Is it possible to set Accept and User-agent here?

(example: https://github.com/fedora-eln/content-resolver/pull/100 )
Looks like uri module should take 'http_agent' and 'headers' to set this?

Failing that, is there any way to identify this traffic? from a specific ip/network, with specific headers?

For zuul it probably doesn't make a difference ig we go ahead with the migration to packit fedora-ci. But other api users would be similarly impacted and was wondering if there are other ways to work around genuine api calls either authenticated or not

Well, I think the first thing any api / automated client can do is set agent and accept. Many other clients have done so and then anubis leaves them alone. I know it's bad to scale that way (forcing many clients to adjust to one server change), but I think it's the most sustainable path.

Failing that, we can configure the anubis policy, but we need something(s) to distinguish this client from all the other clients. That could be a user agent, it could be a specific header that this client sets, it could be a ip range we know this client comes from.

Last resort we can allowlist specific files/paths. If this is really just the api, we could allowlist /api/*, but... that makes us more open to abuse again, so I would prefer to keep that as a last resort.

Shall we keep this open? Can you adjust zuul? or just wait for packit....

We can close this. I have made the adjustments in Zuul and it worked. I guess anyone else affected would have to adapt as well.