# Applying Anubis Selectively with Middleware Manager

**URL:** <https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479>\
**Category:** Self-hosted Applications\
**Tags:** anubis, middleware-manager, pangolin\
**Created:** [August 8, 2025, 4:00pm UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479 "2025-08-08T16:00:43Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [August 8, 2025, 4:00pm UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/1 "2025-08-08T16:00:43Z")

</div>

# Applying Anubis Selectively with Middleware Manager

This guide details how to transition from a global, catch-all Anubis implementation to a more flexible setup where Anubis is applied as a `forwardAuth` middleware. This allows you to use **Middleware Manager** to protect specific routers (resources) on a case-by-case basis, giving you granular control over your application’s security.

## The Concept: `forwardAuth` Middleware

Instead of using a low-priority router to catch all traffic, we will define Anubis as a middleware. This middleware can then be attached to any router you choose within the Middleware Manager UI.

**Advantages of this approach:**

- **Granular Control:** Protect specific routes (e.g., `/dashboard`) while leaving others (e.g., `/api/public`) unprotected.

- **Dynamic Configuration:** Easily add or remove Anubis protection from any resource through the Middleware Manager UI without editing YAML files or restarting containers.

- **Cleanliness:** Keeps your routing configuration clean and focused on directing traffic, while security logic is handled by middleware.

## Step 1: Revert Dynamic Routing Configuration

First, we must remove the “catch-all” logic from your dynamic configuration file. This step is crucial as it returns your routers to their original state, listening directly on the public entrypoint.

Edit your dynamic routing file (e.g., `./config/traefik/rules/your-file.yml` or `/root/config/traefik/dynamic_config.yml`) and restore it to its original configuration **before** we added the Anubis routers and services.

```auto
# ./config/traefik/rules/your-file.yml
# ./root/config/traefik/dynamic_config.yml

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https

  routers:
    # HTTP to HTTPS redirect router
    main-app-router-redirect:
      rule: "Host(`pangolin.development.hhf.technology`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "Host(`pangolin.development.hhf.technology`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure # <-- Back to websecure
      tls:
        certResolver: letsencrypt

    # API router (handles /api/v1 paths)
    api-router:
      rule: "Host(`pangolin.development.hhf.technology`) && PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - websecure # <-- Back to websecure
      tls:
        certResolver: letsencrypt

  services:
    # ORIGINAL SERVICES
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002" # Next.js server

    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000" # API/WebSocket server

```

**Key Change:** All routers that should be publicly accessible are now back on the `websecure` entrypoint. The `anubis` entrypoint is no longer referenced here, and the `anubis-catchall-router` and `anubis-service` have been removed from this file.

## Step 2: Ensure Anubis Service is Running

Your `docker-compose.yml` file should still contain the `anubis` service definition from the previous guide. It doesn’t need any changes. It simply needs to be running so that Traefik can forward authentication requests to it.

```auto
# docker-compose.yml (ensure this service exists)

services:
  # ... your other services
  anubis:
    image: ghcr.io/techarohq/anubis:main
    container_name: anubis
    restart: unless-stopped
    networks:
      - pangolin
    environment:
      - BIND=:8923
      - TARGET=http://traefik:3923 # This is now ignored but harmless
      - COOKIE_DOMAIN=hhf.technology
      - COOKIE_DYNAMIC_DOMAIN=false
      - DIFFICULTY=4

```

After modifying your rules, restart the stack to apply the changes:

```auto
docker compose up -d --force-recreate

```

At this point, your site should function as it did before, with no Anubis protection active.

## Step 3: Create the Anubis `forwardAuth` Middleware

Now, let’s create the reusable Anubis middleware in your Middleware Manager UI.

1. Navigate to your **Middleware Manager** dashboard.

2. Click on **“Middlewares”** in the sidebar.

3. Click the **“Add Middleware”** button.

4. Fill out the form:

5. Click **“Save”**.

You have now created a middleware named `anubis-auth` that, when applied to a router, will send all incoming requests for that router to the Anubis service for verification.

## Step 4: Apply Anubis Protection to a Resource

Let’s apply your new middleware to protect the main front-end router but leave the API router unprotected.

1. In Middleware Manager, click on **“Resources”** in the sidebar.

2. You will see a list of your resources (`next-router`, `api-router`, etc.).

3. Find the eg:- **`next-router`** resource and click the **“Manage”** button.

4. In the resource management view, click on the **“Middlewares”** tab.

5. You will see a dropdown list of available middlewares. Select **`anubis-auth@file`** from the list.

6. Click the **“Assign”** button.

The `anubis-auth` middleware is now active on your `next-router`.

