Since my cgit instance has been getting hammered by botnets for a while now, I've decided put a little more effort into my blocking strategy.
In practice this meant putting a JS proof-of-work challenge on the site as these less unobtrusive than traditional CAPTCHAs and seem difficult to solve in bulk. I also wanted
* Support for users who block cookies
* Something I could easily integrate into my existing configuration
* Something simple, I need it to do one thing well
I looked at a few existing solutions but wasn't satisfied (and admittedly I wanted an excuse to make something with Nginx), so I made my own!
Source: https://github.com/markozajc/shapow
Demo: https://zajc.tel/shapow-demo-diff25 (you stay whitelisted for 5s)
Demo with a more reasonable difficulty: https://zajc.tel/shapow-demo
Binaries are only available for Debian stable amd64, and I've also uploaded an AUR package. Build instructions for others are in the README.
