mirror of
https://github.com/wekan/wekan.git
synced 2026-11-05 01:20:07 -05:00
Sandstorm: build from install.sandstorm.org, and link sandstorm.org everywhere.
v12.69's build-sandstorm in release-all.yml stopped because the certificate of install.sandstorm.io had expired. It fetches the installer from install.sandstorm.org, as sandstorm.yml and sandstorm-store.yml already did, and so does releases/install-sandstorm.sh. That installer downloads Sandstorm from dl.sandstorm.org and configures a development server at local.sandstorm.org, so the docs follow: docs, apps, dl, install and local.sandstorm.io links and addresses become sandstorm.org in the docs, SECURITY.md, code comments and the accounts-sandstorm README, each URL checked to answer there. demo.sandstorm.io stays, as it has no sandstorm.org name; released CHANGELOG sections are records and stay as they are. The release audit's baseline allows the two code comments' docs.sandstorm.org. tests/sandstormOrgHosts.test.cjs: every Sandstorm build installs from install.sandstorm.org, and no tracked file names a sandstorm.io host outside those kept on purpose; it fails on the old release-all.yml. Thanks to xet7 !
This commit is contained in:
Lauri Ojansivu committed
1 parent
b9f6eff3d9
commit
ca2dc5fae5
28 files changed
+104
-58
No files matched your search
@@ -3672,7 +3672,7 @@ jobs:
|
||||
# Ubuntu 24.04's AppArmor defaults kernel.apparmor_restrict_unprivileged_userns=1,
|
||||
# which blocks the unprivileged user namespaces that the Sandstorm install and
|
||||
# the spk supervisor rely on (the "fragile part" noted above). Relax it so
|
||||
# `install.sandstorm.io` and meteor-spk can create sandboxes on the runner.
|
||||
# `install.sandstorm.org` and meteor-spk can create sandboxes on the runner.
|
||||
# `|| true`: on kernels/runners without these knobs, setting them is a no-op.
|
||||
run: |
|
||||
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
|
||||
@@ -3696,11 +3696,11 @@ jobs:
|
||||
run: |
|
||||
# Downloaded, then run: a `curl | sh` cannot be retried, because by the
|
||||
# time the download fails sh is already half way through the script.
|
||||
bash "$GITHUB_WORKSPACE/releases/fetch.sh" -o /tmp/install-sandstorm.sh https://install.sandstorm.io
|
||||
bash "$GITHUB_WORKSPACE/releases/fetch.sh" -o /tmp/install-sandstorm.sh https://install.sandstorm.org
|
||||
sudo bash /tmp/install-sandstorm.sh -d
|
||||
|
||||
- name: Assemble modern meteor-spk.deps (Node 26 + FerretDB + Mongo 3.x CLIs)
|
||||
# Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io (has mongod 3.0 +
|
||||
# Base = upstream meteor-spk 0.6.0 from dl.sandstorm.org (has mongod 3.0 +
|
||||
# niscud). build-deps.sh swaps in Node 26, adds FerretDB + the Mongo 3.x
|
||||
# CLIs + the migration launcher/importer, keeps niscud, and swaps in the
|
||||
# modern sandstorm-http-bridge from the Sandstorm install above. No dependency
|
||||
|
||||
+4
-4
@@ -272,13 +272,13 @@ Meteor.startup(() => {
|
||||
|
||||
On the Sandstorm platform, Standalone WeKan features like the Admin Panel are turned off using environment variables, because Sandstorm platform provides SSO for all apps running on Sandstorm.
|
||||
|
||||
[Sandstorm](https://sandstorm.io) is a separate Open Source platform that has been
|
||||
[security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
|
||||
[Sandstorm](https://sandstorm.org) is a separate Open Source platform that has been
|
||||
[security audited](https://sandstorm.org/news/2017-03-02-security-review) and found bugs fixed.
|
||||
Sandstorm also has passwordless login, LDAP, SAML, Google, and other auth options already.
|
||||
On Sandstorm, code is read-only and signed by app maintainers; only grain content can be modified.
|
||||
WeKan on Sandstorm runs in a sandboxed grain; it does not have access elsewhere without a user-visible PowerBox request or opening a randomly-generated API key URL.
|
||||
Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
|
||||
[Sandstorm Security non-events](https://docs.sandstorm.io/en/latest/using/security-non-events/).
|
||||
Also read [Sandstorm Security Practices](https://docs.sandstorm.org/en/latest/using/security-practices/) and
|
||||
[Sandstorm Security non-events](https://docs.sandstorm.org/en/latest/using/security-non-events/).
|
||||
For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email.
|
||||
|
||||
## What WeKan bugs are eligible?
|
||||
|
||||
@@ -272,7 +272,7 @@ examples do not back up a FerretDB SQLite directory or external file storage.
|
||||
|
||||
# Backup Sandstorm
|
||||
|
||||
1. Please first backup your Sandstorm https://docs.sandstorm.io/en/latest/administering/backups/
|
||||
1. Please first backup your Sandstorm https://docs.sandstorm.org/en/latest/administering/backups/
|
||||
2. Please first download all of your grains to .zip files from top menu row down arrow button, just in case.
|
||||
|
||||
# Upgrade Sandstorm WeKan
|
||||
|
||||
@@ -203,7 +203,7 @@ or have Javascript disabled for security reasons.
