gnu: Add anubis-ai-firewall.

* gnu/packages/web.scm (anubis-ai-firewall): New variable.
* gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register patches.

Relates-to: guix/guix!2572

3 files changed, 171 insertions, 0 deletions

diff --git a/gnu/local.mk b/gnu/local.mk
index 175028eba06..2728cbc2e87 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1014,6 +1014,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/amd-smi-newer-libdrm.patch               \
   %D%/packages/patches/amd-smi-python.patch                     \
   %D%/packages/patches/angband-remove-nonfree-tile-options.patch        \
+  %D%/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch                       \
   %D%/packages/patches/ibus-anthy-fix-tests.patch               \
   %D%/packages/patches/ibus-table-paths.patch                   \
   %D%/packages/patches/antiword-CVE-2014-8123.patch                     \
diff --git a/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch b/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch
new file mode 100644
index 00000000000..c6bbae2f75f
--- /dev/null
+++ b/gnu/packages/patches/anubis-use-the-browser-native-web-crypto-api.patch
@@ -0,0 +1,60 @@
+From c29172faf8b57450317f6d29ac9ff4c5dfe69d77 Mon Sep 17 00:00:00 2001
+From: Sharlatan Hellseher <sharlatanus@gmail.com>
+Date: Tue, 18 Aug 2026 19:26:53 +0100
+Subject: [PATCH] chore: Use the browser-native Web Crypto API.
+
+Use the browser-native Web Crypto API instead of @aws-crypto/sha256-js.
+
+* lib/challenge/preact/js/app.jsx (useEffect): Switch to browser native hasher.
+* web/js/worker/sha256-purejs.mjs (calculateSHA256): Likewise.
+---
+ lib/challenge/preact/js/app.jsx |  7 +++----
+ web/js/worker/sha256-purejs.mjs | 10 ++++------
+ 2 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/lib/challenge/preact/js/app.jsx b/lib/challenge/preact/js/app.jsx
+index f1321b8..96352b0 100644
+--- a/lib/challenge/preact/js/app.jsx
++++ b/lib/challenge/preact/js/app.jsx
+@@ -1,7 +1,6 @@
+ import { render, h, Fragment } from 'preact';
+ import { useState, useEffect } from 'preact/hooks';
+ import { g, j, u, x } from "./xeact.js";
+-import { Sha256 } from '@aws-crypto/sha256-js';
+ 
+ /** @jsx h */
+ /** @jsxFrag Fragment */
+@@ -24,9 +23,9 @@ const App = () => {
+ 
+   useEffect(() => {
+     setImageURL(state.pensive_url);
+-    const hash = new Sha256('');
+-    hash.update(state.challenge);
+-    setChallenge(toHexString(hash.digestSync()));
++    crypto.subtle
++      .digest("SHA-256", new TextEncoder().encode(state.challenge))
++      .then((buf) => setChallenge(toHexString(new Uint8Array(buf))));
+   }, [state]);
+ 
+   useEffect(() => {
+diff --git a/web/js/worker/sha256-purejs.mjs b/web/js/worker/sha256-purejs.mjs
+index 3211b44..08072c6 100644
+--- a/web/js/worker/sha256-purejs.mjs
++++ b/web/js/worker/sha256-purejs.mjs
+@@ -1,9 +1,7 @@
+-import { Sha256 } from '@aws-crypto/sha256-js';
+-
+-const calculateSHA256 = (text) => {
+-  const hash = new Sha256();
+-  hash.update(text);
+-  return hash.digest();
++const calculateSHA256 = async (text) => {
++  return new Uint8Array(
++    await crypto.subtle.digest("SHA-256",
++                                new TextEncoder().encode(text)));
+ };
+ 
+ function toHexString(arr) {
+-- 
+2.54.0
+
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 369c40606b7..0c2c5b335f9 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -142,6 +142,7 @@
   #:use-module (gnu packages golang-build)
   #:use-module (gnu packages golang-check)
   #:use-module (gnu packages golang-compression)
+  #:use-module (gnu packages golang-crypto)
   #:use-module (gnu packages golang-web)
   #:use-module (gnu packages golang-xyz)
   #:use-module (gnu packages gperf)
@@ -177,6 +178,7 @@
   #:use-module (gnu packages nettle)
   #:use-module (gnu packages networking)
   #:use-module (gnu packages node)
+  #:use-module (gnu packages node-xyz)
   #:use-module (gnu packages nss)
   #:use-module (gnu packages nss)
   #:use-module (gnu packages openldap)
@@ -248,6 +250,114 @@
   #:use-module (ice-9 match)
   #:use-module ((srfi srfi-1) #:select (delete-duplicates)))
 
