuJSON file containing ACL policies.

Nix daemon process CPU scheduling policy

The reverse proxy target that Anubis is protecting

Neo4j SSL policy for HTTPS traffic

The address Anubis' metrics server listens to

Whether to serve a default robots.txt that denies access to common AI bots by name and all other bots by wildcard.

Action to perform for this CHILD_SA on DPD timeout

Whether to enable the policy_conditions feature for this account.

Netfilter mark and mask for output traffic

Netfilter mark and mask for input traffic

Image pull policy for the container

Whether to set mark_in on the inbound SA

The error-policy setting applies to all app-layer parsers

The network family that Anubis should bind to

Signature verification policy file

Action to perform after a CHILD_SA gets closed by the peer.

• The default of none does not take any action,
• trap installs a trap policy for the CHILD_SA.
• start tries to re-create the CHILD_SA.

close_action does not provide any guarantee that the CHILD_SA is kept alive

Anubis policy configuration in Nix syntax

Netfilter mark applied to packets after the inbound IPsec SA processed them

Netfilter mark applied to packets after the outbound IPsec SA processed them

Action to perform after loading the configuration.

• The default of none loads the connection only, which then can be manually initiated or used as a responder configuration.
• The value trap installs a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
• The value start initiates the connection actively.
• Since version 5.9.6 two modes above can be combined with trap|start, to immediately initiate a connection for which trap policies have been installed

The difficulty required for clients to solve the challenge

If set, shows a contact email address when rendering error pages

The network family that the metrics server should bind to

Whether to install outbound FWD IPsec policies or not

Whether to enable Open Graph tag passthrough

Grants the user, created by the ensureUser attr, replication permissions

StartTLS policy when connecting to server.

Define a common behavior for all exception policies

Name of the UKI

The name of the instance.

The USBGuard daemon will load this as the policy rule set

Name is used as a suffix for the service name, user, and group

The name of the user account

The name identifying the runner instance towards the Gitea/Forgejo instance.

Adapter name that is used in the radicle-ci-broker configuration

The name of the group

The name of this nylon instance.

Name of the zone.

Name of the PPP peer.

Extra chromium policy options

The name of the system used in the system.build.toplevel derivation

The name of the user account

The frp consists of client and server

How often or when the retention policy is performed.