|
||||
- Pascal code with TRSE https://lemonspawn.com/turbo-rascal-syntax-error-expected-but-begin/
|
||||
- Embedded webserver, for example:
|
||||
- C https://github.com/wekan/hx/blob/main/prototypes/code/webserver/works/c/server.c
|
||||
- Sandstorm https://sandstorm.io , https://github.com/sandstorm-io/sandstorm
|
||||
- Sandstorm https://sandstorm.org , https://github.com/sandstorm-io/sandstorm
|
||||
- Rust https://github.com/dwrensha/sandstorm-rawapi-example-rust
|
||||
- C++ https://github.com/dwrensha/sandstorm-rawapi-example
|
||||
- Try to avoid strange NPM packages
|
||||
|
||||
@@ -96,7 +96,7 @@ Wekan:
|
||||
|
||||
Wekan for Sandstorm:
|
||||
- Install above Wekan from source
|
||||
- Install [Sandstorm locally](https://sandstorm.io/install) with `curl https://install.sandstorm.io | bash`, select dev install
|
||||
- Install [Sandstorm locally](https://sandstorm.org/install) with `curl https://install.sandstorm.org | bash`, select dev install
|
||||
- Install [meteor-spk](https://github.com/sandstorm-io/meteor-spk)
|
||||
- Get 100% CPU issue fibers fixed node, and copy it to spk directory:<br />
|
||||
`wget https://releases.wekan.team/node`<br />
|
||||
@@ -105,7 +105,7 @@ Wekan for Sandstorm:
|
||||
- Add to your /home/username/.bashrc : <br /> `export PATH=$PATH:$HOME/projects/meteor-spk/meteor-spk-0.4.0`
|
||||
- Close and open your terminal, or read settings from .bashrc with<br />`source ~/.bashrc`
|
||||
- `cd wekan && meteor-spk dev`
|
||||
- Then Wekan will be visible at local sandstorm at http://local.sandstorm.io:6080/
|
||||
- Then Wekan will be visible at local sandstorm at http://local.sandstorm.org:6080/
|
||||
- Sandstorm commands: `sudo sandstorm`. [Release scripts](https://github.com/wekan/wekan-maintainer/tree/master/releases). Official releases require publishing key that only xet7 has.
|
||||
|
||||
Docker:
|
||||
|
||||
@@ -234,7 +234,7 @@ Other files:
|
||||
* **[snap](../../snap)**;
|
||||
* **[snap-src](../../snap-src)**;
|
||||
* Sandstorm:
|
||||
* **[sandstorm.js](../../sandstorm.js)**: [Sandstorm](https://sandstorm.io/) specific code;
|
||||
* **[sandstorm.js](../../sandstorm.js)**: [Sandstorm](https://sandstorm.org/) specific code;
|
||||
* **[sandstorm-pkgdef.capnp](../../sandstorm-pkgdef.capnp)**: used the meteor-spk tool to generate a sandstorm package;
|
||||
* Node:
|
||||
* **[package.json](../../package.json)**;
|
||||
|
||||
@@ -134,11 +134,11 @@ docker-compose up -d --build
|
||||
|
||||
## Sandstorm
|
||||
|
||||
1) Install local development version of Sandstorm to your laptop from https://sandstorm.io/install
|
||||
1) Install local development version of Sandstorm to your laptop from https://sandstorm.org/install
|
||||
|
||||
2) Download and install experimental version to your local Sandstorm:
|
||||
[Sandstorm](../Platforms/FOSS/Container/Sandstorm)
|
||||
Local sandstorm is at http://local.sandstorm.io:6080/ .
|
||||
Local sandstorm is at http://local.sandstorm.org:6080/ .
|
||||
|
||||
3) Download your production Wekan grain .zip file with down arrow button. Upload to your dev local Sandstorm.
|
||||
Try does it work.
|
||||
+4
-4
@@ -40,7 +40,7 @@ It's a very specific niche, with limited amount competitors, with all of this ap
|
||||
|
||||
## Requirements
|
||||
|
||||
- 64bit: Linux [Snap](https://github.com/wekan/wekan-snap/wiki/Install) or [Sandstorm](https://sandstorm.io) /
|
||||
- 64bit: Linux [Snap](https://github.com/wekan/wekan-snap/wiki/Install) or [Sandstorm](https://sandstorm.org) /
|
||||
[Mac](../Platforms/Propietary/OS/Mac) / [Windows](../Platforms/Propietary/OS/Windows/Install-Wekan-from-source-on-Windows.md).
|
||||
[More Platforms](../Platforms). [ARM progress](https://github.com/wekan/wekan/issues/1053#issuecomment-410919264).
|
||||
- 1 GB RAM minimum free for Wekan. Production server should have miminum total 4 GB RAM.
|
||||
@@ -105,7 +105,7 @@ Wekan:
|
||||
- Snap/Docker/Sandstorm versions runs inside sandbox and does not have any access to elsewhere on server filesystem.
