How to Run Anubis WASM Bot Filter as a Reverse Proxy

Description and use

Deploy Anubis WASM as a reverse proxy to mitigate bots while keeping full control over logs and rollback paths.

Problem

Deploy a self‑hosted WASM bot filter that adds friction to abusive traffic while preserving real user experience, without relying on a third‑party CDN.

Outcome

Anubis successfully filters out abusive traffic while allowing legitimate users, with full control over logs and rollback capability.

Workflow

• 1. Decide placement: edge (Internet→Anubis→app) or internal (Internet→CDN→Anubis→app).
• 2. Ensure Anubis receives real client IP and scheme via X‑Forwarded‑For, X‑Forwarded‑Proto, and Host headers.
• 3. Deploy Anubis with Docker Compose or systemd: expose only localhost, set upstream, configure logging.
• 4. Configure nginx to terminate TLS, forward headers, and proxy to Anubis on 127.0.0.1:8081.
• 5. Test rollout: start with 1% traffic canary for 30 min, then 10% for 2 h, ramp up while monitoring logs and metrics.
• 6. Maintain rollback path: keep a bypass nginx block or point nginx back to the app directly.
• 7. Monitor for false positives and adjust allowlists or challenge difficulty as needed.

Evidence

Anubis (WASM) is a self-hosted bot mitigation reverse proxy that uses a WebAssembly-powered proof-of-work challenge to make large-scale scraping and abusive automation expensive while keeping normal human traffic usable.

Source

The fastest safe pattern is boring (good): nginx terminates TLS, nginx forwards to Anubis over a private Docker network, Anubis forwards to your origin app.

Source