Levente is right, we need to get the new website set up under a webteam id, that only has access to what it needs for the website. Chris C., yourself, and Timothy (if he wants), and I'm interested too, added as group members.
This would take care of the immediate security need, as well as distribute some of the burden currently concentrated on Chris C.
Chris C., is this something you would like to handle or would you prefer someone else do it?
On Fri, Mar 28, 2014 at 10:50 PM, Levente Uzonyi leves@elte.hu wrote:
On Thu, 20 Mar 2014, Levente Uzonyi wrote:
On Thu, 20 Mar 2014, Chris Cunnington wrote:
locator at: (ALPath / 'favicon.ico') put: (ALFileResource on: (FSLocator imageDirectory / 'squeakfavicon.ico') resolve)
This code is in the current squeak.org image for the favicon, which is a file in the imageDirectory. The simplest thing is for Altitude to be fed a path to wherever Levente wants to put the files for the homepage. The files currently served from my webpage could then be dropped into that directory. Then I can change the absolute references to my site to the disk from:
html footer: [ html img src: 'http://www.chriscunnington.com/poweredsqueak.png'].
to something like:
html footer: [ html img src: (ALPath / 'poweredbysqueak.png') ].
That is if the image will handle it's own files. If we are separating static and dynamic requests in nginx for speed and such, then I think I need to change the links to something in Altitude like:
html footer: [ html img src: '/img/foo.jpg' ].
with a locator like:
locator at: (ALPath / 'img' / 'foo.jpg') put: (ALFileResource on: FSReference * 'img' / 'foo.jpg')
where nginx sees the token /img/ and sends the request to wherever the static files are served from.
The goal is to let nginx serve the static files, and let the browsers and proxies cache them forever.
I wanted to use a separate subdomain (or a set of subdomains) for the static files, but it's easier for now to use a path prefix with the following pattern:
/static/*/...
Where * is the version label - a sequence of alphanumeric characters, and ... is the actual path to the resource. For example for /img/foo.jpg the actual path is
/static/v1/img/foo.jpg
If there's a new version of the resource with the same name, then all you have to do is to replace v1 with v2, then v3, etc.
If you upload the static files to the server, then I'll configure nginx to serve them.
More than a week has passed since my mail, so I decided to fetch the files myself. I extracted the names of the static files from the source code, and downloaded them to the server to the /var/www/www.squeak.org directory. I've configured nginx to serve these files as I described before. Please check if all of them are there.
The next step is to change the source code in the image to use these files. I saw that the css and js files are not minified, so that's another thing to do. I also think that the source code of the web site should be versionned by MC, and probably stored on source.squeak.org to let others modify it.
The image serving the www.squeak.org site is constantly using ~50% CPU for some reason (even when it's not serving any requests). It's also being ran by root, which is really bad from security POV. Please fix these.
Levente
Levente
Chris
On Mar 29, 2014, at 12:32 PM, Chris Muller asqueaker@gmail.com wrote:
Levente is right, we need to get the new website set up under a webteam id, that only has access to what it needs for the website.
Yea, it could use it's own directory such as /home/website.
In the /home/chrisucnnington/service/run file is this:
#!/bin/bash
/usr/bin/cogvm -vm display=none /home/chriscunnington/squeak.org/Squeak4.4-12327.image /home/chriscunnington/squeak.org/squeaksite.st
I imagine it needs something like su -l chriscunnington "the command listed above" to make it not run as root.
Chris C., yourself, and Timothy (if he wants), and I'm interested too, added as group members.
This would take care of the immediate security need, as well as distribute some of the burden currently concentrated on Chris C.
That would be nice.
Chris C., is this something you would like to handle or would you prefer someone else do it?
I'm more than happy for people to participate in this. In a wide variety of ways, I'm not Andreas Raab. If people think they shouldn't get involved because I'd be offended, because I'm a maestro or something, then please disabuse yourselves of that notion. I'd like nothing more to wake one morning, sip coffee, and decipher the improvements other people have made. (Please list them on a list somewhere.) If you let me set the the bar with what I know, then it's going to be a pretty low bar. And what's worse, I won't learn anything new.
Have a nice weekend, Chris
box-admins@lists.squeakfoundation.org
-
Chris Cunnington -
Chris Muller