antoniomika

6 ms·

1.
by antoniomika 6mo ago
We added SSH certificates support to pico.sh [1] and it's been great. Utilizing principals gave us the ability to implement a RBAC like system for specific parts of the pico.sh ecosystem. Users get the flexibility they want with limite
2.
by antoniomika 1y ago
Currently, you can either provide the `BORG_REPO_PERMISSIONS` env var to borg [0] or `--permissions` flag to `borg serve` [1]. You can then enforce this as part of your `authorized_keys` command, for example. [0] https://github.c
3.
by antoniomika 1y ago
This has been replaced with a permissions feature that still provides both delete and overwrite protections. The difference is the underlying store needs to implement it rather than running a server that understands the permission differenc
4.
by antoniomika 1y ago
Check out sysbox[0], it's a runc based runtime that allows you to run "system" containers without privilege. [0]: https://github.com/nestybox/sysbox
5.
by antoniomika 1y ago
Yep! tuns would be the service you want since it can support forwarding arbitrary backends: https://pico.sh/tuns#custom-domains
6.
by antoniomika 1y ago
We’re actually using Unix sockets as the underlying transport layer for this. We’re also not using sshd, we custom wrote our own daemon that’s entire job is tunneling. If you’re curious about this, you can find the project here: https:&#x2
7.
by antoniomika 1y ago
We're actually fully open source and all development occurs in the open! Here's the repo https://github.com/picosh/pico and you can find us on Libera IRC
8.
by antoniomika 1y ago
Hrm that's odd! Just tested and everything looks fine. Any logs or errors you can share?
9.
by antoniomika 1y ago
Our host keys are published here and are durable: https://pico.sh/host-keys
10.
by antoniomika 1y ago
Ashburn, VA and Nuremberg, DE!
11.
by antoniomika 1y ago
Woops! Delete is supported, will update that as well
12.
by antoniomika 1y ago
Correct! The tunnels are protected using ssh auth as well, so you can ensure that only the users you want to access it can.
13.
by antoniomika 1y ago
I'd actually highly recommend taking a look at vaxis ( https://github.com/rockorager/vaxis ). We've moved away from wish/bubbletea and have really enjoyed working with vaxis!
14.
by antoniomika 1y ago
Sorry, this is a focus issue with a tui which we'll fix up soon! Should just need to hit <tab> until OK is highlighted and then press enter
15.
by antoniomika 1y ago
We recently changed our tui framework and the functionality for focus is a bit different. You might have to hit <tab> until `ADD` is highlighted. You can also rsync/scp/sftp an authorized_keys file and we'll add that to
16.
by antoniomika 1y ago
And we're still free! Just added some payments to help keep things running smoothly and allow us to invest in more infrastructure. pgs (static sites) and tuns (tunneling) are both multi-region for example.
17.
by antoniomika 1y ago
And we'd be happy for you too! All of our code/tools are open source and available here: https://github.com/picosh/pico
18.
Bluesky over SSH(termsky.app)
5 points by antoniomika 2y ago|0 comments
19.
by antoniomika 2y ago
Honestly never had a chance to merge it/review it. Once the company wound down, I had to move onto other things (find a new job, work on other priorities, etc) and lost access to be able to do anything with it after. I thought about fo
20.
by antoniomika 2y ago
I wrote a system that did this >5 years ago (luckily was able to open source it before the startup went under[0]). The bastion would record ssh sessions in asciicast v2 format and store those for later playback directly from a control pa
21.
by antoniomika 2y ago
Nope! I utilize env files for all of my password/privileged settings. In the command entry for docker-compose.yml, you can then use a non-templated env var (one that docker-compose itself doesn't fill) by replacing a single dollar
22.
Roll your own ZFS NAS(blog.antonio.cx)
1 points by antoniomika 2y ago|2 comments
23.
by antoniomika 3y ago
Thanks for the feedback and trying things out! - We like the "ssh to create an account" idea too. Makes it easy to confirm a user's identity which is nice and uses tried and true auth/encryption methods. Feedback has bee
24.
by antoniomika 3y ago
We do use Caddy, but just for reverse proxying and handing TLS. We utilize custom http/ssh servers on the backend to handle everything. All of our work is open source and we do development in the open / discuss features over IRC o
25.
by antoniomika 3y ago
Most of the services we've developed at https://pico.sh are more-so geared to "power users". It was difficult to quantify that in a single word so hackers is where we landed. Being users of HN ourselves, it felt l
26.
by antoniomika 3y ago
Thanks for the feedback! This should definitely be supported so we'll get on fixing that!
27.
by antoniomika 3y ago
We don't presently have webhooks, but do have a GitHub action for this ( https://github.com/marketplace/actions/pgs-action ). The goal was to make it easy to deploy using off the shelf tools and not require any
28.
by antoniomika 3y ago
We have rsync implemented with our other pico services, but we need to spend some time to finish implementing the rest of the protocol (support proper diff/upload, this includes recursive file uploads). We'll have that implemented
29.
by antoniomika 4y ago
Thanks for posting! I’d suggest this to anyone that wants a stateless setup method which uses standard SSH key/password auth. sish also has support for internal tunnels (hidden from the world and accessible with local/remote SSH f
30.
by antoniomika 4y ago
Added benefit is sish handles all of the hostname/certificate provisioning on its own and does things like internal tunnels, TCP tunnels, and gives you a little website debugging tool as well. All in a single binary :) Disclaimer: I&#x

More ›