From 9e0415e4d0dc517f85b11e8548947a05ab6b0e23 Mon Sep 17 00:00:00 2001
From: Karan Parashar <whyredfire@gmail.com>
Date: Tue, 18 Aug 2026 00:05:19 +0530
Subject: [PATCH] feat: Add anubis operator and wire it for stirling-pdf

---
 applications/add-ons/anubis-operator.yaml     | 26 ++++++++++
 applications/kustomization.yaml               |  1 +
 .../stirling-pdf/anubis-key-sealedsecret.yaml | 12 +++++
 .../services/stirling-pdf/anubis-proxy.yaml   | 50 +++++++++++++++++++
 extras/services/stirling-pdf/httproute.yaml   |  4 +-
 5 files changed, 91 insertions(+), 2 deletions(-)
 create mode 100644 applications/add-ons/anubis-operator.yaml
 create mode 100644 extras/services/stirling-pdf/anubis-key-sealedsecret.yaml
 create mode 100644 extras/services/stirling-pdf/anubis-proxy.yaml

diff --git a/applications/add-ons/anubis-operator.yaml b/applications/add-ons/anubis-operator.yaml
new file mode 100644
index 0000000..5f575d6
--- /dev/null
+++ b/applications/add-ons/anubis-operator.yaml
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: anubis-operator
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
+    targetRevision: v0.4.4
+    path: config/default
+    kustomize:
+      images:
+        - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: anubis-operator-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
diff --git a/applications/kustomization.yaml b/applications/kustomization.yaml
index 3cf0d64..8bd92a6 100644
--- a/applications/kustomization.yaml
+++ b/applications/kustomization.yaml
@@ -5,6 +5,7 @@ resources:
   - add-ons/gateway-api.yaml
   - add-ons/traefik.yaml
   - add-ons/cert-manager.yaml
+  - add-ons/anubis-operator.yaml
   - add-ons/sealed-secrets.yaml
   - add-ons/cnpg.yaml
   # services
diff --git a/extras/services/stirling-pdf/anubis-key-sealedsecret.yaml b/extras/services/stirling-pdf/anubis-key-sealedsecret.yaml
new file mode 100644
index 0000000..47cb094
--- /dev/null
+++ b/extras/services/stirling-pdf/anubis-key-sealedsecret.yaml
@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: stirling-pdf
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgA81eNBpnSj7I5hSRoZxhU+d3+7u8xM93SzO0eNbMJ448rgvDG+MHzmmLgIxXlE2Sf7OS98+Xwi29eePt9+EiMrhWV5tqgy+gKAFYq1SEEe9tkMn5Ie/rdBgAfdwgnerg2kjLLeRnqeJOaqrHXXcMuxUFM7nc0DwqHe5dLPqVysJGQy4dGzBo+QxvYJuQ7TPtDXEGdE41AchPcR/2UfV7dGH8pqldqlFSJlb0M4rj/2XvinHWEKzPb8mXOHQ+aaENgm4NHTMJ6wjFX1VrO+MAQ7Ktm4ttcF4U/7PMwpMjBF+MaPmdGhFxnENOTvLhV/qcHw3qEDzsEFCosbMAJ4UxqXi0DwdqHYdfsp6bus0xL7RLrQxQw0SQmSYL0Cy+S78/3uk4EhBthvfi/VcJw536WvxZZrzhVp1ItRn9nUWI/oh1iNHAlyXQbMkmWIGIDC8iXtvE0DVWa8Ui16X14dPAZg7z1BAbjPZ+oi1MjcO4kuqVoDknkrBJxMEMYTxtQ8nbqDsKbTA9kNLo0JCmHOiP9l3/4f6hVw/B8uB5O6O2Vionz5U0AsnrunLMNvfeYleaS9290m+msg6T/umr7BgrVNXUEkG3GfJZ3xt8urHNjwXb/ESG5T5JnPYIRdTcITLuzLSKul5lBL+4PT3zOdjt9G/XD6HootT+AN9DuvfebM08RtMIK1mpI3Gx2owcKHxICIdgV/oaIGpe1q0L21jDp5sd30wm/3rfr6eKq1zuDiObA6N6EHI/7224Xw0sUuN2GmnRJ6RA5BQSXwSdeGqdG3
+  template:
+    metadata:
+      name: anubis-key
+      namespace: stirling-pdf
diff --git a/extras/services/stirling-pdf/anubis-proxy.yaml b/extras/services/stirling-pdf/anubis-proxy.yaml
new file mode 100644
index 0000000..bbdb399
--- /dev/null
+++ b/extras/services/stirling-pdf/anubis-proxy.yaml
@@ -0,0 +1,50 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  name: anubis
+  namespace: stirling-pdf
+spec:
+  target:
+    service:
+      name: stirling-pdf
+      port: 8080
+  anubis:
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    persistence:
+      enabled: false
+    metrics:
+      enabled: false
+    envExtra:
+      - name: DIFFICULTY
+        value: "4"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: OG_PASSTHROUGH
+        value: "true"
+      - name: OG_EXPIRY_TIME
+        value: 24h
+      - name: COOKIE_DOMAIN
+        value: pdf.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: pdf.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+      - name: SLOG_LEVEL
+        value: INFO
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  networkPolicy:
+    enabled: true
diff --git a/extras/services/stirling-pdf/httproute.yaml b/extras/services/stirling-pdf/httproute.yaml
index 29b21ab..f9f0d0e 100644
--- a/extras/services/stirling-pdf/httproute.yaml
+++ b/extras/services/stirling-pdf/httproute.yaml
@@ -19,6 +19,6 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: stirling-pdf
-          port: 8080
+        - name: anubis
+          port: 80