Skip to content

Commit

Permalink
grammatical corrections and reformattings for legibillity (#32)
Browse files Browse the repository at this point in the history
  • Loading branch information
Surrogard authored Sep 27, 2024
1 parent c76c262 commit 65d29b1
Show file tree
Hide file tree
Showing 13 changed files with 108 additions and 106 deletions.
7 changes: 3 additions & 4 deletions docs/administrating/installation.md
Original file line number Diff line number Diff line change
Expand Up @@ -120,12 +120,11 @@ By-default, the service will be available over http://127.0.0.1:3434 with creden
There are several exposed parameters (see Dockerfile), however, data stored in `/data` and
initial admin password is `admin` (change it!).

The docker image contains pre-installed python3 (+requests), node js (+axios) and php to let experiment with default
The docker image contains pre-installed python3 (+requests), node js (+axios) and php to let you experiment with default
functions.

There is light (around 8MB) docker image: `reddec/trusted-cgi:latest-light`. It contains only minimal set of
pre-installed
packages and could be useful to run pre-compiled binary functions or shell lambdas. Or to use as a base image.
There is a light (around 8MB) docker image: `reddec/trusted-cgi:latest-light`. It contains only the minimal set of
pre-installed packages and could be useful to run pre-compiled binary functions or shell lambdas. Or to use as a base image.

## From source

Expand Down
34 changes: 17 additions & 17 deletions docs/administrating/policies.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ nav_order: 2

Before `0.3.5` most security settings were in manifest.

Policy is a combination of restrictions described below, however, they can be applied to
`Policy` is a combination of restrictions described below, however, they can be applied to
several objects.

For example, you can make one policy called `my-customer-1`, that will contain several tokens,
Expand All @@ -18,42 +18,42 @@ Currently, lambda can be linked to only one policy, but one policy could be link

## Checks

Security checks aimed to restrict access to function to the limited group of clients.
Security checks are aimed to restrict access to function to the limited group of clients.

All security checks performed after application resolution. Each rule combined by AND operator.
For example, if restrictions by IP defined as well as restrictions by Origin, both limitations will
All security checks are performed after application resolution. All rules are combined by AND operator.
For example, if restrictions by IP are defined as well as restrictions by Origin, both limitations will
be applied for a client request.

In case of failure the 403 Access Deny will be returned.
In case of failure the `403 Access Denied` will be returned.

UI:

1. click to any created application
2. click to security tab
1. click on any created application
2. click on the `Security` tab

### Tokens

Restrict incoming requests by `Authorization` header.

Header should contain one of defined tokens.
Header should contain one of the defined tokens.

If `public` flag is true, the setting will be ignored.
If the `public` flag is true, the setting will be ignored.

By default, UI generates tokens by UUIDv4 algorithm, however arbitrary text could be used and defined during setup.

The performance almost not impacted regardless number of tokens.
The performance is almost not impacted regardless number of tokens.

### Origin

Restrict access by `Origin` header. Useful to from where (domains) browser clients could access
Restrict access by `Origin` header. Useful to limit from where (domains) browser clients could access
function.

If at least one origin defined, the security check becomes mandatory.
If at least one origin is defined, the security check becomes mandatory.

By standard, the field should contain a domain with protocol (ex: https://example.com) however backend is
By standard, the field should contain a domain with protocol (ex: https://example.com) however the backend is
not checking validity of the content and arbitrary text could be used and defined during setup.

Wildcards not supported.
Wildcards are not supported.

The performance almost not impacted regardless number of origins.

Expand All @@ -64,13 +64,13 @@ Restrict access by a client IP.
**Not working properly in docker container**: docker proxies all requests, so client IP will be a docker IP
instead of real address.

Should be defined in default notation `XXX.YYY.ZZZ.TTT`, IPv6 has to be supported but not tested.
Should be defined in default notation `XXX.YYY.ZZZ.TTT`, IPv6 is supported but not tested.

The performance almost not impacted regardless number of IP.
The performance is almost not impacted regardless of number of IPs.

