top | item 46242581

(no title)

mappu | 2 months ago

Gitea has a builtin defense against this, `REQUIRE_SIGNIN_VIEW=expensive`, that completely stopped AI traffic issues for me and cut my VPS's bandwidth usage by 95%.

discuss

order

greenavocado|2 months ago

Are you the only user of your web-facing Gitea? If so, put it behind Wireguard VPN, and basically never worry about bandwidth and security again.

jauntywundrkind|2 months ago

This is the most assured best way to make sure your remain the only user of your stuff.

I highly encourage folks to put stuff out there! Put your stuff on the internet! Even if you don't need it even if you don't think you'll necessarily benefit: leave the door open to possibility!

fragmede|2 months ago

So much this. Wireguard is so easy to do and no, the whole world doesn't need access to my shit, just me and a couple of close friends.

wiether|2 months ago

I don't understand the purpose of this parameter value?

I have `REQUIRE_SIGNIN_VIEW=true` and I see nothing but my own traffic on Gitea's logs.

Is it because I'm using a subdomain that doesn't imply there's a Gitea instance behind?

mappu|2 months ago

Crawlers will find everything on the internet eventually regardless of subdomain (e.g. from crt.sh logs, or Google finds them from 8.8.8.8 queries).

REQUIRE_SIGNIN_VIEW=true means signin is required for all pages - that's great and definitely stops AI bots. The signin page is very cheap for Gitea to render. However, it is a barrier for the regular human visitors to your site.

'expensive' is a middle-ground that lets normal visitors browse and explore repos, view README, and download release binaries. Signin is only required for "expensive" pageloads, such as viewing file content at specific commits git history.

01HNNWZ0MV43FF|2 months ago

Neat https://docs.gitea.com/administration/config-cheat-sheet#ser...

> Enable this to force users to log in to view any page or to use API. It could be set to "expensive" to block anonymous users accessing some pages which consume a lot of resources, for example: block anonymous AI crawlers from accessing repo code pages. The "expensive" mode is experimental and subject to change.

Forgejo doesn't seem to have copied that feature yet