|
||||
- Snap version of Wekan is built directly from https://github.com/wekan/wekan repo on Canonical's build service that does security checks etc.
|
||||
- Docker version of Wekan is built directly from https://github.com/wekan/wekan by [Quay](https://quay.io/wekan/wekan) and [Docker Hub](https://hub.docker.com/r/wekanteam/wekan/) and they do security checks etc.
|
||||
- Sandstorm version is checked by [ocdtrekkie](https://github.com/ocdtrekkie) that it does not break anything, before he lets new version of Wekan into [Sandstorm App Market](https://apps.sandstorm.io/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h).
|
||||
- Sandstorm version is checked by [ocdtrekkie](https://github.com/ocdtrekkie) that it does not break anything, before he lets new version of Wekan into [Sandstorm App Market](https://apps.sandstorm.org/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h).
|
||||
- Wekan does not load any files from Internet, when starting Wekan. For further restrictions, you could on internal server only allow incoming and outgoing traffic from
|
||||
on internal server firewall to those computers that need to use Wekan.
|
||||
- There is contributors to Wekan from all over the world, that add fixes and features to Wekan.
|
||||
@@ -242,8 +242,8 @@ Add only one link to this FAQ. Do not in any way comment or feed the trolls.
|
||||
Not a Company, Not a Startup, Not a Product with Enterprise version. Everything is now [Open Source](https://en.wikipedia.org/wiki/Open-source_software) and [Free software](https://en.wikipedia.org/wiki/Free_software).
|
||||
|
||||
## What is Sandstorm?
|
||||
[Sandstorm](https://sandstorm.io) is a open-source and free software security audited platform with grains, logging, admin settings, server clustering and App Market. App Market has Wekan as installable App. SSO options like LDAP, passwordless email, SAML, GitHub and Google Auth are already available on Sandstorm. Sandstorm is preferred platform for Wekan, as it would take a lot of work to reimplement everything in standalone Wekan.
|
||||
[Sandstorm](https://sandstorm.org) is a open-source and free software security audited platform with grains, logging, admin settings, server clustering and App Market. App Market has Wekan as installable App. SSO options like LDAP, passwordless email, SAML, GitHub and Google Auth are already available on Sandstorm. Sandstorm is preferred platform for Wekan, as it would take a lot of work to reimplement everything in standalone Wekan.
|
||||
|
||||
## How can you contribute to Sandstorm?
|
||||
See [Sandstorm website about contributing pull requests](https://sandstorm.io) and [returning to Open Source community roots, including donation info](https://sandstorm.io/news/2017-02-06-sandstorm-returning-to-community-roots).
|
||||
See [Sandstorm website about contributing pull requests](https://sandstorm.org) and [returning to Open Source community roots, including donation info](https://sandstorm.org/news/2017-02-06-sandstorm-returning-to-community-roots).
|
||||
|
||||
+4
-4
@@ -63,10 +63,10 @@ GitHub Username | Chat Username | Location | Position | Details
|
||||
[Zokormazo](https://github.com/Zokormazo) | Zokormazo | Spain | Contributor | [Add isAdmin to user Schema](https://github.com/wekan/wekan/pull/970), [Add TLS toggle to Admin Panel SMTP setting](https://github.com/wekan/wekan/pull/960)
|
||||
[shtefcs](https://github.com/shtefcs) | kinder | Universe | [Vanila](https://vanila.io) Founder | [Chat](https://chat.vanila.io/channel/wekan), growth hacking
|
||||
[jelenajjo](https://github.com/jelenajjo) | jelena | Universe | [Vanila](https://vanila.io) Web Developer | [Themes](https://github.com/wekan/wekan/issues/781), upcoming new website
|
||||
[dwrensha](https://github.com/dwrensha) | - | USA | [Sandstorm](https://sandstorm.io) Developer | Packaging Wekan releases for Sandstorm
|
||||
[kentonv](https://github.com/kentonv) | - | USA | [Sandstorm](https://sandstorm.io) Developer | [Cap’n Proto](https://capnproto.org) and [node-capnp](https://github.com/kentonv/node-capnp)
|
||||
[ocdtrekkie](https://github.com/ocdtrekkie) | ocdtrekkie | USA | [Sandstorm](https://sandstorm.io) user from beginning of Sandstorm | Testing and accepting Wekan releases for Sandstorm
|
||||
[JamborJan](https://github.com/JamborJan) | - | Universe | [Sandstorm](https://sandstorm.io) Developer | [Add bigger screenshots](https://github.com/wekan/wekan/pull/940)
|
||||
[dwrensha](https://github.com/dwrensha) | - | USA | [Sandstorm](https://sandstorm.org) Developer | Packaging Wekan releases for Sandstorm
|
||||
[kentonv](https://github.com/kentonv) | - | USA | [Sandstorm](https://sandstorm.org) Developer | [Cap’n Proto](https://capnproto.org) and [node-capnp](https://github.com/kentonv/node-capnp)
|
||||
[ocdtrekkie](https://github.com/ocdtrekkie) | ocdtrekkie | USA | [Sandstorm](https://sandstorm.org) user from beginning of Sandstorm | Testing and accepting Wekan releases for Sandstorm
|
||||
[JamborJan](https://github.com/JamborJan) | - | Universe | [Sandstorm](https://sandstorm.org) Developer | [Add bigger screenshots](https://github.com/wekan/wekan/pull/940)
|
||||
[nebulade](https://github.com/nebulade) | - | Germany | [Cloudron](https://cloudron.io) Developer | [Re-enable export](https://github.com/wekan/wekan/pull/1059)
|
||||
[kubiko](https://github.com/kubiko) | - | UK | [Canonical](https://www.canonical.com) Developer | [snap package](https://github.com/wekan/wekan-snap), [Adding snapcraft build support from source](https://github.com/wekan/wekan/pull/1091), [Use version scriptlet in snap](https://github.com/wekan/wekan/pull/1164)
|
||||
[whowillcare](https://github.com/whowillcare) | Universe | Contributor | Global webhook to Admin Panel, etc a lot of features.
