10:27 <drebs> hello, i'm observing grain sizes in my installation, and they "seem" to grow more than (what i think) they should. Is there a way to monitor grain sizes or to have a comparison of what should be the expectation for grain size growth? Sometimes just loading an etherpad grain causes a 200k increase. Is that expected?

11:36 <xet7> drebs: grains are at servers in /opt/sandstorm subdirectories, you get size as root with linux command "du -sh directoryname"

11:38 <xet7> drebs: another way is to browse with "apt-get install ncdu" and then at /opt/sandstorm do "ncdu" so you get sizes at current directory and can browse to subdirectory in textmode GUI

11:41 <xet7> drebs: 3rd way is in grains parent directory to list all subdirectory sizes and save those to textfile like this: du -sh */

11:41 <xet7> correction: du -sh */ >> sizes.txt

11:42 <xet7> for following those for longer time, you could in cron script save sizes to text daily, with day number etc

11:43 <xet7> some day etc example at https://github.com/xet7/admin-scripts/blob/master/move-old-irclogs.sh

11:56 <drebs> xet7, thanks a lot. I will setup some monitoring to check if my feeling about abnormal grain size is corrett.

11:56 <drebs> *correct

11:56 <xet7> :)

12:21 <drebs> an unrelated question: is it possible to turn on line numbers for etherpad inside sandstorm?

13:25 <afuentes> My wildcard certificate is about to expire. Hows the sandstorm-letsencript wildcard certificate status?

13:25 <afuentes> Does it already work?

13:26 <afuentes> I saw the letsencrypt announcement long ago that they caved in and were going to provide wildcard certificates

13:30 <CcxWrk> afuentes: https://community.letsencrypt.org/t/acmev2-and-wildcard-launch-delay/53654

13:30 <CcxWrk> > No release date yet but we’re getting closer. Thank you for your patience.

13:39 <afuentes> Balls

13:39 <afuentes> Thanks CcxWrk :)

13:40 <afuentes> Still a month until my cert expires... cross fingers :)

15:23 <ocdtr_web> drebs: The Sandstorm Etherpad package is set up with the plugins at packaging time. In order to add plugins, you'd have to create a fork and repackage it with your changes. And currently, there'd be no easy way to move your data between forks.

15:24 <ocdtr_web> With regards to grain size, there's a decent chance some of the unexpected growth is your Sandstorm debug log. Each grain has it's own log, which Sandstorm does automatically truncate. Etherpad also keeps a lot of file history content, so they tend to naturally grow over time.

15:25 <ocdtr_web> A shared document I use a lot between three of us that's been consistently overwritten for a couple years reads as being 26 MB in size. That's probably almost entirely file history, since it's about two pages of text currently in it.

15:30 <ocdtr_web> afuentes: Worth noting: Sandstorm probably won't auto-handle the LE wildcard once support is available, as it can't answer the DNS challenge.

15:30 <ocdtr_web> You will need to use like a Nginx reverse proxy type setup.

15:39 <drebs> ocdtr_web, thanks for the info. Did you really mean "which Sandstorm does automatically truncate" or should it be doesn't?

15:39 <drebs> (i ask because if it truncates i shouldn't see the growth, right?)

15:41 <afuentes> ocdtr_web, that would be unfortunate. I mean, if the wildcard certs have 3 months expire date like regular certs

15:41 <afuentes> Still doing it manually every 3 months is worth it :)

15:43 <afuentes> ocdtr_web, how come it cant respond the dns challenge? I picture asking to random.sandstom.mydomain.com... which sandstorm is currently replying to, right?

15:44 <ocdtr_web> drebs: It DOES truncate Sandstorm's log (though from a fresh grain, it will initially seem like an increase until it hits the truncate point)

15:45 <ocdtr_web> But it does not truncate Etherpad's own file history.

15:46 <ocdtr_web> afuentes: I mean, you just have to set up something in front of your Sandstorm to handle the LE renewals. There will almost certainly be documentation on it at some point, since it'll be a pretty popular setup.

15:47 <ocdtr_web> I think you have to actually update DNS, whereas Sandstorm just processes URLs routed to it by a wildcard.

15:47 <drebs> ocdtr_web, thanks

15:50 <ocdtr_web> Ideally, it'd be nice if Etherpad had some options to truncate the pad history.

15:54 <drebs> ocdtr_web, so what's the maximum size of the debug log?

15:55 <afuentes> ocdtr_web, thats kind of weird. Anybody using this kind of certs are going to have the same problems. Short-lived certs if you have to update them manually. Also, whats the point of updating dns to reply the challenge? If you reply to <random>.yourdomain.com means that you are in control of *.yourdomain.com

15:56 <afuentes> What am i missing here? Can you link me to where this info is?

15:57 <afuentes> (just out of curiosity, since it will either be possible or not :))

15:57 <ocdtr_web> afuentes: I don't know the ins and outs of LE, but Kenton does not believe Sandstorm can handle it without some manual intervention.

15:57 <ocdtr_web> https://letsencrypt.org/docs/client-options/ has some details on how LE handles requests for updated certs.

15:58 <afuentes> does sandstorm use cerbot?

15:59 <ocdtr_web> Do not believe so.

15:59 <ocdtr_web> drebs: Looks like the max size of a grain debug log should be 1 MB.

16:01 <afuentes> ocdtr_web, I would even be okay with some payed version to be able to do it automatically. Im already paying the cert mafia, i might as well paying to someone doing good as a replacement :)

16:03 <ocdtr_web> afuentes: As said above, someone will likely devise documentation on how to set it up. It just won't likely be all handled inside Sandstorm itself.

16:15 <drebs1> ocdtr_web, thanks again

17:02 <xet7> afluentes: Sandstorm's *.sandcats.io uses normal wildcard cert. If you want to your your own domain, you can have webserver like Nginx in front of it, Nginx can use Certbot. Or if there is Caddy webserver, Caddy handles updating LE automatically.

17:03 <xet7> afluentes: *.sandcats.io certs are free when installed with sandstorm

17:03 <xet7> for you

17:03 <xet7> though it's possible it costs something for Sandstorm server admins

17:52 <afuentes> xet7, thanks, I know. Im using my own domain

17:53 <afuentes> Its actually just too look cool, because im most of the time the only user of it