00:38 <asheesh> Yo TC01

00:38 <asheesh> Sounds like your libvirt file share into Vagrant is read-only maybe?

00:39 <asheesh> It's crashing as part of https://github.com/sandstorm-io/sandstorm/blob/master/src/sandstorm/spk.c++#L122

00:39 <asheesh> Can you, like, 'touch /vagrant/party.txt' ? from within 'vagrant-spk vm ssh'?

00:39 <asheesh> I mean

00:39 <asheesh> Can you, like, 'touch /opt/app/party.txt' ? from within 'vagrant-spk vm ssh'?

01:04 <TC01> asheesh: as root, yes, but not as the vagrant@ user

01:05 <asheesh> That sounds like the problem, then, hmm.

01:05 <asheesh> Since 'spk dev' runs as the vagrant user

01:05 <asheesh> Is there a way to fix the file sharing so that _does_ work?

01:06 <asheesh> In a pinch you could "just" chmod 777 the relevant files, but that's not how it's supposed to work. (-:

01:08 <TC01> heh. hm... I'm not sure; /opt/app is owned by me (uid 1000) and vagrant is uid 1001. note that there is no user with uid 1000 inside the vm

01:08 <TC01> I'm guessing this is a quirk of the Fedora vagrant image, perhaps?

01:09 <TC01> maybe touching the files list and chmodding it appropriately is the right thing to do

01:10 <TC01> ...except the line that it's failing at is the mkstemp. hm.

01:18 <TC01> aha. this can apparently be adjusted in the vagrantfile https://stackoverflow.com/questions/17966365/vagrant-chicken-and-egg-shared-folder-with-uid-apache-user

01:26 <TC01> hm. the first few of those solutions don't actually seem to work, but running chmod -R a+w does. I... guess I'll go with that :/

03:14 <asheesh> Whoa, I left the channel by accident! Oops or something.

04:20 <TC01> so I'm able to build a spk now :) said spk works when I install it into a vagrant-spk VM (that is, vagrant-spk setupvm -> vagrant-spk up -> install SPK through web interface -> run app), but fails when I upload it to a "real" (production) sandstorm server

04:21 <TC01> more specifically, what seems to fail is the redirect from flask to the java app, so I'm wondering if I'm doing that incorrectly?

04:21 <TC01> this is all on github now here: https://github.com/TC01/legendsbrowser-sandstorm/; I have the following reverse proxying configuration for apache: https://github.com/TC01/legendsbrowser-sandstorm/blob/master/legendsbrowser-apache.conf#L126

04:23 <dwrensha> TC01: is it possible that you've hardcoded http:// into some URLs that would need to be https:// on a prod server?

04:23 <dwrensha> (just a wild guess)

04:23 <TC01> dwrensha: ooh. that is entirely possible!

04:24 <TC01> one of the ways I attempted to redirect was returning (from flask) a redirect("http://...") so, that obviously wouldn't work

04:24 <TC01> hm.

04:35 <TC01> Having the python code return a redirect("/legends") does not seem to work either (but, again, works fine from vagrant-spk)...

04:37 <dwrensha> what does the failure look like? does your browser console show any error?

04:41 <TC01> the file uploads, and then it just returns to the upload page; exactly as it was before pressing the button to upload

04:41 <TC01> there are two httpd messages in the console: one saying that apr_sockaddr_get_info() failed for sandbox and another complaining I didn't set ServerName in the config so 127.0.0.1 is being used

04:43 <dwrensha> this reminds me of a WordPress issue I had where uploads would fail in dev mode only

04:43 <dwrensha> the problem had to do UIDs

04:45 <dwrensha> https://github.com/dwrensha/wordpress-sandstorm/commit/10569aa1c6fb32271d391f09bacd996d3ec901d6

04:46 <dwrensha> right, so in `spk dev` and on Oasis, /var/ is owned by a different UID than the rest of /

04:46 <TC01> well, the upload itself succeeds: I'm poking around the grain's files on the server to confirm that

04:48 <TC01> is that not the case on production grains?

04:49 <dwrensha> another thing that can cause dev to behave differently from prod is if there are some essential files that are stat()ed but not opened, causing spk dev to not detect that they should be included

04:49 <TC01> So, I thought that might be the case

04:50 <TC01> So I created an entirely different vagrant-spk project using Debian instead of Fedora

04:50 <TC01> and uploaded my SPK to that

04:50 <TC01> and it also worked :/

04:52 <dwrensha> yeah, sounds like it's not a UID thing

04:52 <dwrensha> nor a file include thing

04:56 <TC01> I'm pretty sure it's something to do with the reverse proxying, or more specifically, redirecting from inside one reverse proxy'd app to another. but I'm not really sure how to debug that further

05:18 <asheesh> TC01: You have a reverse proxy involved, yeah? Nginx in the grain or something?