|
||||
|
||||
+1
-1
@@ -35,7 +35,7 @@
|
||||
|
||||
## Authentication
|
||||
|
||||
Most are these are already available at [Sandstorm](https://sandstorm.io), for example see
|
||||
Most are these are already available at [Sandstorm](https://sandstorm.org), for example see
|
||||
[screenshots of SAML support](https://discourse.wekan.io/t/sso-passing-variables-through-url/493/8).
|
||||
Following are for Source/Docker installs:
|
||||
|
||||
|
||||
@@ -67,4 +67,4 @@ sudo systemclt start proxybouncer
|
||||
```
|
||||
Question: Does this setup imply that everyone will be logged in to Wekan as 'proxybouncer'? Is there a way to pass username from Google via headers, etc.?
|
||||
|
||||
Answer: First login to Proxybouncer can limit login domain of G Suite. Second login is using Wekan username and password. There is no integrated login yet for standalone Wekan like there is for https://sandstorm.io
|
||||
Answer: First login to Proxybouncer can limit login domain of G Suite. Second login is using Wekan username and password. There is no integrated login yet for standalone Wekan like there is for https://sandstorm.org
|
||||
@@ -54,12 +54,12 @@ From Devices / Install Guest Additions CD image...
|
||||
|
||||
## 6) Install Sandstorm dev version
|
||||
|
||||
[Info source](https://sandstorm.io/install)
|
||||
[Info source](https://sandstorm.org/install)
|
||||
|
||||
Start install:
|
||||
|
||||
```
|
||||
curl https://install.sandstorm.io | bash
|
||||
curl https://install.sandstorm.org | bash
|
||||
```
|
||||
|
||||
Use options for development / dev install.
|
||||
@@ -85,7 +85,7 @@ sudo useradd -G sandstorm wekan
|
||||
|
||||
```
|
||||
cd ~/repos
|
||||
curl https://dl.sandstorm.io/meteor-spk-0.4.0.tar.xz | tar Jxf -
|
||||
curl https://dl.sandstorm.org/meteor-spk-0.4.0.tar.xz | tar Jxf -
|
||||
echo "export PATH=$PATH:~/repos/meteor-spk-0.4.0" >> ~/.bashrc
|
||||
```
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ Read:
|
||||
|
||||
Start install:
|
||||
```
|
||||
curl https://install.sandstorm.io | bash
|
||||
curl https://install.sandstorm.org | bash
|
||||
```
|
||||
|
||||
Use options for development / dev install.
|
||||
@@ -38,7 +38,7 @@ sudo sandstorm start
|
||||
```
|
||||
mkdir ~/repos
|
||||
cd ~/repos
|
||||
curl https://dl.sandstorm.io/meteor-spk-0.4.0.tar.xz | tar Jxf -
|
||||
curl https://dl.sandstorm.org/meteor-spk-0.4.0.tar.xz | tar Jxf -
|
||||
echo "export PATH=$PATH:~/repos/meteor-spk-0.4.0" >> ~/.bashrc
|
||||
```
|
||||
|
||||
@@ -122,7 +122,7 @@ meteor-spk dev
|
||||
|
||||
`App in now available from Sandstorm server. Ctrl-C to disconnect.`
|
||||
|
||||
With Firefox/Chromium/Chrome/Edge/Chromium Edge browser, open http://local.sandstorm.io:6080/
|
||||
With Firefox/Chromium/Chrome/Edge/Chromium Edge browser, open http://local.sandstorm.org:6080/
|
||||
|
||||
Login with premade local dev account Alice.
