> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/TecharoHq/Anubis/llms.txt
> Use this file to discover all available pages before exploring further.

# lib.Options

> Configuration options for initializing the Anubis middleware

## Overview

The `lib.Options` struct contains configuration parameters for initializing an Anubis server instance. These options control middleware behavior, security settings, cookie configuration, and integration with upstream services.

## Type Definition

```go theme={null}
type Options struct {
    Next                     http.Handler
    Policy                   *policy.ParsedConfig
    Target                   string
    TargetHost               string
    TargetSNI                string
    TargetInsecureSkipVerify bool
    CookieDynamicDomain      bool
    CookieDomain             string
    CookieExpiration         time.Duration
    CookiePartitioned        bool
    BasePrefix               string
    WebmasterEmail           string
    RedirectDomains          []string
    ED25519PrivateKey        ed25519.PrivateKey
    HS512Secret              []byte
    StripBasePrefix          bool
    OpenGraph                config.OpenGraph
    ServeRobotsTXT           bool
    CookieSecure             bool
    CookieSameSite           http.SameSite
    Logger                   *slog.Logger
    LogLevel                 string
    PublicUrl                string
    JWTRestrictionHeader     string
    DifficultyInJWT          bool
}
```

## Fields

<ParamField path="Next" type="http.Handler">
  HTTP handler to call after successful bot protection validation. This is typically your application's main handler.
</ParamField>

<ParamField path="Policy" type="*policy.ParsedConfig" required>
  Parsed bot policy configuration containing bot rules, thresholds, and challenge settings.
</ParamField>

<ParamField path="Target" type="string">
  Target URL for reverse proxy mode. When set, Anubis acts as a reverse proxy to this upstream server.
</ParamField>

<ParamField path="TargetHost" type="string">
  Override the Host header when proxying requests to the target.
</ParamField>

<ParamField path="TargetSNI" type="string">
  SNI (Server Name Indication) value to use when connecting to the target over TLS.
</ParamField>

<ParamField path="TargetInsecureSkipVerify" type="bool" default="false">
  Skip TLS certificate verification when connecting to the target. Only use in development environments.
</ParamField>

<ParamField path="CookieDynamicDomain" type="bool" default="false">
  Enable dynamic cookie domain based on the request hostname.
</ParamField>

<ParamField path="CookieDomain" type="string">
  Domain attribute for authentication cookies. If empty, cookies are scoped to the current domain.
</ParamField>

<ParamField path="CookieExpiration" type="time.Duration" default="24h">
  Duration until authentication cookies expire.
</ParamField>

<ParamField path="CookiePartitioned" type="bool" default="false">
  Enable partitioned cookies (CHIPS) for improved privacy in third-party contexts.
</ParamField>

<ParamField path="BasePrefix" type="string" default="/">
  URL path prefix for all Anubis endpoints. Useful when mounting Anubis under a specific path.
</ParamField>

<ParamField path="WebmasterEmail" type="string">
  Contact email address displayed to users who are blocked or challenged.
</ParamField>

<ParamField path="RedirectDomains" type="[]string">
  List of allowed domains for redirect validation to prevent open redirect vulnerabilities.
</ParamField>

<ParamField path="ED25519PrivateKey" type="ed25519.PrivateKey">
  Ed25519 private key for signing JWTs. Auto-generated if both this and HS512Secret are nil.
</ParamField>

<ParamField path="HS512Secret" type="[]byte">
  HMAC-SHA512 secret for signing JWTs. Used instead of ED25519PrivateKey when set.
</ParamField>

<ParamField path="StripBasePrefix" type="bool" default="false">
  Remove the BasePrefix from requests before proxying to the target.
</ParamField>

<ParamField path="OpenGraph" type="config.OpenGraph">
  OpenGraph tag configuration for customizing social media previews.
</ParamField>

<ParamField path="ServeRobotsTXT" type="bool" default="false">
  Serve a robots.txt file at `/robots.txt` and `/.well-known/robots.txt`.
</ParamField>

<ParamField path="CookieSecure" type="bool" default="true">
  Set the Secure flag on authentication cookies, requiring HTTPS.
</ParamField>

<ParamField path="CookieSameSite" type="http.SameSite" default="http.SameSiteLaxMode">
  SameSite attribute for authentication cookies. Valid values: `http.SameSiteDefaultMode`, `http.SameSiteLaxMode`, `http.SameSiteStrictMode`, `http.SameSiteNoneMode`.
</ParamField>

<ParamField path="Logger" type="*slog.Logger">
  Structured logger instance. If nil, a default logger is created with subsystem="anubis".
</ParamField>

<ParamField path="LogLevel" type="string" default="info">
  Logging level. Valid values: `debug`, `info`, `warn`, `error`.
</ParamField>

<ParamField path="PublicUrl" type="string">
  Public-facing URL of the Anubis service. Used for generating absolute URLs in responses.
</ParamField>

<ParamField path="JWTRestrictionHeader" type="string">
  HTTP header name to check for JWT-based restrictions. When set, enables header-based authentication.
</ParamField>

<ParamField path="DifficultyInJWT" type="bool" default="false">
  Include challenge difficulty in JWT claims for verification.
</ParamField>

## Related Types

* [config.OpenGraph](/api/config/store-config#opengraph) - OpenGraph configuration
* [policy.ParsedConfig](/api/policy) - Parsed policy configuration

## Example

```go theme={null}
import (
    "crypto/ed25519"
    "log/slog"
    "net/http"
    "time"

    "github.com/TecharoHQ/anubis/lib"
)

func main() {
    policy, err := lib.LoadPoliciesOrDefault(ctx, "policy.yaml", 20, "info")
    if err != nil {
        panic(err)
    }

    opts := lib.Options{
        Next:             yourAppHandler,
        Policy:           policy,
        CookieExpiration: 24 * time.Hour,
        CookieSecure:     true,
        CookieSameSite:   http.SameSiteLaxMode,
        Logger:           slog.Default(),
        LogLevel:         "info",
        ServeRobotsTXT:   true,
    }

    server, err := lib.New(opts)
    if err != nil {
        panic(err)
    }

    http.ListenAndServe(":8080", server)
}
```