• 0 Posts
  • 16 Comments
Joined 2 months ago
Cake day: July 22nd, 2024
  • Lucy :3@feddit.orgtoSelfhosted@lemmy.world•Are selfhosted Piped instances still working?English
    2·
    25 days ago

    I have dozens of services, and most of them start their own http server, using a regular websocket binding to localhost and a port. As most of them are web services, I run out of standard ports pretty fast - 80, 8000, 8080, and then 8069, 8070 etc. Keeping tracks is a pain. Docker just makes it worse. Also, all non-web services have standard ports - 25, 456 for smtp/smtps, which nmap identifies. In my current state, an attacker could just open a random port on my server and I couldn’t notice.

    Unix sockets are basically just regular files, where http traffic is written to and read from. So eg. gitlab-puma or piped-proxy creates the file /run/gitlab/gitlab.socket respectively /run/piped/proxy.socket, and my reverse proxy (nginx) communicates through that socket with the service, just as it would through a regular websocket using localhost and a port. Except unix sockets are easily identifiable (they are named and put in dirs dependent on their service) and can be access controlled much better - instead of any service in the whole network (assuming no firewall is present on the device, usually behind a consumer grade router) being able to communicate with the service, only members of the group http (nginx) or the services’ user can read/write to the socket, assuming nginx is save and root, http and the services’ user are not compromised, not even an attacker with access to the server can read any traffic, as it’s encrypted (https) to nginx, and not readable to other users through the socket file. It’s also a bit more performant. The catch is: Very few programs support it, and many of the ones that do implement it incorrectly. Usually I would create a specific user for a service (or sysusers.conf file would), under which the service runs in systemd, and which therefore owns the socket file. The http user is then added to the group of the services user, or the file’s group is set to http. With 770 (or 660) permissions (Read and write for the user and all users in the group, including http) everything would be fine, however, they’re usually 755, so only actually writeable for the owner, and not the group, so http, which makes communication impossible. And as just creating the file with correct ownership and permissions beforehand results in the service believing the socket is already in use, I usually have to patch the actual program itself. Maybe I can do something with systemd’s PostExec etc. tho.

    And piped-backends library does not support unix sockets at all - so I will need to extend the incredibly complicated library itself to get what I want. Damn.

  • Lucy :3@feddit.orgtoFunny@sh.itjust.works•A mysterious file
    9·
    26 days ago

    From Wikipedia

    Lego Mindstorms […] is a discontinued line of educational kits for building programmable robots based on Lego bricks. It was introduced on 1 September 1998 and was discontinued on 31 December 2022.

    Holy … that sounds like cashing in for christmas 2022 and then just dropping all support, including addons and the (required!) software.

  • Lucy :3@feddit.orgtoFunny@sh.itjust.works•A mysterious file
    27·
    27 days ago

    I only know Mindstorms Ev3, which is an electric robotics set. You basically have a main brick, 15105 cm or smth, and motors and some sensors. You can plug it all together with phone wires (I believe), and program the main brick either with scratch(-like stuff), or python afaik. There are some official models you can build with it, eg. a car.

    I prefer Fischertechnik’s Robotics TXT Controller more though, as Lego’s system is just yet another closed and very limited system, eg. only the official mindstorms motors are supported. It’s also more open, running an open source rom of Linux, and using the same +/- plug system for basic motors (+ support for servo and stepping motors) since the very beginning - from simple regulatable transformers in the last century over battery/accu boxes to simpler remote controlled boxes and the TXT controller. And it works with multiple remotes, the app or just by using python, the camera and object recognition. All which Lego also can’t do, to no surprise. And, of course, it wasn’t killed off to be replaced by a slightly different and therefore incompatible system.