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@ WeKan **snap** already ships.
|
||||
|
||||
## 1. Why
|
||||
|
||||
The current Sandstorm build uses **meteor‑spk 0.6.0** (`https://dl.sandstorm.io/meteor-spk-0.6.0.tar.xz`,
|
||||
The current Sandstorm build uses **meteor‑spk 0.6.0** (`https://dl.sandstorm.org/meteor-spk-0.6.0.tar.xz`,
|
||||
built 2021‑10‑23). Its `meteor-spk.deps` payload is a 2015‑era design:
|
||||
|
||||
| Component | meteor‑spk 0.6.0 ships | WeKan needs |
|
||||
@@ -381,7 +381,7 @@ and refreshes.
|
||||
|
||||
## 9. Build / CI ([.github/workflows/sandstorm.yml](../../../../../../.github/workflows/sandstorm.yml))
|
||||
|
||||
- **Base = upstream meteor‑spk 0.6.0**, downloaded from `https://dl.sandstorm.io/meteor-spk-0.6.0.tar.xz`.
|
||||
- **Base = upstream meteor‑spk 0.6.0**, downloaded from `https://dl.sandstorm.org/meteor-spk-0.6.0.tar.xz`.
|
||||
It already contains `bin/mongod` (3.0.7), `bin/niscud` (2.x) and the old `node_modules` the
|
||||
niscu→3.0 stage needs. **Nothing is needed from the old `projects.7z`** (it only holds
|
||||
0.4.1/0.5.0/0.5.1, and its swapped node is ancient — we install Node 26 anyway). The dead
|
||||
|
||||
@@ -63,7 +63,7 @@ mismatch fails.
|
||||
|
||||
## Sources
|
||||
|
||||
- [Sandstorm: Powerbox](https://docs.sandstorm.io/en/latest/developing/powerbox/)
|
||||
- [Sandstorm: Powerbox](https://docs.sandstorm.org/en/latest/developing/powerbox/)
|
||||
- `src/sandstorm/api-session.capnp` and `src/sandstorm/bridge-proxy.c++` in
|
||||
[sandstorm-io/sandstorm](https://github.com/sandstorm-io/sandstorm)
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## 1. Backup Sandstorm
|
||||
|
||||
1. Please first backup your Sandstorm https://docs.sandstorm.io/en/latest/administering/backups/
|
||||
1. Please first backup your Sandstorm https://docs.sandstorm.org/en/latest/administering/backups/
|
||||
2. Please first download all of your grains to .zip files from top menu row down arrow button, just in case.
|
||||
|
||||
## 2. Upgrade Sandstorm WeKan
|
||||
@@ -58,13 +58,13 @@ Download Official Version
|
||||
|
||||
1. Please backup first.
|
||||
|
||||
2. [Official Sandstorm Store](https://apps.sandstorm.io/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h)
|
||||
2. [Official Sandstorm Store](https://apps.sandstorm.org/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h)
|
||||
|
||||
Download Newest WeKan Test Version
|
||||
|
||||
1. Please backup first.
|
||||
|
||||
2. [Experimental Sandstorm Store](https://apps.sandstorm.io/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h?experimental=true)
|
||||
2. [Experimental Sandstorm Store](https://apps.sandstorm.org/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h?experimental=true)
|
||||
|
||||
About CloudFlare and uploading wekan.spk file
|
||||
|
||||
@@ -220,11 +220,11 @@ Source: https://groups.google.com/g/sandstorm-dev/c/4JFhr7B7QZU
|
||||
|
||||
[Sandstorm Website](https://sandstorm.org)
|
||||
|
||||
If you have any grains at Sandstorm's **Oasis montly paid service**, please move those to self-hosted, because [only **Oasis grain hosting** part is shutting down](https://sandstorm.io/news/2019-09-15-shutting-down-oasis) - [HN](https://news.ycombinator.com/item?id=20979428). This does not affect any other parts like self-hosting at sandcats.io, App Market, updates, etc.
|
||||
If you have any grains at Sandstorm's **Oasis montly paid service**, please move those to self-hosted, because [only **Oasis grain hosting** part is shutting down](https://sandstorm.org/news/2019-09-15-shutting-down-oasis) - [HN](https://news.ycombinator.com/item?id=20979428). This does not affect any other parts like self-hosting at sandcats.io, App Market, updates, etc.
|
||||
|
||||
Works on Ubuntu 64bit, on Debian 64bit.
|
||||
|
||||
[Security audited](https://sandstorm.io/news/2017-03-02-security-review), recommended for security critical use on public internet or internal network. [Sandstorm Security Features](https://docs.sandstorm.io/en/latest/using/security-practices/). Sandstorm is [completely Open Source](https://sandstorm.io/news/2017-02-06-sandstorm-returning-to-community-roots), including [Blackrock Clustering](https://github.com/sandstorm-io/blackrock).
|
||||
[Security audited](https://sandstorm.org/news/2017-03-02-security-review), recommended for security critical use on public internet or internal network. [Sandstorm Security Features](https://docs.sandstorm.org/en/latest/using/security-practices/). Sandstorm is [completely Open Source](https://sandstorm.org/news/2017-02-06-sandstorm-returning-to-community-roots), including [Blackrock Clustering](https://github.com/sandstorm-io/blackrock).
|
||||
|
||||
Install to your own server. Automatic updates, tested before release. Sandstorm Wekan has different features than Standalone.
|
||||
|
||||
@@ -253,8 +253,8 @@ Install to your own server. Automatic updates, tested before release. Sandstorm
|
||||
|
||||
## Wekan App
|
||||
|
||||
Wekan at [experimental](https://apps.sandstorm.io/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h?experimental=true) or
|
||||
[official](https://apps.sandstorm.io/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h) Sandstorm App Market. Note: Only use official. Experimental versions are broken.
