4 ms·

Gitea has a builtin defense against this, `REQUIRE_SIGNIN_VIEW=expensive`, that completely stopped AI traffic issues for me and cut my VPS's bandwidth usage by

by mappu 10mo ago

Gitea has a builtin defense against this, `REQUIRE_SIGNIN_VIEW=expensive`, that completely stopped AI traffic issues for me and cut my VPS's bandwidth usage by 95%.

01HNNWZ0MV43FF 10mo ago
Neat https://docs.gitea.com/administration/config-cheat-sheet#service-service https://docs.gitea.com/administration/config-cheat-sheet#ser... > Enable this to force users to log in to view any page or to use API. It could be set to "expensive" to block anonymous users accessing some pages which consume a lot of resources, for example: block anonymous AI crawlers from accessing repo code pages. The "expensive" mode is experimental and subject to change. Forgejo doesn't seem to have copied that feature yet
greenavocado 10mo ago
Are you the only user of your web-facing Gitea? If so, put it behind Wireguard VPN, and basically never worry about bandwidth and security again.
- fragmede 10mo ago
  So much this. Wireguard is so easy to do and no, the whole world doesn't need access to my shit, just me and a couple of close friends.
- jauntywundrkind 10mo ago
  This is the most assured best way to make sure your remain the only user of your stuff. I highly encourage folks to put stuff out there! Put your stuff on the internet! Even if you don't need it even if you don't think you'll necessarily benefit: leave the door open to possibility!
wiether 10mo ago
I don't understand the purpose of this parameter value? I have `REQUIRE_SIGNIN_VIEW=true` and I see nothing but my own traffic on Gitea's logs. Is it because I'm using a subdomain that doesn't imply there's a Gitea instance behind?
- mappu 10mo ago
  Crawlers will find everything on the internet eventually regardless of subdomain (e.g. from crt.sh logs, or Google finds them from 8.8.8.8 queries). REQUIRE_SIGNIN_VIEW=true means signin is required for all pages - that's great and definitely stops AI bots. The signin page is very cheap for Gitea to render. However, it is a barrier for the regular human visitors to your site. 'expensive' is a middle-ground that lets normal visitors browse and explore repos, view README, and download release binaries. Signin is only required for "expensive" pageloads, such as viewing file content at specific commits git history.
  - wiether 10mo ago
    Thanks for the clarification! From Gitea's doc I was under the impression that it was going further than "true" so I didn't understood why because "true" was enough for me to not be bothered by bots. But in your case you want a middle-ground, which is provided by "expensive"!
  - nextaccountic 10mo ago
    oh.. that's why 8.8.8.8 is free

by mappu 10mo ago

Gitea has a builtin defense against this, `REQUIRE_SIGNIN_VIEW=expensive`, that completely stopped AI traffic issues for me and cut my VPS's bandwidth usage by 95%.

01HNNWZ0MV43FF 10mo ago

Neat https://docs.gitea.com/administration/config-cheat-sheet#service-service https://docs.gitea.com/administration/config-cheat-sheet#ser... > Enable this to force users to log in to view any page or to use API. It could be set to "expensive" to block anonymous users accessing some pages which consume a lot of resources, for example: block anonymous AI crawlers from accessing repo code pages. The "expensive" mode is experimental and subject to change. Forgejo doesn't seem to have copied that feature yet

greenavocado 10mo ago

Are you the only user of your web-facing Gitea? If so, put it behind Wireguard VPN, and basically never worry about bandwidth and security again.

fragmede 10mo ago
So much this. Wireguard is so easy to do and no, the whole world doesn't need access to my shit, just me and a couple of close friends.
jauntywundrkind 10mo ago
This is the most assured best way to make sure your remain the only user of your stuff. I highly encourage folks to put stuff out there! Put your stuff on the internet! Even if you don't need it even if you don't think you'll necessarily benefit: leave the door open to possibility!

wiether 10mo ago

I don't understand the purpose of this parameter value? I have `REQUIRE_SIGNIN_VIEW=true` and I see nothing but my own traffic on Gitea's logs. Is it because I'm using a subdomain that doesn't imply there's a Gitea instance behind?

mappu 10mo ago
Crawlers will find everything on the internet eventually regardless of subdomain (e.g. from crt.sh logs, or Google finds them from 8.8.8.8 queries). REQUIRE_SIGNIN_VIEW=true means signin is required for all pages - that's great and definitely stops AI bots. The signin page is very cheap for Gitea to render. However, it is a barrier for the regular human visitors to your site. 'expensive' is a middle-ground that lets normal visitors browse and explore repos, view README, and download release binaries. Signin is only required for "expensive" pageloads, such as viewing file content at specific commits git history.
- wiether 10mo ago
  Thanks for the clarification! From Gitea's doc I was under the impression that it was going further than "true" so I didn't understood why because "true" was enough for me to not be bothered by bots. But in your case you want a middle-ground, which is provided by "expensive"!
- nextaccountic 10mo ago
  oh.. that's why 8.8.8.8 is free