#dev 2024-08-08
2024-08-08 UTC
box4641, bret, beanbrain, AramZS, [Adam_Wier], jjuran, ttybitnik, GuestZero and barnaby joined the channel
# 
beanbrain i've been trying to use rsync to push my site build to my server, and i'm really confused about how to do it securely. can i have some help?
# beanbrain it's confusing, because i have disallowed ssh-ing into root, which has the permissions to modify my files in the site directory, /usr/local/www
# beanbrain the site directory itself is owned by a user www, but that is not a login user, also for security,
# beanbrain ssh and rsync are both allowed through pf
# beanbrain ah -- it's a freebsd server
# beanbrain i can't seem to understand rsyncd for the life of me
# beanbrain when i set up a module, i can't see it listed with `rsync rsync://mysite::
[jacky] and rjomara5857 joined the channel
# ptramo[d] rsync:// is the insecure protocol, only usable to pull
# ptramo[d] You will need ssh to push as it's the only transport that allows secure authentication
# ptramo[d] You'll want a user that can run the rsync command over ssh, read and modify the files
# beanbrain thanks ptramo[d]
# beanbrain i was talking with a friend, and they suggested a ci/cd pipeline for this
# ptramo[d] Sure thing 🙂 one fewer daemon, yay
# ptramo[d] How do they suggest the files land on the server?
# beanbrain cause the user that receives the rsync on the server should be (and is) an underprivileged user
# beanbrain they suggested ansible or something similar, but that's almost 800 MiB i don't need
# ptramo[d] What's the problem you're trying to solve? 🙂
# ptramo[d] Ansible is more configuration management, and typically runs privileged
# beanbrain i just need to push the site i build locally to the directory it's served from
# ptramo[d] Ok, so on the host that serves the files, there will be a unix user that can write those files
# ptramo[d] Either it'll pull from somewhere or get pushed to, and then it'll write the files
# ptramo[d] rsync and git are both viable ways to pull or push
# beanbrain yeah, i think what i may end up doing is writing some code to run as a daemon and verify the files i push into the unprivileged ssh user's homedir
# beanbrain then if they pass push them into the site dir
# ptramo[d] Both need to be secured, typically via ssh
# beanbrain but i'll have to sort it after i come back from work tomorrow
# ptramo[d] That seems like a layer of indirection you don't need. I don't see how that's more secure than writing the files directly
# beanbrain well i wouldn't be ssh-ing in as root, that's why
# ptramo[d] You should never ssh as root, but you also shouldn't need root to write to a directory served by your web server
# beanbrain the site dir is owned by a user www, but that's not a login user
# beanbrain should i give www the perms to login and ssh?
# ptramo[d] If that's the user running your http server then no
# ptramo[d] Make a new user for writes, make its default group www, and have the files group-readable?
# beanbrain so the login user tim is the only one that has ssh
# beanbrain eh -- i have to go to work now anyway
# beanbrain what is it with ah and eh ??
# beanbrain eh ++
# ptramo[d] Its minus minus and plus plus
# ptramo[d] They're a way to give and take points of karma
# beanbrain oh -- i thought it was the user
# beanbrain oh ++
# beanbrain nvm i have no more time lol
# beanbrain thanks for your help!
# beanbrain i'll be back tomorrow
# ptramo[d] happy to keep the discussion going whenever
# beanbrain thank you
gRegor, GuestZero and jeremycherfas joined the channel
# donthatedontkill Hello, all. I normally folllow with slack on work but posting from discord.
# donthatedontkill I have a question that surely other people have dealt with and would have some input.
# donthatedontkill I currently have my site as a github repo that Netlify deploys when it sees pushes. This is obviously fine for text and I want to start publishing photos to my site. With a github profile, as I understand, this would bloat the size, even if I delete old pictures, so my question is : Is anyone else using a github repo/netlify combo? If you post pictures, what did you use a solution for hosting the pictures?
# IWDiscord <donthatedontkill>
# IWDiscord <donthatedontkill>
# donthatedontkill My first thoughts are a google drive kind of situation that they'd link to, but I wanted to see if anyone else had solutions that didn't involve having my content hosted at google, microsoft, etc. Probably too big of an ask but before I settled, I wanted to exhaust my options. Thanks for any hints/ideas/suggestions you might have!
# catgirlin.space git lfs maybe?
# 
Loqi Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server https://indieweb.org/git_lfs
# donthatedontkill catgirlin_space0[d]: Yeah, I had seen that. I've never used it though. I see myself posting a decent amount of photos and even with better management, having some issues with repo size but maybe I should just consider that a "deal with it when we get there" kind of problem
# donthatedontkill Thanks for the nudge!
# [snarfed] this has come up before, we should document it on https://indieweb.org/GitHub or nearby
# donthatedontkill [snarfed]: Okay so basically I'm making a bit of a mountain out of a mole hill with his?
# [snarfed] eg my site has ~1300 image files in https://github.com/snarfed/snarfed.org and it's fine
# donthatedontkill [snarfed]: Okay, then in that case, I'll just not worry too much about it.
# donthatedontkill [snarfed]: Haha Okay this is ver reassuring
# donthatedontkill *very
# donthatedontkill Rosalina Saige (catgirlin.space)++
# donthatedontkill Adam_Wier[d]: I tried to do the karma thing but I guess I didn"t quite understand how it worked
# donthatedontkill [snarfed]++
# donthatedontkill Rosalina++
# donthatedontkill In any case, thanks for your help, both of you
# donthatedontkill By the way I second a blog post or addition to the wiki. I looked at the phot page on the wiki before coming here. It seemed the natural place to look (I never though to check the github page) For whatever that's worth
# donthatedontkill jimw: Yeah, that's what started this whole thing for me :/
[jamietanna] joined the channel
# 
[jamietanna] Anyone seen issues with Bridgy Fed not loading OK? https://fed.brid.gy/web/www.jvt.me shows "page isn't redirecting correctly" in Firefox 🤔
# [jamietanna] Looking at my feed in IndiePass, I can't see any updates since Tuesday so may have been bust since then?
# 
capjamesg[d] I see the same in Firefox.
ttybitnik joined the channel
# [jamietanna] On Monday I did a site redesign, not sure if that may have messed anything up? Didn't do anything structural though, only CSS 🤔
# [jamietanna] Seem to see a similar issue in Chrome too
# [jamietanna] More on https://github.com/snarfed/bridgy-fed/issues/1244 (to avoid polluting chat)
# [snarfed] whee, the http://www.jvt.me special case strikes again. sorry [jamietanna]! will fix
# [jamietanna] Haha it's fun being the special case to keep you on your toes 😂 ta!
# catgirlin.space curious like, does anyone know of any other websites using rel-sweetheart? found it the other day (i forget how…) and i keep thinking abt it lol https://microformats.org/wiki/rel-sweetheart
# catgirlin.space [edit] curious like, does anyone know of any other websites using rel-sweetheart? found it the other day (i forget how…) and i keep thinking abt it lol https://microformats.org/wiki/rel-sweetheart