## Step 5: Deploy and Verify

1. **Deploy Changes:** In Middleware Manager, a “Deploy Changes” button should appear at the top. Click it to write the new middleware configuration to your Traefik rules file.

2. **Verify:**

You have successfully configured granular, on-demand bot protection using Anubis and Middleware Manager. You can now repeat Step 4 for any other resource you wish to protect.

---

<div class="post-metadata">

**Author:** ![Iron5448](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/i/b3f665/32.png) [@Iron5448](https://forum.hhf.technology/u/Iron5448)\
**Post date:** [August 18, 2025, 10:01am UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/2 "2025-08-18T10:01:53Z")

</div>

few questions;

1. by default Pangolin gave Crowdsec integration, does this means Crowdsec can’t work together with Anubis? (since you didn’t include crowdsec in this guide).
2. five days ago anubis merged forward auth middleware feature [2], does this guide already consider this new feature?

sorry to say but this guide is unnecessary complicated in its wording. as a newbie at setting up pangolin I’d prefer if you stick to the default [1] as example.

* * *

[1] https://docs[.]digpangolin[.]com/self-host/quick-install

[2] https://github[.]com/TecharoHQ/anubis/pull/368

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [August 18, 2025, 10:31am UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/3 "2025-08-18T10:31:22Z")

</div>

Thank you for your reply.

This guide is for advanced users; newbies should stick to the default Pangolin installation. This process requires altering Traefik files, which can impact your overall performance if not done correctly. Anubis is applied to the stack rather than to individual resources. For more fine-tuning and forward authentication features, you will need a deeper knowledge of the system and must deploy a middleware manager.

`1. five days ago anubis merged forward auth middleware feature [2], does this guide already consider this new feature?` yes this was kept in mind i was watching this feature

@Iron5448 for you use this but this too is advance

[Integrating Anubis with Pangolin and Traefik - Self-hosted Applications - HHF Technology Forums](https://forum.hhf.technology/t/integrating-anubis-with-pangolin-and-traefik/3478)

---

<div class="post-metadata">

**Author:** ![devwearsprada](https://forum.hhf.technology/user_avatar/forum.hhf.technology/devwearsprada/32/2761_2.png) [@devwearsprada](https://forum.hhf.technology/u/devwearsprada)\
**Post date:** [January 11, 2026, 10:06am UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/4 "2026-01-11T10:06:31Z")

</div>

Thank you for the guide. I can’t get this to work, and I’m kinda stuck debugging this. As of now, I have a `forwardAuth` middleware file named `anubis` with the following contents:

```auto
{
  "address": "http://anubis:8923",
  "authResponseHeaders": [
    "X-Anubis-Reason",
    "X-Anubis-Status"
  ],
  "trustForwardHeader": true
}

```

My `docker-compose.yml` contains the `anubis` service.

```auto
  anubis:
    image: ghcr.io/techarohq/anubis:main
    container_name: anubis
    restart: unless-stopped
    environment:
      - BIND=:8923
      - COOKIE_DOMAIN=example.com
      - DIFFICULTY=4
      - POLICY_FNAME=/data/cfg/botPolicy.yaml
    volumes:
      - ./config/anubis/botPolicy.yaml:/data/cfg/botPolicy.yaml:ro

```

`example.com` is my top level domain.

I’ve added the `anubis` middleware to various resources. The resources load perfectly, just **without** showing the anubis challenge.

I’ve played around with the `botPolicy.yaml` file to play around winth the [status codes](https://anubis.techaro.lol/docs/admin/configuration/custom-status-codes/).

```auto
status_codes:
  CHALLENGE: 403
  DENY: 403

```

Changing this to the values above does show the anubis challenge page, but it seems to fail to load multiple resources because of the `403` status code (I assume). It appears that the default `200` status code makes Traefik ignore the middleware? Again, I am not sure… any advise would be appreciated!

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [January 11, 2026, 10:09am UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/5 "2026-01-11T10:09:29Z")

</div>

> [@devwearsprada](#):
>
> anubis

can you try

```auto
# Default middleware templates
middlewares:
  - id: anubis
    name: Anubis
    type: forwardAuth
    config:
      address: "http://anubis:8923"
      trustForwardHeader: true
      authResponseHeaders:
        - "X-Anubis-Status"
        - "X-Anubis-Reason"

```

---

<div class="post-metadata">

**Author:** ![devwearsprada](https://forum.hhf.technology/user_avatar/forum.hhf.technology/devwearsprada/32/2761_2.png) [@devwearsprada](https://forum.hhf.technology/u/devwearsprada)\
**Post date:** [January 11, 2026, 10:16am UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/6 "2026-01-11T10:16:44Z")