Since `0.3.8` the following headers are respected if `--behind-proxy` (`BEHIND_PROXY=true`) flag is set:

- `X-Real-Ip`
- `X-Forwarded-For`

The first address in chain will be used as client address.
The first address in the chain will be used as client address.
20 changes: 10 additions & 10 deletions docs/development.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,41 +5,41 @@ nav_order: 999
---
# Development

The project has Linux-specific features and aimed to be run in Linux ecosystem, however
client control utility (cgi-ctl) and server (trusted-cgi) shall work on most platform (Darwin, Linux, Windows).
The project has Linux-specific features and is aimed to be run in the Linux ecosystem, however
the client control utility (cgi-ctl) and server (trusted-cgi) should work on most platforms (Darwin, Linux, Windows).

Requirements for backend

* go 1.13 and upper - see [Go installation manual](https://golang.org/doc/install)
* go 1.13 and higher - see [Go installation manual](https://golang.org/doc/install)
* make - should be available in your OS repository
* [git with LFS](https://git-lfs.github.com/) - for cloning binary UI

IDE:

* I am personally using professional [Jetbrains Goland](https://www.jetbrains.com/go/)
* Someone can prefer use free Visual Studio Code with Go plugin
* Or use Liteide
* Another possibility would be the free Visual Studio Code with Go plugin
* Or use LiteIDE

Quick project setup:

1. Install [Go](https://golang.org/doc/install), setup `GOPATH` and add `GOPATH/bin` in your `PATH` variable (should be described in the link)
2. Clone project somewhere (not required only under `GOAPTH`, because the project uses modules): `git clone https://github.com/reddec/trusted-cgi.git`
2. Clone the project somewhere (not required only under `GOAPTH`, because the project uses modules): `git clone https://github.com/reddec/trusted-cgi.git`
2.1 Pull LFS files: `git lfs pull`
3. Change directory to the cloned folder (`cd trusted-cgi`) and build it: `go get -v ./cmd/...`
4. Test project build: `trusted-cgi --help` (version should be `dev`)
5. Run locally: `trusted-cgi --dev`

When you decide to change something and check - repeat 3, 4, 5, however in a matured IDE (like Goland) it's
possible to run `main.go` directly from UI that allows you to attach debugger if needed.
possible to run `main.go` directly from UI that allows you to attach the debugger if needed.

This is example of my runner in Goland (nothing complicated, but change working directory to your folder out of GIT tracking)
This is an example of my runner in Goland (nothing complicated, but change working directory to your folder out of GIT tracking)

![image](https://user-images.githubusercontent.com/6597086/83396622-d9568b80-a42e-11ea-8be4-93f7b4cff0c2.png)


## Embedding UI

Requirements should be same as for UI [sub-repo](https://github.com/reddec/trusted-cgi-ui)
Requirements should be the same as for UI [sub-repo](https://github.com/reddec/trusted-cgi-ui)

```shell
make clean
Expand All @@ -52,4 +52,4 @@ In case of API changes, generated files should also be update by following comma

```shell
make regen
```
```
16 changes: 8 additions & 8 deletions docs/examples/blog.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,17 @@ nav_order: 1
---
# Blog example

This is basic public comment board example:
This is a basic public comment board example:

* anyone can post comment with any name
* anyone can post comments with any name
* only last N post will be displayed
* comments stored in SQLite

**Do not use the example in production!** Comments board without authorization it's a bad, very bad idea.
**Do not use the example in production!** The comments board is without authorization! It's a bad, a very bad idea.
However, the example should be safe for XSS attacks due to user data escaping.

* Create new project based on python template (UI-> Dashboard -> Python)
* Click files, then click on app.py file. Copy following content:
* Create a new project based on python template (UI -> Dashboard -> Python)
* Click `Files`, then click on `app.py` file. Copy following content:

```python
import os
Expand Down Expand Up @@ -67,7 +67,7 @@ with sqlite3.connect(db_name) as conn:
f.write(page)
```

* In UI create directory `static`, click on it, create file `index.html` and put following content:
* In the UI create the directory `static`, click on it, create the file `index.html` and put the following content:

```html
<html><body>
Expand All @@ -81,7 +81,7 @@ with sqlite3.connect(db_name) as conn:
</body></html>
```

* Setup mapping for form values: click on Mapping tab and add:
* Setup mapping for form values: click on the `Mapping` tab and add:
* output headers: `Content-Type: text/html`
* query params should be mapped as: comment to `COMMENT` and name to `NAME`
* set static dir to `static`
Expand All @@ -92,5 +92,5 @@ with sqlite3.connect(db_name) as conn:

Done!

