anubis has a -policy-fname flag pointing a policy JSON file where you can allow various URLs to pass through. See the service file and the JSON snippets at https://blueslugs.com/2025/03/27/deploying-anubis-on-nginx/ in practice for a RSS feed.

Sadly, anubis' doc is not very straightforward in this regard. Probably because Xe wanted to protect a proxied git forge, not a blog

Actually for a very small, minimalist site, Anubis means extra bandwidth, so pick your poison. As stated in the project README on Github, in most cases you don't need it.