From 281325c0b1a15e548c4c9b2f74def229e05e784e Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sat, 25 Jul 2026 18:37:39 +0200
Subject: [PATCH] anubis: improve php-my-admin and mediawiki

---
 hosts/vm/reverseproxy/reverseproxy.nix | 32 ++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 1f95959..e55fe2f 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -87,6 +87,11 @@ let
         path_regex = "^/[a-zA-Z0-9_-]*/public/.*";
         action = "ALLOW";
       }
+      {
+        name = "allow-phpmyadmin";
+        path_regex = "^/phpmyadmin/.*";
+        action = "ALLOW";
+      }
       {
         # geneau utilisait ses pages persos avant la mise en place d'Anubis.
         # Le déploiement d'Anubis l'a impacté (cf les mails de fin 2025).
@@ -102,7 +107,7 @@ let
       }
       {
         name = "challenge-other";
-        path_regex = "^*";
+        path_regex = "^.*";
         action = "CHALLENGE";
       }
     ];
@@ -131,6 +136,29 @@ let
     ];
   };
 
+  anubisWiki = formatJSON.generate "anubis_wiki.json" {
+    "bots" = [
+      {
+        import = "${antiBot}";
+      }
+      {
+        name = "allow-mediawiki-images";
+        path_regex = "^/w/images/.*";
+        action = "ALLOW";
+      }
+      {
+        name = "allow-mediawiki-api";
+        path_regex = "^/w/api.php.*";
+        action = "ALLOW";
+      }
+      {
+        name = "challenge-other";
+        path_regex = ".*";
+        action = "CHALLENGE";
+      }
+    ];
+  };
+
   fetchFromCrans =
     opts:
     pkgs.fetchFromGitLab (
@@ -230,7 +258,7 @@ in
           proxyPass = "172.16.10.110";
         };
         "mediawiki" = {
-          anubisConfig = "${anubisChallenge}";
+          anubisConfig = "${anubisWiki}";
           proxyPass = "172.16.10.144";
           serverAliases = [ "mediakiwi" ];
         };