Deploy stashboard without using AppEngime about stashboard

[anarcat]

You can install App Engine yourself, it's free software and available over 'pip'. Would that be sufficient?

[anarcat]

I was able to deploy this on a VPS using those simple commands:

git clone https://github.com/twilio/stashboard.git
wget https://commondatastorage.googleapis.com/appengine-sdks/featured/google_appengine_1.9.0.zip
unzip google_appengine_1.9.0.zip
cd google_appengine
./dev_appserver.py ../stashboard/stashboard/

... and it just works!

[anarcat]

However, with such a deployment, the app listens only on localhost. You can change that with the --host argument, however then the /admin section is completely available to the public without authentication so this is rather dangerous.

[kyleconroy]

While you can follow the steps @anarcat posted, stashboard is not meant to be deployed onto a VPS. The admin section is completely unsecured. Also, the appengine_sdk is meant for local development, not production deploys.

[anarcat]

This is quite unfortunate. There are numerous people (including me) trying to reduce the network's dependence on google products for various political, economic and security reasons. Forcing people to use Appengine is basically a blocker for me that makes this product unuseable.

[sesam]

You could try joining forces with those severak others and get this working
on the opensource version of appengine sdk, as linked by stashboard authors
On May 13, 2014 4:10 PM, "anarcat" [email protected] wrote:

This is quite unfortunate. There are numerous people (including me) trying
to reduce the network's dependence on google products for various
political, economic and security reasons. Forcing people to use Appengine
is basically a blocker for me that makes this product unuseable.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/64#issuecomment-42959596
.

[anarcat]

Sorry, I don't understand that: from what I can tell, stashboard does work with the SDK, there are just a few rough edges (e.g. #66) and it is designated (rather inexplicably) as being "not for production".

What link are you refering to?

[sesam]

I was trying to say "patches welcome (probably)" in a nice constructive
way. To get this to work for your case, a good first step is to be nice to
the people who made this software free open source instead of criticising
that their use case isn't identical to yours.

On Thu, May 15, 2014 at 2:44 PM, anarcat [email protected] wrote:

Sorry, I don't understand that: from what I can tell, stashboard _does_work with the SDK, there are just a few rough edges (e.g.
#66 #66) and it is
designated (rather inexplicably) as being "not for production".

What link are you refering to?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/64#issuecomment-43204304
.

[anarcat]

I guess I understand that part so far. :p I thought you refering to existing efforts to port this or appengine, but maybe i misunderstood.

I would be more comprehensive if #66 was still open... but then again, i guess it's unfair to expect anything at all here. :)

cheers

[anarcat]

@sesam with time... i feel i need to apologize here. i am very grateful to @twilio folks for publishing their code publicly! i was a little frustrated my issues were closed so promptly - i believe there is a genuine use case in hosting this outside of google, and i was hoping to use those issues to track the various problems that needed to be fixed and document how to fix them.

but my sarcasm was a bit over the line, and i apologize if i hurt any feelings in doing so. i still hope to be able to participate in this project by extending it to be more usable outside of the google silo, but i totally understand if that work isn't accepted here...

thanks and apologies again.

[sesam]

I hope we've short-circuited any hurts, and while I can't guarantee patches
will be accepted, running a parallell repo or semi-official branch with
some patches might get a workable login protection in front of /admin. An
idea for an ugly quick hack, is to detect when not on appengine and then
activate a set-and-forget admin password that Chrome/any password manager
can store. For any better security, the weakest link may be more work to
strengthen.
On May 23, 2014 5:52 PM, "anarcat" [email protected] wrote:

@sesam https://github.com/sesam with time... i feel i need to apologize
here. i am very grateful to @twilio https://github.com/twilio folks for
publishing their code publicly! i was a little frustrated my issues were
closed so promptly - i believe there is a genuine use case in hosting this
outside of google, and i was hoping to use those issues to track the
various problems that needed to be fixed and document how to fix them.

but my sarcasm was a bit over the line, and i apologize if i hurt any
feelings in doing so. i still hope to be able to participate in this
project by extending it to be more usable outside of the google silo, but i
totally understand if that work isn't accepted here...

thanks and apologies again.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/64#issuecomment-44028471
.

[anarcat]

that would be good enough for me. that or relying on the webserver authentication, which can then plugin to whatever we need...