00:33 <kentonv> samba_: To be clear, the only problem with changing Sandstorm's host is that any links you gave to people won't work anymore, obviously, because they contain the wrong host. But if you tell people to change the link to the right host, it will work.

00:35 <samba_> ook kentonv , nice to help me to understand that. do you think I can be able to edit the mongodb to tell the db to point to another hostname?

00:36 <kentonv> samba_: No no, that's not the problem. The hostname isn't in the DB.

00:36 <kentonv> you're imagining that this is way more complicated than it is. :)

00:36 <samba_> what's in the db, just the stuff after the domain name?

00:37 <kentonv> no, none of it is in the DB

00:37 <kentonv> the links are in e-mails and such that you sent to people, not in the DB

00:38 <kentonv> if you e-mailed someone a link to foo.example.com, but later you changed the host to bar.example.com, then the link to foo.example.com won't work anymore, because the site isn't there anymore.

00:44 <kentonv> samba_: to be clear, it's the old e-mails that have broken links. All new e-mails will have correct links. It's because we can't go and update the e-mails that were already sent. :)

00:45 <samba_> ah, ok.. so let me ask one last thing: if I redirect my site.org to sandstorm.site.org and wait a sufficent time, all the new grains will use the new domain and shared link will work with the new domain

00:45 <samba_> is this correct?

00:47 <samba_> also: there's no track in sandstorm, db, cache or anything of the link to a grain ?

00:47 <kentonv> the database only stores the token (the last part of the link). It doesn't store the hostname or domain.

00:48 <kentonv> if you set up a redirect then all the links that already went out will work, yes.

00:49 <TimMc> samba_: There's no "wait a sufficient time" step. As soon as you move the site to the new hostname, all the old emailed and bookmarked links will break; as soon as you put up a redirect at the old host, the links will start working again.

00:50 <TimMc> and you'll need to keep that redirect up indefinitely

00:50 <kentonv> somehow we've accidentally made this seem way more complicated than it is. I'm really just describing what happens any time you change the address of any server. :)

00:50 <kentonv> there's nothing special about Sandstorm here. :)

00:51 <samba_> can you explain better this last part? what is complicated ?

00:51 <kentonv> it's not complicated. That's what I'm trying to say. :)

00:52 <samba_> ah, ok. ahaha nice

00:52 <kentonv> if you have a web site and then you change the address of the web site, then any links that you sent people in the past won't work, unless you have a redirect.

00:54 <TimMc> Well, my first attempt to get someone else to use an app on my sandstorm server went poorly.

00:55 <kentonv> aww, why is that?

00:55 <TimMc> I offered my server for hosting photos. I invited them and explained in the email how to find and install Lychee (which I made preinstalled for ease of use), how to add photos, the need to make a *public* album, how to drag them in... and how to add a sharing link.

00:56 <TimMc> They then posted the link to the grain to social media, which of course didn't work.

00:56 <kentonv> doh

00:57 <TimMc> I wonder if they just missed that step in their eagerness, or if they thought that adding a sharing link made the grain public. Might ask. But it occurs to me that the experience of visiting a grain direcetly could offer both "you need to log in" but also "or ask the owner to send you a link from the Share Access tab".

00:58 <kentonv> when you visit a grain directly that you don't have access to, you should see a "request access" button which e-mails the owner...

00:58 <kentonv> and directs the owner through sharing via the sharing dialog

00:58 <TimMc> Oho, interesting!

00:58 <kentonv> a little trick we copied from Google Docs.

00:59 <TimMc> It sounds like possibly people didn't click it... the owner had said in their post "you won't need to log in".

00:59 <kentonv> hmm you would need to log in to request access

00:59 <TimMc> ah

00:59 <TimMc> These are non-users of the app.

00:59 <kentonv> ah yeah, if you aren't logged in it says "Please sign in to request access"

01:00 <TimMc> yup

01:00 <TimMc> ...and a grain owner is not necessarily an admin, so they can't invite.

01:01 <TimMc> So there might be value in some other mechanism there, or even just additional messaging.

01:04 <TimMc> Context, if you're interested: I've been talking with people about the problem of hosting photos of protests on imgur, facebook, etc. -- don't want identifiable photos of people who do not consent uploaded to centralized sites, but sharing photos of protests builds social energy around them. Sandstorm galleries seem a decent option.

