julian

Sure. I have found that the default botPolicy works fine for blocking the AI bots, but blocks federation.

At the reverse proxy level:

if ($request_method = POST) {
    proxy_pass http://nodebb/; 
}

Because Anubis can’t filter by HTTP method, unless I am mistaken. This just broadly allows all incoming activities. If you want to get specific, limit it to your shared inbox or individual user inboxes via regular expression or something. I didn’t find that it was necessary.

As for botPolicies.yaml

  # Allow /inbox
  - name: allow-ap-headers
    headers_regex:
      Accept: application/ld\+json; profile="https://www.w3.org/ns/activitystreams"
      Accept: application/activity\+json
    action: ALLOW

  - name: allow-assets
    path_regex: /assets
    action: ALLOW

The former allows those specific AP headers (it is naive, some AP impls. send slight variations of those two headers.

The latter allows our uploads.

Drop the “Fediverse” verbiage, or even “federated”.

You may be speaking to potential instance admins but only those familiar with AP know what federation means. Otherwise it’s a term with no meaning.

Ironically, even “Lemmyverse” means more than “Fediverse”, so “linked together through the Lemmyverse” actually works better.