05:18 <asheesh> I think I have some magic config for you.

05:18 <TC01> asheesh: I do; I'm using apache, but could easily switch to nginx :)

05:19 <asheesh> Do you have a grain URL (or sharing link) you can send me?

05:19 <asheesh> Interesting; I know of 0 other apps that embed Apache fwiw, but that's fine.

05:20 <TC01> sure, one sec

05:20 <asheesh> Yay

05:21 <TC01> (I default to apache because I always *think* I know how to configure it and I'm less experienced with nginx, and then I always seem to run into some apparently intractable problem like this... perhaps one day, I will learn)

05:22 <TC01> asheesh: https://main.sandstorm.acm.jhu.edu/shared/Dq7LKNAFmJ7LgkSbI3rysjPiVAmW7_DJYaLgsn_jUGO

05:24 <asheesh> I get this in my JS console:

05:24 <asheesh> > Mixed Content: The page at 'https://main.sandstorm.acm.jhu.edu/grain/EzrRFBSeKRC5aKPLj7qpxv/' was loaded over HTTPS, but requested an insecure resource 'http://64052d2cd8a340e8202a27620477b854.sandstorm.acm.jhu.edu/legends'. This request has been blocked; the content must be served over HTTPS.

05:24 <TC01> aha

05:24 <asheesh> Which Sounds like you're assuming http:// but otherwise things are OK.

05:24 <asheesh> s/Which Sounds/Which sounds/

05:26 <TC01> I'm not quite sure what's causing that. I do have ProxyPass{,Reverse} /legends http://127.0.0.1:58881/legends in the apache configuration...

05:26 <asheesh> Well, here's a different question.

05:26 <asheesh> What code, if any, causes a redirect from / to /legends ?

05:27 <TC01> https://github.com/TC01/legendsbrowser-sandstorm/blob/master/legendsbrowser-flask.py#L78

05:27 <TC01> specifically this: return redirect(lburl), where lburl = "/legends", redirect is flask.redirect

05:27 <TC01> I guess that method must be assuming http.

05:28 <TC01> or... something

05:28 <asheesh> Oh, interesting.

05:28 <asheesh> http://stackoverflow.com/a/26636880

05:29 <asheesh> or http://stackoverflow.com/a/37842465

05:29 <asheesh> If your Apache can set X_FORWARDED_PROTO properly then you should be in business.

05:29 <asheesh> https://github.com/sandstorm-io/vagrant-spk/blob/master/stacks/lemp/service-config/nginx.conf#L31 "Trust the sandstorm-http-bridge's X-Forwarded-Proto."

05:31 <TC01> aha

05:31 <asheesh> I'm struggling to figure out how to copy that header into the request in Apache.

05:32 <asheesh> http://stackoverflow.com/questions/18935448/https-scheme-lost-in-apache-proxy-scenario-upon-redirect-from-gitlab is all about how to hard-coded it to https, but that's not right in general.

05:33 <TC01> right

05:35 <asheesh> SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on

05:35 <asheesh> RequestHeader set X-Forwarded-Proto 'https' env=HTTPS

05:36 <asheesh> If you use those two lines, maybe the right thing will happen?

05:36 <TC01> let's find out!

05:37 <asheesh> : )

05:38 <asheesh> Also looks like you can maybe do

05:39 <asheesh> RequestHeader set X-ForwardedProto "%{HTTP_X_FORWARDED_PROTO}"

05:39 <isd> So, I'm back to trying to wrap websession in something that looks like the standard go http package's handlers, and having touble rigging up the initial session.

05:39 <asheesh> But I'm less sure of that.

05:39 <isd> This shows up when I open the grain's page: http://pastie.org/private/mvhryvqpjimlyfauj3536q

05:40 <asheesh> "method not implemented"... I guess the question is, which method?

05:40 <isd> That interface ID is from APIsession

05:40 <asheesh> There's some subclassing stuff for APIsession and websession.

05:40 <isd> Yeah, it's the one extra thing in params

05:41 <isd> so I'm handing it a websession, and I assume it's actually expecting the whole business

05:42 <isd> but, the ApiSession interface doesn't actually specify any extra methods. That thing it's complaining amount is a member of a struct that's defined inside it

05:42 <isd> Probably I'm just casting it the wrong way or something.

05:43 <asheesh> isd: I'm afraid I am out of my depth for right now on that.

05:43 <isd> I have a hunch.

05:47 <asheesh> Keep me posted TC01. FWIW you could also look at the Sandstorm-specific HTTP headers and use that to "hint" flask but if you can fix it in Apache then that is the best.

05:48 <TC01> asheesh: will do. I think I'm off to bed, but I'll take another look in the morning. thanks for all the help!

