diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index 566ebd5..7df645b 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -32,6 +32,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed cookie deletion logic ([#520](https://github.com/TecharoHQ/anubis/issues/520), [#522](https://github.com/TecharoHQ/anubis/pull/522)) - Add `--target-sni` flag/envvar to allow changing the value of the TLS handshake hostname in requests forwarded to the target service. - Fixed CEL expression matching validator to now properly error out when it receives empty expressions +- Added OpenRC init.d script. ## v1.18.0: Varis zos Galvus diff --git a/run/openrc/anubis.confd b/run/openrc/anubis.confd new file mode 100644 index 0000000..13fd7d9 --- /dev/null +++ b/run/openrc/anubis.confd @@ -0,0 +1,24 @@ +# The URL of the service that Anubis should forward valid requests to. Supports +# Unix domain sockets. +#ANUBIS_TARGET="http://localhost:3923" +#ANUBIS_TARGET="unix:///path/to/socket" + +# The network address that Anubis listens on. +# +# If unset, listen on /run/anubis_${instance}/anubis.sock Unix socket instead. +#ANUBIS_BIND_PORT=":8923" + +# The network address that Anubis serves Prometheus metrics on. +# +# If unset, listen on /run/anubis_${instance}/metrix.sock Unix socket instead. +#ANUBIS_METRICS_BIND_PORT=":9090" + +# The difficulty of the challenge, or the number of leading zeroes that must be +# in successful responses. +#ANUBIS_DIFFICULTY=4 + +# Additional command-line options for Anubis. +#ANUBIS_OPTS="" + +# Configure the user[:group] Anubis will run as. +#command_user="anubis:anubis" diff --git a/run/openrc/anubis.initd b/run/openrc/anubis.initd new file mode 100644 index 0000000..3b74924 --- /dev/null +++ b/run/openrc/anubis.initd @@ -0,0 +1,34 @@ +#!/sbin/openrc-run +# shellcheck shell=sh + +instance=${RC_SVCNAME#*.} + +description="Anubis HTTP defense proxy (instance ${instance})" +supervisor="supervise-daemon" +command="/usr/bin/anubis" +command_args="\ + -bind ${ANUBIS_BIND_PORT:-/run/anubis_${instance?}/anubis.sock -bind-network unix} \ + -metrics-bind ${ANUBIS_METRICS_BIND_PORT:-/run/anubis_${instance?}/metrics.sock -metrics-bind-network unix} \ + -target ${ANUBIS_TARGET:-http://localhost:3923} \ + -difficulty ${ANUBIS_DIFFICULTY:-4} \ + ${ANUBIS_OPTS} +" +command_background=1 +pidfile="/run/anubis_${instance?}/anubis.pid" + +: "${command_user:=anubis:anubis}" + +depend() { + use net firewall +} + +start_pre() { + if [ "${instance?}" = "${RC_SVCNAME?}" ]; then + eerror "${RC_SVCNAME?} cannot be started directly. You must create" + eerror "symbolic links to it for the services you want to start" + eerror "and add those to the appropriate runlevels." + return 1 + fi + + checkpath -d -o "${command_user?}" "/run/anubis_${instance?}" +}