01:04 <kentonv> They can sign in as a guest without an admin invite.

01:04 <kentonv> They won't be able to install apps or create grains but they can sign in.

01:05 <TimMc> (I think it's a great use-case because if the crappy server I'm hosting protest photos on dies without a backup... not a huge deal.)

01:05 <TimMc> By guest you mean Visitor, in teh meaning of the admin panel?

01:05 <kentonv> yes

01:07 <TimMc> I wonder if the page could lower the hurdle to people signing in as new Visitors. "Sign in" implies to me "you must already have an account".

01:10 <kentonv> yeah, unfortunately there isn't a well-understood term that I know of for "identify yourself based on an account you already have with a different, well-known service"

01:11 <TimMc> *nod*

01:12 <kentonv> on oasis.sandstorm.io when logged out you actually see a "create account" form while the upper-right has a "sign in" form, but they do the same thing. Because people *expect* that they have to create an account before they sign in, and they *expect* that once they have created an account they shouldn't choose "create account" again.

01:12 <TimMc> hah

01:13 <TimMc> Someday I want to create a site that says "sign in" and it just... signs you in. No authentication or whatever. Just to surprise people.

01:13 <TimMc> "You are now "terry123572", don't lose that cookie."

01:14 <TimMc> I wonder if the unauthed grain page could just *display* the sign-in/account creation form, since that way people will be able to think "oh, I *have* a Google account, I can do this"

01:15 <kentonv> that's a good point

01:16 <TimMc> It's a pretty spare page as is, so I wouldn't be concerned about clutter... other than a big ol' signin form potentially distracting from the error message.

01:16 <kentonv> plopping the login form there ought to be pretty easy.

09:06 <astuce> hello ! hello !

09:09 <astuce> i'm using haproxy to redirect layer 4 to the sandstorm vm on wich i installed nginx as reverse proxy and i got errors on iframe and wildcard

10:50 <astuce> when i use only nginx reverse proxy, got no prob

15:52 <TimMc> astuce: Is nginx changing the Host header by any chance?

15:56 <astuce> i'll check that :)

15:57 <astuce> but haproxy should not cause pb cause it should just forwards on tcp !

16:09 <TimMc> Do you have evidence haproxy is actually causing a problem? Like, did you have some other mechanism to funnel traffic into the VM before?

20:05 <kentonv> is mrdomino here?

20:26 <kentonv> how about strugee?

21:41 <mrdomino> kentonv: hi

21:41 <kentonv> hi

21:42 <kentonv> you use sniproxy?

21:42 <mrdomino> yeah

21:42 <kentonv> FYI your certs aren't renewing. But I found the bug: https://github.com/sandstorm-io/sandstorm/pull/2848

21:42 <kentonv> going to push a release as soon as the tests pass

21:43 <mrdomino> oh, awesome!

21:43 <mrdomino> thanks

21:45 <kentonv> I think you have enough time left that you won't need to take an action. But if you feel like it, do "sandstorm update" tonight.

21:59 <mrdomino> ok, thanks

22:17 <kentonv> mrdomino: if you could try a "sandstorm update" now, that would be useful to see if it fixes things.

22:18 <mrdomino> done

22:20 <mrdomino> seems like it worked

22:20 <kentonv> hmm, my browser still shows cert expiring tomorrow

22:21 <kentonv> ah but globalsign logs show a cert just issued

22:24 <mrdomino> my logs say it got the new cert and will switch "soon"

22:24 <kentonv> yep, looks like all is good

22:24 <mrdomino> :) thanks

23:21 <jemc> is it possible to use a still-in-development app on oasis (like, copying a grain from my local vagrant-spk dev, perhaps?)

23:23 <jemc> or alternatively, is it possible to publish a "still in development" app to the global app market, in such a way that people won't try to use it too early and give bad reviews that things are still broken?

23:40 <kentonv> jemc: yes and yes. You can upload custom spk files and use them privately on Oasis if you have a paid account. Separately, if you submit an app to the app market, it will immediately show up on https://apps.sandstorm.io?experimental=true -- the experimental index. It won't appear on the main index until we approve it. So you could indicate in the description that it's not ready yet, and I won't approve it.

23:41 <jemc> kentonv: wonderful, thanks for the thorough answer

23:49 <asheesh> kentonv: Thanks for finding that difficulty with sniproxy + cert renewal stuff, and for pinging people about it!