|
||||
Wekan at [experimental](https://apps.sandstorm.org/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h?experimental=true) or
|
||||
[official](https://apps.sandstorm.org/app/m86q05rdvj14yvn78ghaxynqz7u2svw6rnttptxx49g1785cdv1h) Sandstorm App Market. Note: Only use official. Experimental versions are broken.
|
||||
|
||||
Newest Wekap app .spk file download at https://releases.wekan.team/sandstorm/
|
||||
|
||||
|
||||
@@ -184,7 +184,7 @@ shown in a grain.
|
||||
### Local test on Sandstorm
|
||||
|
||||
Done on 2026-10-23 on the maintainer's machine: Sandstorm 0.308 at
|
||||
`http://local.sandstorm.io:6080`, dev accounts, driven with Playwright.
|
||||
`http://local.sandstorm.org:6080`, dev accounts, driven with Playwright.
|
||||
|
||||
1. `releases/sandstorm-slim-spk.sh` built the bundle with the profile.
|
||||
`sandstorm-src/build-deps.sh` (`FERRETDB_SOURCE=build`) built the deps, and
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ curl https://Bearer:APIKEY@api-URL.SUBDOMAIN.sandcats.io/api/boards/sandstorm/ex
|
||||
```
|
||||
For local Sandstorm install:
|
||||
```
|
||||
curl http://Bearer:APIKEY@api-URL.local.sandstorm.io:6080/api/boards/sandstorm/export?authToken=#APIKEY > wekanboard.json
|
||||
curl http://Bearer:APIKEY@api-URL.local.sandstorm.org:6080/api/boards/sandstorm/export?authToken=#APIKEY > wekanboard.json
|
||||
```
|
||||
|
||||
***
|
||||
|
||||
@@ -6,7 +6,7 @@ This is totally oversimplified TLDR comparison that leaves out a lot of details.
|
||||
* Admin Panel
|
||||
* Wekan kanban board
|
||||
* Can be installed to Ubuntu 16.04 64bit without Docker
|
||||
* Can run inside Docker, see [Sandstorm within Docker](https://docs.sandstorm.io/en/latest/install/#option-6-using-sandstorm-within-docker)
|
||||
* Can run inside Docker, see [Sandstorm within Docker](https://docs.sandstorm.org/en/latest/install/#option-6-using-sandstorm-within-docker)
|
||||
|
||||
## Difference: User interface
|
||||
|
||||
@@ -20,7 +20,7 @@ This is totally oversimplified TLDR comparison that leaves out a lot of details.
|
||||
|
||||
[Current Admin Panel / Authentication screenshots](https://discourse.wekan.io/t/sso-passing-variables-through-url/493/8).
|
||||
|
||||
The user interface in Sandstorm is one of Sandstorm's [long list of high-end security features](https://docs.sandstorm.io/en/latest/using/security-practices/) protecting potentially malicious applications running on Sandstorm sandboxes/grains to hijack whole full screen interface and do phishing of information, stealing admin credentials when replacing admin menus, etc. It's black to be totally recognizable and different from other applications. Having it hidden or on not so dark would make new users to not find it. There has been usability testing of Sandstorm's user interface. Sandstorm has been fully security audited and found problems fixed already.
|
||||
The user interface in Sandstorm is one of Sandstorm's [long list of high-end security features](https://docs.sandstorm.org/en/latest/using/security-practices/) protecting potentially malicious applications running on Sandstorm sandboxes/grains to hijack whole full screen interface and do phishing of information, stealing admin credentials when replacing admin menus, etc. It's black to be totally recognizable and different from other applications. Having it hidden or on not so dark would make new users to not find it. There has been usability testing of Sandstorm's user interface. Sandstorm has been fully security audited and found problems fixed already.
|
||||
|
||||
## Difference: Hardware requirements
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ Wekan Meteor Bundle:
|
||||
|
||||
Wekan for Sandstorm:
|
||||
- Install above Wekan from source
|
||||
- Install [Sandstorm locally](https://sandstorm.io/install) with `curl https://install.sandstorm.io | bash`, select dev install
|
||||
- Install [Sandstorm locally](https://sandstorm.org/install) with `curl https://install.sandstorm.org | bash`, select dev install
|
||||
- Install [meteor-spk](https://github.com/sandstorm-io/meteor-spk)
|
||||
- Get 100% CPU issue fibers fixed node, and copy it to spk directory:<br />
|
||||
`wget https://releases.wekan.team/node`<br />
|
||||
@@ -29,7 +29,7 @@ Wekan for Sandstorm:
|
||||
- Add to your /home/username/.bashrc : <br /> `export PATH=$PATH:$HOME/projects/meteor-spk/meteor-spk-0.4.0`
|
||||
- Close and open your terminal, or read settings from .bashrc with<br />`source ~/.bashrc`
|
||||
- `cd wekan && meteor-spk dev`
|
||||
- Then Wekan will be visible at local sandstorm at http://local.sandstorm.io:6080/
|
||||
- Then Wekan will be visible at local sandstorm at http://local.sandstorm.org:6080/
|
||||
- Sandstorm commands: `sudo sandstorm`. [Release scripts](https://github.com/wekan/wekan-maintainer/tree/master/releases). Official releases require publishing key that only xet7 has.
