From b5454c1022618951db7dc42aa0b36ce9f5a91ef2 Mon Sep 17 00:00:00 2001 From: Mitchell-Johnson Date: Wed, 23 Sep 2026 18:59:42 -0700 Subject: [PATCH] Public downloads: the installer and the updater come from Gitea releases, no token REQUIRE_SIGNIN_VIEW is off and mitchell/hamlab is public, so anyone can clone it or pull a release. The other five repos are individually private and 404 to anonymous. Gitea resolves releases/download/latest/, so the install one-liner and HAMLAB_URL point at the newest release and never need changing. Co-Authored-By: Claude Opus 5 --- PLAN.md | 33 +++++++++++---------------------- README.md | 9 +++++---- install.sh | 4 +++- 3 files changed, 19 insertions(+), 27 deletions(-) diff --git a/PLAN.md b/PLAN.md index d6206c3..35cc28c 100644 --- a/PLAN.md +++ b/PLAN.md @@ -398,6 +398,17 @@ something long in one, switch away and back, refresh — it's all still there. **not** part of `make deploy`, because deploy pushes this build to the machines this hub owns while publishing offers it to every install anywhere, and one tag per deploy would be noise. Re-publishing a version needs `--force`. + **Public since 2026-09-23**, at Mitchell's instruction and after the trade was put to him + twice: Gitea's instance-wide `REQUIRE_SIGNIN_VIEW` is off and `mitchell/hamlab` is marked + public, so anyone can browse it, clone it and download a release with no account. The + other five repos there are each marked private and are invisible — an anonymous request + for one is a 404, not a login prompt — registration is still disabled, and new repos + still default to private. No token is needed by anything any more (the read-only one was + revoked; only `hamlab-publish`, which creates releases, remains). Gitea resolves + `releases/download/latest/`, so `install.sh` and `HAMLAB_URL` now point straight + at the newest release and never need changing; the rolling copy on + `hamlab-demo.bigham.dev` stays as a mirror. What is public is the source, the history, + `BUGS.md` and this file — which describes the lab and names the console's hostname. - **Auth hardening** — WebAuthn passkeys (phone Face ID), TOTP fallback, optional NPM access list restricting to WireGuard/LAN. - **Files tab** — **shipped 2026-09-18** (`internal/files`, `Files.tsx`): browse from @@ -426,28 +437,6 @@ something long in one, switch away and back, refresh — it's all still there. ## To do -- **Somewhere public to download from** — asked for 2026-09-22, half done. The **updater** - shipped 2026-09-23 (above) and reads releases from Gitea, but `git.bigham.dev` runs with - `REQUIRE_SIGNIN_VIEW=true`, so those releases are reachable only with a token. That is - fine for this fleet — each machine carries a read-only `read:repository` token — and no - use at all to a stranger running the `install.sh` one-liner, who still gets the rolling - copy on `hamlab-demo.bigham.dev`. What is left is deciding where a public download - actually lives: - - **Lower the wall on Gitea.** `REQUIRE_SIGNIN_VIEW=false` and per-repo visibility does - the rest: every repo there is private and stays hidden, and only a repo marked public - is visible. That is how Gitea is meant to be configured, and it is the one change that - makes "releases on my Gitea" literally true. It is an instance-wide posture change on - a public hostname, so it is Mitchell's call — the same trade was declined once before - (`docs/docker.md`, the demo site's `install.sh` is hosted outside Gitea for exactly - this reason). - - **Or keep the wall and keep the demo site** as the public face: `make publish` already - writes the rolling `dl/` directory there, and a generated index page (version, built - when, a row per architecture with size and checksum, the one-line install, and that - the binaries are unsigned and served from his own box) would finish the "page" half - without touching Gitea at all. - - Either way the release notes and version history live on Gitea, and the updater does - not care which of the two it is pointed at. - - **Deprecate copyparty** — asked for 2026-09-23, not started. `copyparty` on `grid` (`copyparty.service`, `:3923`, `/etc/copyparty.conf`, serving all of `/tank` as user `core` with one account behind NPM) overlaps the **Files** tab almost entirely. The aim diff --git a/README.md b/README.md index ec49949..e1288f3 100644 --- a/README.md +++ b/README.md @@ -20,15 +20,16 @@ sudo ./hamlab-linux-amd64 install # that's the whole install or, from wherever `make release` output is served: ```sh -curl -fsSL https://hamlab-demo.bigham.dev/install.sh | sh # asks: user, address, HTTPS, firewall, password -curl -fsSL https://hamlab-demo.bigham.dev/install.sh | sh -s -- --yes # asks nothing, all defaults -curl -fsSL https://hamlab-demo.bigham.dev/install.sh | sh -s -- --listen 0.0.0.0:8100 --tls auto # flags go to `hamlab install` +curl -fsSL https://git.bigham.dev/mitchell/hamlab/releases/download/latest/install.sh | sh # asks: user, address, HTTPS, firewall, password +curl -fsSL https://git.bigham.dev/mitchell/hamlab/releases/download/latest/install.sh | sh -s -- --yes # asks nothing, all defaults +curl -fsSL https://git.bigham.dev/mitchell/hamlab/releases/download/latest/install.sh | sh -s -- --listen 0.0.0.0:8100 --tls auto # flags go to `hamlab install` ``` `install.sh` is a wizard when there is a terminal (it reads answers from `/dev/tty`, so it works piped from curl) and silent otherwise. Either way it picks the build for `uname -m`, checks it against `SHA256SUMS` and runs `hamlab install`; re-running it upgrades in place. -`make publish` puts a release where that URL serves it (`HAMLAB_URL` points it elsewhere); run it beside the `hamlab-linux-*` files and it installs offline. +`latest` is an alias Gitea resolves to the newest release, so that URL never changes. +`make gitea-release` publishes a release there (`HAMLAB_URL` points the installer elsewhere); run the script beside the `hamlab-linux-*` files and it installs offline. `hamlab install`: - copies the binary to `/usr/local/bin` (`--prefix`), atomically; diff --git a/install.sh b/install.sh index cd097e5..0c2d394 100755 --- a/install.sh +++ b/install.sh @@ -15,6 +15,8 @@ # ./install.sh # beside the hamlab-linux-* files: installs offline # # HAMLAB_URL where hamlab-linux-, SHA256SUMS and VERSION are served from — +# by default the newest release on Gitea; "latest" is an alias Gitea +# resolves to the most recent release, so the URL never needs changing — # any static file host, or a Gitea/Forgejo release's download URL # HAMLAB_TOKEN access token, when that place is a private Gitea/Forgejo repo # NO_COLOR plain output @@ -22,7 +24,7 @@ # POSIX sh: runs under dash, busybox ash and bash alike. set -eu -HAMLAB_URL="${HAMLAB_URL:-https://hamlab-demo.bigham.dev/dl}" +HAMLAB_URL="${HAMLAB_URL:-https://git.bigham.dev/mitchell/hamlab/releases/download/latest}" BUILT_FOR="@VERSION@" # filled in by `make release` # ─────────────────────────────────────────────────────────────── looks ──