</div>

Thanks for your reply. I think I tried that? In the `middleware-manager` I’ve made a `forwardAuth` middleware with these contents:

```json
{
  "address": "http://anubis:8923",
  "authResponseHeaders": [
    "X-Anubis-Reason",
    "X-Anubis-Status"
  ],
  "trustForwardHeader": true
}

```

---

<div class="post-metadata">

**Author:** ![z2rec](https://forum.hhf.technology/user_avatar/forum.hhf.technology/z2rec/32/5287_2.png) [@z2rec](https://forum.hhf.technology/u/z2rec)\
**Post date:** [March 11, 2026, 5:13pm UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/7 "2026-03-11T17:13:15Z")

</div>

@hhf.technoloy Can you please revisit this topic? Seems Anubis is not working and instructions are no longer relevant to latest version of middleware manager where we have each individual resource to pick instead of choosing `next-router`/`api-router` as in the guide.

---

<div class="post-metadata">

**Author:** ![Hassle4437](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/h/8e7dd6/32.png) [@Hassle4437](https://forum.hhf.technology/u/Hassle4437)\
**Post date:** [April 21, 2026, 3:29pm UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/8 "2026-04-21T15:29:38Z")

</div>

@hhf.technoloy Maybe a naive question, but is there a way to put Anubis in front of pangolin resources that are not protected through the Pangolin SSO/access management?

---

<div class="post-metadata">

**Author:** ![z2rec](https://forum.hhf.technology/user_avatar/forum.hhf.technology/z2rec/32/5287_2.png) [@z2rec](https://forum.hhf.technology/u/z2rec)\
**Post date:** [September 8, 2026, 6:18pm UTC](https://forum.hhf.technology/t/applying-anubis-selectively-with-middleware-manager/3479/9 "2026-09-08T18:18:56Z")

</div>

Alright here are my changes that finally made it work.

Regarding the Anubis container, `TARGET` needs to be empty (` ` _space_) and I have added [botPolicies.yaml](https://github.com/TecharoHQ/anubis/blob/main/data/botPolicies.yaml) file.

```yaml
# docker-compose.yml (ensure this service exists)

services:
  # ... your other services
  anubis:
    image: ghcr.io/techarohq/anubis:main
    container_name: anubis
    restart: unless-stopped
    networks:
      - pangolin
    environment:
      - BIND=:8923
      - 'TARGET= '
      - COOKIE_DOMAIN=hhf.technology
      - COOKIE_DYNAMIC_DOMAIN=false
      - DIFFICULTY=4
      - POLICY_FNAME=/data/cfg/botPolicies.yaml
    volumes:
      - ./config/anubis/botPolicies.yaml:/data/cfg/botPolicies.yaml:ro

```

I put `botPolicies.yaml` in `./config/anubis` folder but you can put it wherever you like, just make sure to reflect that inside the `docker-compose.yml`.

Inside it, search for `status_codes` and change them to something else than `200`.

```yaml
# By default, send HTTP 200 back to clients that either get issued a challenge
# or a denial. This seems weird, but this is load-bearing due to the fact that
# the most aggressive scraper bots seem to really, really, want an HTTP 200 and
# will stop sending requests once they get it.
status_codes:
  CHALLENGE: 403
  DENY: 403

```

This part is a bit confusing. With the default `200`, Traefik sees an “authorized” signal, discards Anubis’s challenge page entirely, and forwards straight to application (eg. Immich). No challenge is ever shown to the visitor.

Setting _status\_codes.CHALLENGE/DENY_ to `403` (or any non-2xx) makes Traefik correctly interpret those as “denied,” so it relays Anubis’s actual challenge page/body back to the browser instead of silently passing the request through.

* * *

Furthermore, create `./config/traefik/rules/anubis-static-bypass.yml`

```auto
http:
  routers:
    anubis-static:
      rule: "PathPrefix(`/.within.website/`)"
      service: anubis-static-svc
      priority: 1000 # must beat the web-app's auto-generated router's priority 
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
  services:
    anubis-static-svc:
      loadBalancer:
        servers:
          - url: "http://anubis:8923"

```

Here you can adjust the rule to match host as well but since I plan on applying this to multiple hosts I just match the rule by path.

Example for Immich only:

```auto
rule: "Host(`immich.hhf.technology`) && PathPrefix(`/.within.website/`)"

```

* * *

Finally restart anubis and traefik containers:

```auto
docker compose up -d --force-recreate anubis traefik

```