ChanServ changed the topic of #sandstorm to: Welcome to #sandstorm: home of all things Sandstorm and Cap'n Proto. Say hi! | Have a question but no one is here? Try asking in the discussion group: https://groups.google.com/group/sandstorm-dev | Channel logs available at https://libera.irclog.whitequark.org/sandstorm
strugee has quit [Quit: ZNC - http://znc.in]
<TimMc> I'm happy to look over the nginx stuff if you'd like another set of eyes.
strugee has joined #sandstorm
<ocdtrekkie> I torched everything I had tried so far, but the goal is basically to add a location to the lemp-box nginx config such that I continue to serve / out of /var/www but that I can do like /footgun-manager and it will go to /opt/app/footgun-manager
<ocdtrekkie> The main problem I seemed to be having was getting PHP to process the files correctly.
strugee has quit [Quit: ZNC - http://znc.in]
<ocdtrekkie> "Primary script unknown" was the error I was hitting, I spent a lot of time in ServerFault/StackOverflow threads.
strugee has joined #sandstorm
jryans has quit [Ping timeout: 248 seconds]
torhex-pasmul[m4 has quit [Ping timeout: 268 seconds]
<ocdtrekkie> So Standalone Domains will not let me host these at their original URLs, sadly. Sandstorm doesn't recognize the hostname I'm CNAMEing to the standalone subdomain. RIP
<ocdtrekkie> That's like... probably for the best anyways?
TMM_ has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
TMM_ has joined #sandstorm
jryans has joined #sandstorm
pie_ has quit []
pie_ has joined #sandstorm
torhex-pasmul[m4 has joined #sandstorm
<TimMc> Standalone Domains?
<TimMc> And what did the footgun-manager do?
<ocdtrekkie> I was thinking if I can get a management tool on there I'd put my sql import/export crud there, for one, maybe eventually a file manager.
<ocdtrekkie> Right now once you restore grain a footgun, you can't add/upload anything else without making it a new grain and breaking any existing links and sharing.
<TimMc> ah
<ocdtrekkie> I hadn't actually put anything there but a hello worldish php file to test Nginx.
<ocdtrekkie> But if you know how to modify nginx to successfully get it to do that I could throw something together.
<TimMc> "Primary script unknown" is pretty mysterious. Kind of sounds like something (what layer is even generating that?) can't find the PHP file to start with, or can't find the CGI executable or something.
<ocdtrekkie> If you look at nginx.conf in the lemp stack, it involves the script_filename variable and stuff I think.
<ocdtrekkie> But search results on primary script unknown, php multiple locations, should start to get you an idea where the difficulties I'm hitting are.
<TimMc> I saw some stuff pointing to systemd's ProtectHome setting. Not sure what to make of it.
<TimMc> (it made me think there was maybe something about not having permissions to read the specified script)
<TimMc> I've seen a post where someone got "Primary script unknown" via Apache, which means it's a layer down -- in php-fpm or PHP itself.
<TimMc> Where is $fastcgi_script_name defined?
<ocdtrekkie> I asked Simon if he maybe had some time in the future to help me with it, and he like, did most of it on the spot.
TMM_ has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
TMM_ has joined #sandstorm
<ocdtrekkie> I randomly discovered something weird/confusing.
<ocdtrekkie> Is Let's Encrypt cross signing with Google Trust Services or something?
<ocdtrekkie> That's the page I'm on and it doesn't mention GTS
<TimMc> I've never heard of GTS.
<ocdtrekkie> But I did a crt.sh and it looks like some of my domains came up with a Google Trust Services cert at the same time as the new Let's Encrypt starting late this year.
<ocdtrekkie> Google Trust Services, one of the many ways the entire Internet stack is critically compromised by a single company who is every role simultaneously.
<ocdtrekkie> Certificate Transparency says they're issuing certs for my domains though.
<TimMc> Oooh... are you sure it's actually Let's Encrypt?
<ocdtrekkie> Cloudflare has it's own certificates in the transparency log.
<TimMc> Do you have an example I can look at?
<TimMc> Looks like it's only the wildcard ones (*.jacobweisz.com)
<ocdtrekkie> Cloudflare is the only other party pulling a wildcard it looks like.
<ocdtrekkie> Maybe for some reason CF is both issuing year long certs itself and pulling 90 day certs from Google?
<TimMc> Or they cut over to using GTS on 2022-06-01.
<TimMc> (on that day, it was issued by both)
<ocdtrekkie> Found a Cloudflare Community thread
<ocdtrekkie> Looks like Cloudflare started issuing "backup certificates" this year.
<TimMc> Interesting!
<ocdtrekkie> And knowing what it is, there it is in my CF dashboard
<ocdtrekkie> I don't suppose as a free plan user they'd take kindly to a request they explicitly not get backup certs for my domains from Google.
<ocdtrekkie> But anyways I guess it clearly states the certificate hasn't been deployed and now I know where it came from, so whatever I guess.
<TimMc> Interesting! I wonder what their rationale was.
<ocdtrekkie> Although I imagine if the source of the compromise is Cloudflare they would also have to revoke all the Google certs they store the private keys for too?
<ocdtrekkie> ...so app icon for a footgun
<ocdtrekkie> any ideas?
<TimMc> An open box labeled "DO NOT OPEN" XD
<ocdtrekkie> That's not bad...
garrison has joined #sandstorm
garrison9 has quit [Ping timeout: 248 seconds]