05:48 <isd> Yeah, this is more of a capnp issue. I have a rough sense of what's happening; I think the go lib is just not reporting the interface ID. There's some awkwardness binding capnp interfaces to Go interfaces, because Go doesn't expect you to declare the interface, it just... has the methods.

05:49 <isd> Capnp is actually substantially more annoying to work with than most other-language libs I've touched.

05:50 <asheesh> And you're using https://github.com/zombiezen/go-capnproto2 , right?

05:50 <asheesh> iirc it's a pure Go library, at least.

05:51 <isd> asheesh: yeah I am

05:52 <isd> It's still weird trying to map the way Capnp APIs are designed onto other languages

05:53 <isd> Is ApiSession supposed to be the top-level thing I expose to the sandstorm API server?

05:54 <asheesh> ApiSession is for the "Exporting HTTP APIs" feature <https://docs.sandstorm.io/en/latest/developing/http-apis/> and WebSession is for normal grain view, but those are the two, yeah, as I understand it.

05:54 <asheesh> But I should make sure I understand what "UiView" means first, too.

05:55 <asheesh> https://github.com/sandstorm-io/sandstorm/blob/68edc5d41d27c966ece922fd0de4c2188e1ae0a5/src/sandstorm/grain.capnp#L141

05:55 <asheesh> I don't understand personally at the moment how UiView and WebSession and ApiSession interact but that might be useful.

05:58 <isd> UiView has a newSession method that returns a UiSession. {Web,Api}Session appear to be subtypes of that.

06:01 <isd> Ack, no, I'm mistaken, it's websession.

06:01 <isd> not apisession that has that ID.

06:01 <isd> that makes more sense.

06:03 <isd> Ack, yeah, I see what's going on.

06:03 <isd> This is going to be annoying.

06:37 <isd> Huzzah!

06:37 <isd> progress.

06:37 <isd> Yeah, I was doing the casting in a way that loses the type information, so it "forgets" that it's a websession.

07:01 <isd> On the off chance that anyone is curious about what the problem was: https://github.com/zombiezen/go-capnproto2/issues/42

07:02 <isd> Now I have to deal with the awful redirect loop that I'm getting :P

07:06 <isd> Sandstorm seems to strip off the trailing slash from the URL path; is this correct? If so, why?

07:06 <isd> It's probably way too late for anyone to be around...

07:06 <isd> fun fact: go's net/http sometimes generates a redirect that adds it if it's missing

07:07 <isd> hence redirect loop

07:14 <isd> Ah, it's actually adding the leading slash. sandstorm expects relative paths go's ServeMux expects absolute. that's great.

07:14 <isd> well, that's enough for tonight I think

14:46 <Lord> Is there a way to have automatic backup of grains by mail ?

15:52 <mrshu> hi!

15:52 <mrshu> I have a question that might sound a bit stupid so feel free to ignore me

15:52 <mrshu> where do I suggest apps that would be a nice addition to the sandstorm platform?

15:54 <synchrone> https://sandstorm.io/vote

15:54 <synchrone> be sure you're logged in to alpha.sandstorm.io

15:55 <synchrone> otherwise you can't submit new apps

15:55 <mrshu> hanks synchrone

16:18 <mrshu> synchrone: is that link actually still relevant?

16:19 <mrshu> synchrone: there does not seem to be much happening there (but it might be just my wrong impression)

16:20 <synchrone> this was the "official" link

16:20 <mrshu> synchrone: ok, thanks a ton again

16:21 <synchrone> although sandstorm devs do not actually port the apps themselves

16:21 <synchrone> so it's more for the community to be guided by

16:31 <TC01> asheesh: got it to work! the SetEnvIf/RequestHeader lines you pasted, combined with setting "app.wsgi_app = ProxyFix(app.wsgi_app)" in flask, made it do the right thing

16:36 <dwrensha> TC01: nice!

17:46 <mnutt> another thing that would be really helpful to know is what sorts of browsers people use who are using sandstorm. for instance, the file upload capability in davros is kind of a mess because it is supporting upload via html5, flash, and silverlight. I'd love to replace it with html5-only code that's much cleaner but am wary of just dropping support without knowing if anyone is using it or not

18:00 <zarvox> mnutt: The oldest MS browser that Sandstorm supports is IE11. I'm not sure what the precise numbers are, but I'm pretty sure you can assume a reasonably modern Chrome or Firefox for all but a very long tail of usage.

18:01 <mnutt> wow, nice. pretty sure they all have html5 support then

18:02 <zarvox> Yeah. http://caniuse.com/#feat=fileapi suggests that you should be able to count on FileReader existing

18:03 <zarvox> though IE11 is missing FileReader.readAsBinaryString()

22:06 <sarahsharp> hey asheesh: is there any chance someone could package CiviCRM for sandstorm.io? I would love to try it out for Outreachy.