Now open URL from overview section by browser and try to post something.
Now open the URL from the `Overview` section by browser and try to post something.

36 changes: 18 additions & 18 deletions docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,18 +8,18 @@ Lightweight self-hosted lambda/applications/cgi/serverless-functions engine.

![Download](./assets/interaction.svg)

The process flow is quite straightforward: one light daemon in background listens for requests and launches scripts/apps
on demand. An executable shall read standard input (stdin) for request data and write a response to standard output (stdout).
The process flow is quite straightforward: one light daemon in the background listens for requests and launches scripts/apps
on demand. An executable reads standard input (stdin) for request data and writes a response to standard output (stdout).

Technically any script/application that can parse STDIN and write something to STDOUT should be capable of the execution.
Technically any script/application that can parse STDIN and write something to STDOUT should be capable of execution.

Trusted-cgi designed keeping in mind that input and output data is quite small and contains structured data (json/xml),
however, there are no restrictions on the platform itself.
Trusted-cgi is designed keeping in mind that input and output data is quite small and contains structured data (json/xml),
however, there are no restrictions on the platform itself (see "Limits" tab in Lambda UI).

Key differences with classic CGI:

* Only request body is being piped to scripts input (CGI pipes everything, and application has to parse it by itself - it could be very not trivial and slow (it depends))
* Request headers, form fields, and query params are pre-parsed by the platform and can be passed as an environment variable (see mapping)
* Only the request body is being piped to scripts input (CGI pipes everything, and application has to parse it by itself - it could be very non-trivial and slow (it depends))
* Request headers, form fields, and query params are pre-parsed by the platform and can be passed as environment variables (see mapping)
* Response headers are pre-defined in manifest

Due to changes, it's possible to make the simplest script with JSON input and output like this:
Expand All @@ -39,12 +39,12 @@ Keep in mind, the platform also adds a growing number of new features - see feat

It's best (but not limited) for

* for hobby projects
* for experiments
* for projects with a low number of requests: webhooks, scheduled processing, etc..
* for a project working on low-end machines: raspberry pi, cheapest VPS, etc..
* hobby projects
* experiments
* projects with a low number of requests: webhooks, scheduled processing, etc..
* projects working on low-end machines: raspberry pi, cheapest VPS, etc..

However, if your projects have overgrown the platform limitations, it should be quite easy to migrate to any other solutions, because
However, if your projects have exceeded the platform limitations, it should be quite easy to migrate to any other solutions, because
most low-level details are hidden and could be replaced in a few days (basically - just wrap script to HTTP service)

Also, it is possible to scale the platform performance by just launching the same instances of the platform
Expand All @@ -57,13 +57,13 @@ with a shared file system (or docker images) with a balancer in front of it.

The idea came from the past: CGI. At the beginning of the Internet, people have been making a simple script that receives incoming bytes over STDIN
(standard input) and writes to STDOUT (standard output). The application server (aka CGI server), accepts clients,
invokes scripts and redirects socket input/output to the script. There are a lot of details here but this is a brief explanation.
invokes scripts and redirects socket input/output to the script. There are a lot more details here but this is a brief explanation.

After more than 20 years the world spin around and arrived at the beginning: serverless functions/lambda and so on.
It is almost CGI, except scripts became docker containers, and we need many more servers to do the same things as before.

So let's cut the corners a bit: we have a trusted developer (our self, company workers - means it's not arbitrary clients),
so we don't need a heavy restriction for the application, so let's throw away docker and another heavy staff.
so we don't need a heavy restriction for the application, so let's throw away docker and other heavy stuff.

## Docs and features

Expand All @@ -90,12 +90,12 @@ Each function contains at least one URL: `<base URL>/a/<UID>` and any number of

## Why I did it?

Because I want to write small handlers that will be 99% of the time just do nothing. I am already paying for the cheapest
Because I want to write small handlers that will 99% of the time just do nothing. I am already paying for the cheapest
Digital Ocean (thanks guys for your existence) and do not want to pay additionally to Lambda providers like Google/Amazon/Azure.