|
||||
|
||||
Docker:
|
||||
|
||||
@@ -67,4 +67,4 @@ sudo systemclt start proxybouncer
|
||||
```
|
||||
Question: Does this setup imply that everyone will be logged in to Wekan as 'proxybouncer'? Is there a way to pass username from Google via headers, etc.?
|
||||
|
||||
Answer: First login to Proxybouncer can limit login domain of G Suite. Second login is using Wekan username and password. There is no integrated login yet for standalone Wekan like there is for https://sandstorm.io
|
||||
Answer: First login to Proxybouncer can limit login domain of G Suite. Second login is using Wekan username and password. There is no integrated login yet for standalone Wekan like there is for https://sandstorm.org
|
||||
@@ -838,7 +838,7 @@ export class BridgeConfig extends $.Struct {
|
||||
/**
|
||||
* Specifies a path which will be prefixed to all API requests -- that is, requests coming in
|
||||
* through the API endpoint as described in:
|
||||
* https://docs.sandstorm.io/en/latest/developing/http-apis/
|
||||
* https://docs.sandstorm.org/en/latest/developing/http-apis/
|
||||
*
|
||||
* Note that this form of HTTP APIs is old and will eventually be deprecated. In the fantastic
|
||||
* future, available APIs should be defined by `powerboxApis`, below. However, as of this writing,
|
||||
@@ -853,7 +853,7 @@ export class BridgeConfig extends $.Struct {
|
||||
* your UI's URL schema, which is often convenient. To actually restrict what an API token
|
||||
* holder is allowed to do, you MUST use permissions and enforce them for both API and UI
|
||||
* requests. See:
|
||||
* https://docs.sandstorm.io/en/latest/developing/auth/
|
||||
* https://docs.sandstorm.org/en/latest/developing/auth/
|
||||
*
|
||||
*/
|
||||
get apiPath() {
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
// with. So Copy card URL asks the Sandstorm shell to share the card instead:
|
||||
// a { startSharing: { pathname } } message opens Sandstorm's Share Access
|
||||
// dialog, whose sharing link opens the grain at that card
|
||||
// (https://docs.sandstorm.io/en/latest/developing/path/#helping-the-user-share-access).
|
||||
// (https://docs.sandstorm.org/en/latest/developing/path/#helping-the-user-share-access).
|
||||
// The shell requires the path to start with "/" and accepts only
|
||||
// { pathname, hash } (sandstorm shell grain-client.js). Pure:
|
||||
// tests/sandstormShare.test.cjs.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Sandstorm.io login integration for Meteor.js
|
||||
|
||||
[Sandstorm](https://sandstorm.io) is a platform for personal clouds that makes
|
||||
[Sandstorm](https://sandstorm.org) is a platform for personal clouds that makes
|
||||
installing apps to your personal server as easy as installing apps to your
|
||||
phone.
|
||||
|
||||
@@ -22,7 +22,7 @@ package repository:
|
||||
meteor add kenton:accounts-sandstorm
|
||||
|
||||
To package a Meteor app for Sandstorm, see
|
||||
[the Meteor app packaging guide](https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tutorial-meteor/).
|
||||
[the Meteor app packaging guide](https://docs.sandstorm.org/en/latest/vagrant-spk/packaging-tutorial-meteor/).
|
||||
|
||||
Note that this package does nothing if the `SANDSTORM` environment variable is
|
||||
not set. Therefore, it is safe to include the package even in non-Sandstorm
|
||||
@@ -58,7 +58,7 @@ Either of these will return an object containing the following fields:
|
||||
* `pronouns`: From `X-Sandstorm-User-Pronouns`, indicates the pronouns
|
||||
by which the user prefers to be referred.
|
||||
|
||||
See [the Sandstorm docs](https://docs.sandstorm.io/en/latest/developing/auth/#headers-that-an-app-receives) for more information about these fields.
|
||||
See [the Sandstorm docs](https://docs.sandstorm.org/en/latest/developing/auth/#headers-that-an-app-receives) for more information about these fields.
