feat: add Anubis LXC script

[opastorello]

✍️ Description

Anubis (TecharoHQ) — a reverse proxy that sits in front of a web service and stops AI scrapers and abusive bots with a proof-of-work challenge, letting real browsers and well-behaved clients through. Requested in community-scripts/ProxmoxVE#16497.

• Installed from the upstream .deb via fetch_and_deploy_gh_release … "binary" (amd64/arm64 assets exist). The package ships /usr/bin/anubis, the anubis@.service template unit (DynamicUser, works in an unprivileged CT) and the docs/policy files, so no hand-written unit.
• Instance config in /etc/anubis/main.env + /etc/anubis/main.botPolicies.yaml (copy of the upstream default), service anubis@main. The package's own /etc/anubis/default.env is not a conffile and gets overwritten on every upgrade — that's why the user-facing file has its own name.
• var_anubis_target (app_var) sets TARGET up front; defaults to upstream's http://localhost:3000 and is editable afterwards.
• Defaults are tuned for how a CT is actually used — exposed directly over plain HTTP: COOKIE_SECURE=false (with true, the challenge cookie is dropped on http://<ip> and the page loops) and USE_REMOTE_ADDRESS=true (client IP from the socket). The JSON note tells the user what to flip once a TLS proxy sits in front.
• A signing key is generated at install (ED25519_PRIVATE_KEY_HEX, 64 hex) so passes survive restarts.
• Ports: 8923 (proxy), 9090 (Prometheus metrics). 1 vCPU / 512 MB / 4 GB.

AI Agent: Claude Code (Fable 5.1), high reasoning. Everything below was run and read by me.

🔗 Related PR / Issue

Link: community-scripts/ProxmoxVE#16497

✅ Prerequisites

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No breaking changes – Existing functionality remains intact.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🏗️ arm64 Support

• arm64 supported - Tested and supported on arm64.
• arm64 not tested - Assumed to work on arm64, but testing has not been done.
• arm64 not supported - Confirmed upstream dependencies or binaries do not support arm64.

Upstream publishes anubis_<ver>_arm64.deb and binary mode picks it by architecture, but I only have an amd64 host — var_arm64 left unset, architectures omitted, per AGENTS.md.

---

🛠️ Type of Change

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

🔍 Code & Security Review

• Follows CODE-AUDIT.md & CONTRIBUTING.md guidelines
• Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
• No hardcoded credentials
• No Docker / Docker Compose – The application is installed bare-metal; Docker is not used.
• No git pull – Updates use fetch_and_deploy_gh_release instead of git pull.

---

🤖 AI Assistance

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

---

📋 Additional Information

Test log (Proxmox VE 9.x, amd64, Debian 13, storage local):

1. Install from a local checkout and again from this branch as an end user (COMMUNITY_SCRIPTS_URL=…/add-anubis): Deployed: anubis (1.27.0), anubis@main active with DynamicUser=yes, listening on 8923 and 9090.
2. Browser user agent → Anubis challenge page (HTTP 200, "Making sure you're not a bot"). Non-browser client → passed through to a test backend on localhost:3000.
3. /metrics on 9090 → 200.
4. update with the version unchanged → "No update available". Forced update (version marker removed) → .deb re-deployed, service stop/start, /etc/anubis/main.env untouched, challenge still served afterwards.
5. update run from inside the branch-installed container → works.

main.env is intentionally minimal; the full variable list is in the package docs (/usr/share/doc/anubis/docs/admin/installation.mdx). Startup logs two upstream WARNs about Thoth-only checks in the default policy — that's the stock upstream policy file, not something this script adds.

---

📦 Application Requirements (for new scripts)

• The application is at least 6 months old (March 2025)
• The application is actively maintained
• The application has 600+ GitHub stars (~22.5k)
• Official release tarballs are published
• I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

🌐 Source

• https://github.com/TecharoHQ/anubis
• https://anubis.techaro.lol/docs/

🤖 Generated with Claude Code

[github-actions]

Try this script

ct/anubis.sh, run in the Proxmox VE shell or on an Incus host:

COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/opastorello/ProxmoxVED/add-anubis \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/opastorello/ProxmoxVED/add-anubis/ct/anubis.sh)"

COMMUNITY_SCRIPTS_URL is not optional for ct/. Fetching the ct/ script from a
branch does not tell the engine where that branch is — with bash -c "$(curl …)"
there is no file on disk for the scripts root to be derived from, so it would fall
back to upstream main and look for the install script there.

Against a core branch as well

Add COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/OWNER/core/BRANCH
to test an engine change at the same time. The two resolve independently.

Useful flags while testing

dev_mode=net logs every fetch with status and duration, so you can confirm the
branch is really being used. dev_mode=keep stops a failed build from deleting
the container along with the evidence.