From e10bdbca0b5c3a790df596249118ac3b6e7631a5 Mon Sep 17 00:00:00 2001
From: Henry-Hiles <henry@henryhiles.com>
Date: Tue, 18 Aug 2026 17:24:44 -0400
Subject: [PATCH] block certain paths unauthed

---
 clients/quadraticserver/forgejo.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/clients/quadraticserver/forgejo.nix b/clients/quadraticserver/forgejo.nix
index 6b14701..f5307a8 100644
--- a/clients/quadraticserver/forgejo.nix
+++ b/clients/quadraticserver/forgejo.nix
@@ -48,15 +48,16 @@
         };
       };
 
+      # We may want to include regular commits, e.g. https://git.federated.nexus/Henry-Hiles/nixos/commit/21373eed250ba70ff195258d3b5a4fe039f72779, but currently this doesn't seem needed
       caddy.virtualHosts."${domain}".extraConfig = ''
         respond /robots.txt <<EOF
           User-agent: *
-          Disallow: /*/*/*/commit
+          Disallow: /*/*/*/commit*
           EOF 200
 
         @commitAnonymous {
-          path /*/*/src/commit*
-          not header_regexp Cookie "(^|;\s*)session=[^;]+(?:;|$)"
+          path_regexp commit ^/[^/]+/[^/]+/[^/]+/commit(?:/.*)?$
+          not header_regexp Cookie "(^|;[[:space:]]*)session=[^;]+(;|$)"
         }
 
         redir @commitAnonymous /user/login?redirect_to={uri} 302