sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
https://sandstorm.io
Other
6.72k stars 705 forks source link

How to give grain network access? #3479

Closed diomat closed 3 years ago

diomat commented 3 years ago

Hello again,

I installed Dokuwiki in Sandstorm and would like to install extensions. Unortunately Dokuwiki can't reach it's "plugin directory"

Error message:

The plugin repository could not be contacted. Make sure your server is allowed to contact www.dokuwiki.org and check your proxy settings.

I read about Sandstorm not giving grains network access by default and Cap'n'Proto and some Powerbox UI in the docs and the Sandstorm website, but I can't find any explanation of how to give grains actual access to the network.

Is it possible? If so, how?

Cheers Claudio

zenhack commented 3 years ago

Getting Dokuwiki to use the right interfaces would require modifications to the app package (cc: @johnbintz, who maintains the package). It would need to make a powerbox request for the resources it wants, in this case the ability to connect to the plugin registry. There is a way for an app to request "full network" access, but (1) only administrators can grant this request, and (2) we try to discourage this when a narrower permission would do, as is probably the case here.

It's also worth noting probably many plugins would have similar problems where they expect access to resources Sandstorm doesn't provide, though I imagine others would probably be fine, depending on what the plugins do. It raises a usability question since downloading arbitrary plugins means some of them will be broken.

https://github.com/zenhack/powerbox-http-proxy might be of interest for this if someone wants to do the work.

ocdtrekkie commented 3 years ago

The "manual install" option should work, where you download the extension from DokuWiki's website and then upload it into the grain. I know that @johnbintz has tested extensions with DokuWiki and that some users use them. Manual install is safer, as Ian says, because your DokuWiki grain is unable to reach out and interact with other things over the Internet.

diomat commented 3 years ago

Ok, thanks for your answers. Doing it manually is too much work considering I will probably install dozens of plugins.

But I have installed a template and an extension successfully by hand, like you suggested trekkie.

Sidenote: The first template borked Dokuwiki though. How would I recover from this in Sandstorm without access to the file system? See: https://github.com/cosmocode/dokuwiki-template-sprintdoc/issues/67

ocdtrekkie commented 3 years ago

John has advice for that on the readme at https://github.com/johnbintz/dokuwiki-sandstorm

diomat commented 3 years ago

John has advice for that on the readme at https://github.com/johnbintz/dokuwiki-sandstorm

I see. Thanks.

Thanks for your help zenhack and trekkie.

zenhack commented 3 years ago

No problem!

ocdtrekkie commented 3 years ago

John is a pretty good and active maintainer too, so you may want to file a feature request for the ability to Powerbox out for plugins or any other issues you have, directly on that repo. :)