+(define-public anubis-ai-firewall
+  (package
+    ;; Name clashes with "anubis" in (gnu packages mail).
+    (name "anubis-ai-firewall")
+    (version "1.22.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/TecharoHQ/anubis")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (patches
+        (search-patches "anubis-use-the-browser-native-web-crypto-api.patch"))
+       (sha256
+        (base32 "1vaj78727ndzsxydhdgwr9w0p9ykg73nkrbbiijh5l7lvabh3ric"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      ;; TODO: Enable some of them
+      #:tests? #f
+      ;; TODO: some JS work is required as app.js could not be found
+      #:install-source? #f
+      #:embed-files #~(list ".version"
+                            ".*\\.tmpl"
+                            ".*\\.js"
+                            ".*\\.jsx"
+                            ".*\\.mjs"
+                            ".*\\.sh"
+                            ".*\\.css"
+                            "nodes"
+                            "text"
+                            "children")
+      #:import-path "github.com/TecharoHQ/anubis/cmd/anubis"
+      #:unpack-path "github.com/TecharoHQ/anubis"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'patch-usr-bin-env-shebangs
+            (lambda* (#:key unpack-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" unpack-path)
+                (substitute* (find-files "." "\\.sh$")
+                  (("#!/usr/bin/env bash")
+                   (string-append "#!" (which "bash")))))))
+          (add-after 'patch-usr-bin-env-shebangs 'generate-code
+            (lambda* (#:key unpack-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" unpack-path)
+                (for-each make-file-writable
+                          (find-files "." "(_templ\\.go|_string\\.go)$"))
+                (invoke "templ" "generate")
+                (with-directory-excursion "internal/dnsbl"
+                  (invoke "stringer" "-type=DroneBLResponse")))))
+          (add-after 'generate-code 'make-assets
+            (lambda* (#:key inputs unpack-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" unpack-path)
+                (substitute* "xess/xess.go"
+                  (("if anubis.Version != \"devel\" \\{")
+                   "if false {"))
+                ;; Let esbuild resolve 'preact' and 'preact/hooks'.
+                (setenv "NODE_PATH"
+                        (string-append (assoc-ref inputs "node-preact")
+                                       "/lib/node_modules"))
+                (invoke "./web/build.sh")
+                (invoke "./lib/challenge/preact/build.sh")))))))
+    (native-inputs
+     (list brotli
+           esbuild
+           go-github-com-a-h-templ
+           go-github-com-cespare-xxhash-v2
+           go-github-com-facebookgo-flagenv
+           go-github-com-gaissmai-bart
+           go-github-com-golang-jwt-jwt-v5
+           go-github-com-google-cel-go
+           go-github-com-google-uuid
+           go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus
+           go-github-com-grpc-ecosystem-go-grpc-middleware-v2
+           go-github-com-joho-godotenv
+           go-github-com-lum8rjack-go-ja4h
+           go-github-com-nicksnyder-go-i18n-v2
+           go-github-com-prometheus-client-golang
+           go-github-com-redis-go-redis-v9
+           go-github-com-sebest-xff
+           go-github-com-shirou-gopsutil-v4
+           go-github-com-techarohq-thoth-proto
+           go-go-etcd-io-bbolt
+           go-golang-org-x-net
+           go-golang-org-x-text
+           go-google-golang-org-grpc
+           go-gopkg-in-yaml-v3
+           go-k8s-io-apimachinery
+           go-sigs-k8s-io-yaml
+           go-tools
+           gzip
+           node-preact
+           templ
+           zstd))
+    (home-page "https://github.com/TecharoHQ/anubis")
+    (synopsis "Weighs the soul of incoming HTTP requests to stop AI crawlers")
+    (description
+     "Anubis is a Web AI Firewall Utility that weighs the soul of your
+connection using one or more challenges in order to protect upstream resources
+from scraper bots.
+
+This program is designed to help protect the small internet from the endless
+storm of requests that flood in from AI companies. Anubis is as lightweight as
+possible to ensure that everyone can afford to protect the communities closest
+to them.")
+    (license license:expat)))
+
 (define-public qhttp
   (package
     (name "qhttp")