|
||||
|
||||
Note that `sandstormUser()` may return `null` on the client side if the login
|
||||
handshake has not completed yet (`Meteor.loggingIn()` returns `true` during
|
||||
|
||||
@@ -17,5 +17,5 @@ rm projects.7z
|
||||
# and found there by sandstorm-slim-spk.sh. No shell rc file is edited.
|
||||
export PATH="$PATH:$WEKAN_METEOR_SPK_DIR/meteor-spk-0.6.0"
|
||||
echo "INSTALL DEV VERSION OF SANDSTORM:"
|
||||
curl https://install.sandstorm.io | bash
|
||||
curl https://install.sandstorm.org | bash
|
||||
cd "$REPO_DIR"
|
||||
@@ -80,8 +80,8 @@
|
||||
"imports/sandstorm/capnp/package.mjs": [
|
||||
"http://choosealicense\\.com/no\\-license/",
|
||||
"http://opensource\\.org/licenses/",
|
||||
"https://docs\\.sandstorm\\.io/en/latest/developing/auth/",
|
||||
"https://docs\\.sandstorm\\.io/en/latest/developing/http\\-apis/",
|
||||
"https://docs\\.sandstorm\\.org/en/latest/developing/auth/",
|
||||
"https://docs\\.sandstorm\\.org/en/latest/developing/http\\-apis/",
|
||||
"https://keybase\\.io"
|
||||
],
|
||||
"server/sandstorm.js": [
|
||||
@@ -135,7 +135,7 @@
|
||||
],
|
||||
"models/lib/sandstormShare.js": [
|
||||
"http://grain\\.invalid",
|
||||
"https://docs\\.sandstorm\\.io/en/latest/developing/path/(#[a-z-]+)?"
|
||||
"https://docs\\.sandstorm\\.org/en/latest/developing/path/(#[a-z-]+)?"
|
||||
],
|
||||
"models/lib/activityPub.js": [
|
||||
"https://www\\.w3\\.org/ns/activitystreams(#Public)?",
|
||||
|
||||
+1
-1
@@ -194,7 +194,7 @@ if (isSandstorm && Meteor.isClient) {
|
||||
// Since the Sandstorm grain is displayed in an iframe of the Sandstorm shell,
|
||||
// we need to explicitly expose meta data like the page title or the URL path
|
||||
// so that they could appear in the browser window.
|
||||
// See https://docs.sandstorm.io/en/latest/developing/path/
|
||||
// See https://docs.sandstorm.org/en/latest/developing/path/
|
||||
function updateSandstormMetaData(msg) {
|
||||
return window.parent.postMessage(msg, '*');
|
||||
}
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
'use strict';
|
||||
// Sandstorm is at sandstorm.org. v12.69's build-sandstorm stopped because the
|
||||
// certificate of install.sandstorm.io had expired; install.sandstorm.org, the
|
||||
// installer it serves and the dl.sandstorm.org it downloads from are current,
|
||||
// and that installer configures a development server at local.sandstorm.org.
|
||||
// Run: node tests/sandstormOrgHosts.test.cjs
|
||||
const assert = require('node:assert/strict');
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
const { execFileSync } = require('node:child_process');
|
||||
|
||||
const ROOT = path.join(__dirname, '..');
|
||||
const read = rel => fs.readFileSync(path.join(ROOT, rel), 'utf8');
|
||||
let passed = 0;
|
||||
const test = (name, fn) => { fn(); passed += 1; console.log(' ok -', name); };
|
||||
|
||||
test('every Sandstorm build installs Sandstorm from install.sandstorm.org', () => {
|
||||
const releaseAll = read('.github/workflows/release-all.yml');
|
||||
assert.match(releaseAll, /releases\/fetch\.sh" -o \/tmp\/install-sandstorm\.sh https:\/\/install\.sandstorm\.org\n/);
|
||||
for (const wf of ['.github/workflows/sandstorm.yml', '.github/workflows/sandstorm-store.yml']) {
|
||||
assert.match(read(wf), /curl https:\/\/install\.sandstorm\.org \| sudo bash -s -- -d/, wf);
|
||||
}
|
||||
assert.match(read('releases/install-sandstorm.sh'), /curl https:\/\/install\.sandstorm\.org \| bash/);
|
||||
});
|
||||
|
||||
test('negative: no tracked file names a sandstorm.io host', () => {
|
||||
// Kept on purpose: demo.sandstorm.io has no sandstorm.org name; a released
|
||||
// CHANGELOG section is a record; fetch.sh's comment says what happened to
|
||||
// install.sandstorm.io.
|
||||
const KEPT = /(?:^|[^a-z0-9.-])demo\.sandstorm\.io\b|install\.sandstorm\.io's certificate had expired/;
|
||||
const files = execFileSync('git', ['ls-files'], { cwd: ROOT, encoding: 'utf8' }).split('\n')
|
||||
.filter(f => f && f !== 'CHANGELOG.md' && !f.startsWith('old-CHANGELOG/') && f !== 'tests/sandstormOrgHosts.test.cjs');
|
||||
const found = [];
|
||||
for (const f of files) {
|
||||
let text;
|
||||
try { text = read(f); } catch (e) { continue; }
|
||||
if (!text.includes('sandstorm.io') || text.includes('\0')) continue;
|
||||
text.split('\n').forEach((line, i) => {
|
||||
const rest = line.replace(new RegExp(KEPT.source, 'g'), '');
|
||||
if (/(?:^|[^A-Za-z0-9-])(?:[a-z0-9-]+\.)*sandstorm\.io\b/.test(rest)) found.push(`${f}:${i + 1}: ${line.trim().slice(0, 120)}`);
|
||||
});
|
||||
}
|
||||
assert.deepEqual(found, []);
|
||||
});
|
||||
|
||||
console.log(`sandstormOrgHosts: ${passed} tests passed`);
|
||||
Reference in new issue
Block a user