Getting a phpBB site running with Anubis and Apache on Debian

06 Sep 2026

This assumes phpBB is already installed and working. There are numerous guides online for that.

I specifically wanted a guide for getting Anubis working, and I hit a few goofy roadblocks due to the documentation not being entirely consistent + I was a little sleepy. So, for my own sake and maybe that of anyone else, here are the things that need to exist.

Partly cribbed from bloovis.com’s guide.

Installation

Get the files from the latest release on Github. Select anubis_[version].0_amd64.deb from the list. Save to your home directory or wherever. From that directory, install via apt:

 sudo apt install ./anubis-$VERSION-$ARCH.deb

You might get an error like “Notice: Download is performed unsandboxed as root as file ‘/home/user/anubis_1.27.0_amd64.deb’ couldn’t be accessed by user ‘_apt’. - pkgAcquire::Run (13: Permission denied)” but this doesn’t seem to matter.

Once installed, copy the default config file and name it something specific for your use.

 sudo cp /etc/anubus/default.env /etc/anubis/apache.env

And also copy the default botPolicies file to a new one:

 sudo cp /usr/share/doc/anubis/botPolicies.yaml /etc/anubis/apache.botPolicies.yaml

Env setup

First, make a private key hex and copy the output.

 openssl rand -hex 32

In your favorite text editor, open /etc/anubis/apache.env and make the following modifications:

 BIND=localhost:8082
 BIND_NETWORK=tcp
 DIFFICULTY=4
 POLICY_FNAME=/etc/anubis/apache.botPolicies.yaml
 TARGET=http://localhost:3001
 SERVE_ROBOTS_TXT=0
 ED25519_PRIVATE_KEY_HEX=[hex you copied from the step above. remove these brackets]

In this example, Anubis is listening on port 8082 and will forward http requests to 3001. If you have other services running on these ports, just pick some other ones. Be sure to leave the target as http, not https.

BotPolicy setup

The default botPolicies file you copied over will probably work fine out of the box. Additional modifications can be made, and the in-line documentation is pretty helpful in addition to Anubis’s web docs.

Create a systemd service to make start/stop easy

Create /etc/systemd/system/anubis.service and edit it to:

 [Unit]
 Description="Anubis HTTP defense proxy"

 [Service]
 ExecStart=/usr/bin/anubis
 Restart=always
 RestartSec=30s
 EnvironmentFile=/etc/anubis/apache.env
 LimitNOFILE=infinity
 DynamicUser=yes
 CacheDirectory=anubis/hks3
 CacheDirectoryMode=0755
 StateDirectory=anubis/hks3
 StateDirectoryMode=0755
 ReadWritePaths=/run

 [Install]
 WantedBy=multi-user.target

Now run

 sudo systemctl daemon-reload
 sudo systemctl enable anubis
 sudo systemctl start anubis
 sudo systemctl status anubis

Apache

Assumptions:

Your website is at yourcoolsite.com
Your site is not 100% ipv4 (and can therefore handle ipv6 routing)
You have already set up LetsEncrypt (certbot) SSL certs (if not, please do that)
You want www.yourcoolsite.com to redirect to yourcoolsite.com without the www
You have the following Apache modules installed and enabled:
- remoteip
- headers
- proxy
- proxy http
- proxy_uwsgi

Notes:

phpBB relies on the .htaccess file in /var/www/html or whatever your main site folder is. You must be sure to include the Directory block with “AllowOverride All” or Apache will ignore the .htaccess file, and then a bunch of mysterious events will occur when using your forum.
You can see the listening and forwarding ports you created above (8082 and 3001 in this example) within these blocks. If you’re using different ports, be sure to update them.
LetsEncrypt will often take a base http/80 site and make a second copy of it in /etc/apache2/sites-available, called e.g. yourcoolsite-ssl.conf, which uses port 443 and has all of the certificate info in it. This single block will handle the old original yourcoolsite.conf, yourcoolsite-ssl.conf, and Anubis forwarding.
- Disable one of the existing ones, e.g. sudo a2dissite yourcoolwebsite-ssl.conf and modify the remaining one with this entire block.

Edit your virtual host (e.g. yourcoolsite.conf)

 # Plain HTTP redirect to HTTPS
 <VirtualHost *:80>
      ServerAdmin webmaster@yourcoolsite.com
      ServerName yourcoolsite.com
      ServerAlias www.yourcoolsite.com
      DocumentRoot /var/www/html/
      ErrorLog /var/log/apache2/yourcoolsite.com_error.log
      CustomLog /var/log/apache2/yourcoolsite.com_access.log combined
      RewriteEngine on
      RewriteCond %{SERVER_NAME} =yourcoolsite.com
      RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
      <Directory /var/www/html>
                Options FollowSymlinks
                AllowOverride All
                Require all granted
      </Directory>
      </VirtualHost>


 # HTTPS listener that forwards to Anubis
 <IfModule mod_proxy.c>
 <VirtualHost *:443>
      ServerAdmin webmaster@yourcoolsite.com
      ServerName yourcoolsite.com
      ServerAlias www.yourcoolsite.com
      DocumentRoot /var/www/html/
      ErrorLog /var/log/apache2/yourcoolsite.com_error.log
      CustomLog /var/log/apache2/yourcoolsite.com_access.log combined
      <Directory /var/www/html>
                Options FollowSymlinks
                AllowOverride All
                Require all granted
      </Directory>

      SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
      SSLCertificateFile /etc/letsencrypt/live/yourcoolsite.com/fullchain.pem
      SSLCertificateKeyFile /etc/letsencrypt/live/yourcoolsite.com/privkey.pem
      Include /etc/letsencrypt/options-ssl-apache.conf

      # These headers need to be set or else Anubis will
      # throw an "admin misconfiguration" error.
      RequestHeader set "X-Real-IP" expr=%{REMOTE_ADDR}
      RequestHeader set X-Forwarded-Proto "https"
      RequestHeader set "X-Http-Version" "%{SERVER_PROTOCOL}s"
      RequestHeader set "X-TLS-SNI-Name" "%{SSL_TLS_SNI}s"

      ProxyPreserveHost On

      ProxyRequests Off
      ProxyVia Off

      # Replace 9000 with the port Anubis listens on
      ProxyPass / http://localhost:8082/
      ProxyPassReverse / http://localhost:8082/
 </VirtualHost>
 </IfModule>

 # Actual website config
 <VirtualHost *:3001>
      ServerAdmin webmaster@yourcoolsite.com
      ServerName yourcoolsite.com
      ServerAlias www.yourcoolsite.com
      DocumentRoot /var/www/html/
      ErrorLog /var/log/apache2/yourcoolsite.com_error.log
      CustomLog /var/log/apache2/yourcoolsite.com_access.log combined
      <Directory /var/www/html>
                Options FollowSymlinks
                AllowOverride All
                Require all granted
      </Directory>

      # Pass the remote IP to the proxied application instead of 127.0.0.1
      # This requires mod_remoteip
      RemoteIPHeader X-Real-IP
      RemoteIPTrustedProxy 127.0.0.1/32
 </VirtualHost>

Tell Apache to listen on your chosen port

In /etc/apache2/conf-available, create listener-3001.conf with the contents:

 Listen [::1]:3001

And enable that with sudo a2enconf listener-3001.conf.

Go live

Reload Apache config

 sudo systemctl reload apache2

And you should be good to go.

raeokay