You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
145 lines
4.0 KiB
145 lines
4.0 KiB
# community services for woodbine.nyc
|
|
|
|
Experiment in digital autonomy
|
|
|
|
Latest code is hosted on https://git.woodbine.nyc/micro/woodbine.nyc
|
|
|
|
If you are new to running your own websites, welcome!
|
|
|
|
Note that a "service" is a fuzzy name for software that is expected to be always running.
|
|
|
|
A simple web server (`python3 -m http.server`) could be a service, as could something like Gmail.
|
|
|
|
## Goals
|
|
|
|
Understandable
|
|
|
|
- a person should be able to adapt this to their community while learning the least amount of new concepts and technology
|
|
- the person who set it up should not be needed to maintain the services
|
|
|
|
Resiliant
|
|
|
|
- services should work even when other parts of the web are not accessible
|
|
|
|
Lean
|
|
|
|
- we prefer lightweight software, which usually require less long-term maintenance
|
|
|
|
## Decisions
|
|
|
|
There are many other kinds of digital autonomy, but most people are used to the web.
|
|
|
|
We hope to share our decision making here, so you can follow our thought process.
|
|
|
|
### Decisions made for you
|
|
|
|
These needs are required for anyone who wants to deploy **web-based** services.
|
|
|
|
#### Auth
|
|
|
|
We need a way for people to either register an account or sign in with an external account to use the services.
|
|
|
|
After trying authelia, zitadel, authentik, and keycloak, got the furthest with zitadel.
|
|
|
|
#### Web
|
|
|
|
To host a webpage, you need some software that listens for http requests. We chose Caddy.
|
|
|
|
If you would like to edit the webpage, either change the files in `./data/web/site/` directly, or you can connect via WebDAV and edit the file remotely via https://web.localhost.
|
|
|
|
#### Backup
|
|
|
|
If you will be helping a community, its important to have backups and restore. We have two helper services, `backup-files` and `backup-database`.
|
|
|
|
These use duplicity to backup to a backblaze instance, so you will need to setup that beforehand.
|
|
|
|
#### Secrets
|
|
|
|
We have two helper services for making sure secrets exist (`check-secrets`), or generating unique secrets for other services that need them (`generate-secrets`).
|
|
|
|
---
|
|
|
|
## getting started
|
|
|
|
### setup
|
|
|
|
Make a backblaze B2 account for backups. Add the secrets to ./secrets/backup/.
|
|
|
|
Fill out env.template and make sure to pass it in the next command
|
|
|
|
### running
|
|
|
|
Helper scripts can be found in [the scripts directory](./scripts)
|
|
|
|
To start
|
|
|
|
./scripts/up
|
|
|
|
To stop, you can press ctrl+c, or in another terminal run
|
|
|
|
./scripts/down
|
|
|
|
To generate secrets for all services ahead-of-time
|
|
|
|
./scripts/generate-secrets
|
|
|
|
### port forwarding
|
|
|
|
The caddy service expects to be able to bind to ports 80 and 443
|
|
|
|
One simple way is to allow unprivileged users access to these low ports
|
|
|
|
echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee -a /etc/sysctl.conf
|
|
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80
|
|
|
|
---
|
|
|
|
## design
|
|
|
|
All the services are defined by docker compose files.
|
|
|
|
We provide `backup-files`, `backup-database`, `check-secrets`, and `generate-secrets` helper services.
|
|
|
|
We have configured Caddy to import all files found in /etc/caddy.d/, so if you want to add a new service, you will need to make a small `Proxyfile` to tell caddy what subdomain to forward to what port.
|
|
|
|
See [the services readme](./services/readme.md) for a guide on adding a new service.
|
|
|
|
---
|
|
|
|
## roadmap
|
|
|
|
### alpha
|
|
|
|
- [x] identity provider (zitadel)
|
|
- [ ] single sign-on for webdav (one user per folder)
|
|
- [ ] single sign-on for one more service
|
|
- [x] file backup (duplicity)
|
|
- [ ] postgres backup (duplicity)
|
|
- [ ] decide on single postgres instance or multiple
|
|
- [x] reverse proxy (caddy)
|
|
- [x] personal home pages (caddy-webdav)
|
|
- [x] migrate from yaml to env for authelia config
|
|
- [x] setup notifications via smtp
|
|
|
|
### beta
|
|
|
|
- [ ] file restore
|
|
- [ ] postgres restore
|
|
- [ ] wiki
|
|
- [ ] matrix server (dendrite)
|
|
- [ ] mail server (stalwart or maddy)
|
|
- [ ] mailing list (listmonk)
|
|
- [ ] code forge (gitea or forgejo)
|
|
|
|
### 0.1
|
|
|
|
- [ ] only expose 443, 587, 993
|
|
- [ ] running on beta.woodbine.nyc
|
|
- [ ] audit on secrets management
|
|
- [ ] audit on mail server
|
|
- [ ] audit on general architecture
|
|
|
|
## credits
|
|
|
|
thank you https://hackerspace.zone
|