I also tried self-hosted solutions based on k3s but it too heavy for 1GB server (yep, it is, don't believe in marketing).

So, 'cause I am a developer I decided to make my own wheels ;-)
So, 'cause I am a developer, I decided to make my own wheels ;-)

# Installation

Expand All @@ -109,9 +109,9 @@ See [installation manual](administrating/installation)

# Contributing

The platform is quite simple Golang project with Vue + Quasar frontend
The platform is a quite simple Golang project with Vue + Quasar frontend
and should be easy for newcomers. Caveats and tips for backend check [here](development)

For UI check [sub-repo](https://github.com/reddec/trusted-cgi-ui)

Any PR (docs, code, styles, features, ...) will be very helpful!
Any PR (docs, code, styles, features, ...) will be very helpful!
22 changes: 11 additions & 11 deletions docs/usage/actions.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,24 +6,24 @@ nav_order: 1
---
# Actions

Actions is optional arbitrary commands defined in [Makefile](https://www.gnu.org/software/make/manual/make.html#Rule-Example) as targets and can be invoked
Actions are optional arbitrary commands defined in a [Makefile](https://www.gnu.org/software/make/manual/make.html#Rule-Example) as targets and can be invoked
by UI, admin API or during template cloning operations.

Main purpose is to prepare environment or function out of general flow procedure (HTTP call):
The main purpose is to prepare the environment or a function out of general flow procedure (HTTP call):
build binary, download dependencies, etc.

UI:

1. click to any created application
2. click to actions tab
1. click on any created application
2. click on the `Actions` tab


Basic example - update from git.

For example, your lambda source code hosted somewhere in Git repo and you already
initialized function from Git clone.
For example, your lambda source code is hosted somewhere in a Git repo and you already
initialized the function from Git clone.

You can put `update` action in Makefile that will pull latest `master` branch.
You can put an `update` action in the Makefile that will pull the latest `master` branch.

`makefile`
```makefile
Expand All @@ -34,10 +34,10 @@ update:
That's it!


You will in UI/{Lambda}/Actions button `update`. If you will push it, the `update`
You will see the button `update` in the `Actions` tab. If you push it, the `update`
target will be invoked.

You also can schedule automatic update in a `Schedule` tab!
You also can schedule an automatic update in the `Schedule` tab!

Bonus: if you used `create from git` button for new lambda in UI, the `update` target
will be automatically generated for your convenience.
Bonus: if you used the `create from git` button for a new lambda in the UI, the `update` target
will automatically be generated for your convenience.
6 changes: 3 additions & 3 deletions docs/usage/aliases.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ nav_order: 2
---
# Aliases

Links (or aliases) are useful to make a public links and dynamically migrate between real implementations (functions). For ex:
you made a GitHub hook processor in Python language, then changed your mind and switched to PHP function. Instead of
updating link in GitHub repo (that could be a hassle if you spread it everywhere) you can change just a link.
Links (or aliases) are useful to make public links and dynamically migrate between real implementations (functions). For ex:
you made a GitHub hook processor in the Python language, then changed your mind and switched to a PHP function. Instead of
updating the link in your GitHub repo (that could be a hassle if you spread it everywhere) you can change just a link.

Important! Security settings and restrictions will be used from new functions.
4 changes: 2 additions & 2 deletions docs/usage/git_repo.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ application/lambda.

Requirements:

* read-only access for the key (could be found in ui in Settings)
* read-only access for the key (could be found in UI in the Settings)
* manifest.json in repo

How to:

1. Add public key as allowed.
For github: repo -> settings -> deploy keys
2. Put remote origin to field in repo and push {create from git} in UI in Dashboard
2. Put the remote origin URL into the field `Git repository` and push {create from git} in UI in Dashboard
4 changes: 2 additions & 2 deletions docs/usage/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@ nav_order: 2
has_children: true
---

To create a new lambda it's enough to just click on template icon in a dashboard.
To create a new lambda it's enough to just click on the template icon in a dashboard.

Or use [cgi-ctl create](../cgi-ctl/create) command.
Or use [cgi-ctl create](../cgi-ctl/create) command.
Loading

0 comments on commit 65d29b1

Please sign in to comment.