copr-anubis: allow copr-related user agents to pass without challenge

inventory/group_vars/copr_dist_git_dev_aws

@@ -1,6 +1,9 @@
 ---
 copr_machine_type: distgit
 
+# Enable verbose Anubis logging for debugging
+anubis_debug: true
+
 devel: true
 freezes: false
 # consumed by roles/copr/certbot

inventory/group_vars/copr_front_dev_aws

@@ -1,6 +1,9 @@
 ---
 copr_machine_type: frontend
 
+# Enable verbose Anubis logging for debugging
+anubis_debug: true
+
 allowlist_emails:
   - msuchy@redhat.com
   - praiskup@redhat.com

roles/anubis/templates/default.env.j2

@@ -15,3 +15,9 @@ POLICY_FNAME=/etc/anubis/policies.yaml
 # https://anubis.techaro.lol/docs/admin/installation#using-base-prefix
 BASE_PREFIX={{ anubis_base_prefix }}
 {% endif %}
+{% if anubis_debug is defined %}
+
+# Debug logging - shows all requests, evaluations, and detailed diagnostics
+# https://anubis.techaro.lol/docs/admin/installation
+SLOG_LEVEL=DEBUG
+{% endif %}

roles/anubis/templates/policies.yaml.j2.copr-infrastructure

@@ -1,5 +1,17 @@
 ---
 bots:
+  # Trusted services
+
+  # Copr ecosystem tools - CLI, Python library, tests, internal services
+  # Format: copr <package>/<version>
+  - name: allow-copr-tools
+    action: ALLOW
+    user_agent_regex: ^copr
+
+  - name: allow-packit
+    action: ALLOW
+    user_agent_regex: packit.dev/packit
+
 {% if copr_machine_type == "frontend" %}
   # Machine/API endpoints - ALLOW without challenge
   # These are used by dnf, copr-cli, webhooks, and internal services
@@ -56,14 +68,6 @@ bots:
     action: ALLOW
     path_regex: /chroot/[^/]+/comps/$
 
-  # Trusted services - ALLOW by user-agent
-
-  # Packit - automated upstream/downstream sync
-  # https://packit.dev
-  - name: allow-packit
-    action: ALLOW
-    user_agent_regex: packit.dev/packit
-
   # Web UI endpoints - protected (browsers get challenged)
   # /coprs, /admin, /status, /recent, /explore, /batches, /groups, /user
   # These are handled by default-config