Vyxal

sure

is it ok if I just tell you here, so if you have further questions you can ask me?

of course

So when commits are pushed to the production branch, this workflow is triggered, which just sends a POST request to vyxal.pythonanywhere.com/update

so it's essentially a simple webhook

the /update link has a password which needs to be passed in the X-funky-password header

(I can send you the password if you want it)

sure, go ahead

@lyxal actually I'll post it on the Web Design team on GitHub

3:34 AM

isn't that unsecure?

I would argue it's no less secure than email tbh

because won't it send as a plaintext email to everyone like it did when I put the site password there?

yeah, ok, how else do you suggest doing it?

then the flask app, here, receives the request, validates the password with the sha256 hash), and if correct, executes the funky_upgrade.sh script

that script is inside the Vyxal repo, so it's checkout out on PythonAnywhere at /home/vyxal/mysite/funky_upgrade.sh

and when it's run, it pulls the git repo, upgrades all the pip dependencies, etc: github.com/Vyxal/Vyxal/blob/…

and finally it uses the PythonAnywhere API to restart the web app

ah okay that seems simple enough

it uses the $API_TOKEN environment variable, which is automatically set by PythonAnywhere if you have an API token set up on your account

3:38 AM

Lyxal created a repository: Vyxal/secrets

uh

that was a private repo

lol

still is a private repo

do you use pgp of any kind? if so, that's the best secure option

e.g. if you have a keybase account

I don't

3:40 AM

do you have an SSH key?

no

but the repo vyxal bot so kindly announced should work for sharing among the whole team

oh do you want the whole team to see it? ok that's easier then

only people on the web-design team should be able to access it I think

I don't think so

> All 19 members can access this repository.

@pxeger yeah, so that anyone in the team can fix it if something goes wrong

@pxeger hmm changing that means changing perms throughout the rest of the organisation

3:43 AM

ah

@pxeger you have to make sure you manually clone the repository into mysite when you first set it up: cd /home/vyxal; rm -rf mysite; git clone git@github.com:Vyxal/Vyxal.git mysite

and now I think about it, actually, you need to create an SSH key on PythonAnywhere as well

1: run ssh-keygen on PythonAnywhere, and press enter for all the defaults (no password)

2. copy the contents of ~/.ssh/id_rsa.pub (not ~/.ssh/id_rsa, because that's the private key)

3. add the public key as a Deploy Key on GitHub - just paste it into github.com/vyxal/vyxal/settings/keys/new (give it a good name, and don't allow write access)

after you've done that, you should be able to clone the repo

That sounds simple enough

Thanks for the explanation!

also, in the GitHub Actions workflow, I set environment: production

this means that when the workflow runs successfully, GitHub interprets that to mean that it was deployed to an Environment called production

you can set some settings for environments at github.com/Vyxal/Vyxal/settings/environments/343657709/edit

@pxeger the password is stored as a Repository Secret in GitHub Actions called FUNKY_PASSWORD

I should really change it so that it's a secret only accessible within workflows defined under the production Environment, though

@lyxal wait I just realised I don't have a plaintext version of the password right now, it's only on my desktop at home and I'm on holiday (did you notice my timezone changed?)

I don't think it'd too hard to change though, if you needed to

just change the hash in flask_app.py and update the GitHub secret value

@pxeger when it runs the script, it does it with a slight hack using os.fork() (which doesn't work on Windows, so you can't test it there), because the script needs to run in a separate process detached from the web app

otherwise when PythonAnywhere tries to restart flask, it gets a deadlock because it's waiting for funky_upgrade.sh to stop running, which is waiting for the PythonAnywhere restart API call to finish, which is waiting for the flask app to stop, ...

@pxeger I did notice that you're active at a different time than usual :p

and I think that's all there is to tell you

here's a bookmark: chat.stackexchange.com/rooms/106764/conversation/…

Thanks again for that...I appreciate you taking the time to explain it to me and consequently everyone else :)

3:56 AM

np :)

Aaroneous Miller

4:28 AM

Just so u know, anybody in the Vyxal org is able to get into the secrets repo, not just the web design team

Razetime

might be because almost everyone is owner

Aaroneous Miller

It’s because the default permissions for private repos in the org is for all members to have admin privileges in the repo. We should probably change it so that by default private repos have no permissions, and all permission must be explicit

I tested it with the cookie and I could get into the repo, even though it’s set for the web design team to have access, just because that’s the default permissions

!!/'night

@AaroneousMiller o/

4:53 AM

Lyxal created branch Vyxal/Can-people-still-commit

Okay so I think I've fixed the perms

Not-Lyxal deleted branch Vyxal/Can-people-still-commit

11:50 AM

→ 6 instances of me just setting up auto deepsource stuff moved to Trash

[deepsource-autofix[bot]](github.com/deepsource-autofix[bot]) opened PR #426 (Vyxal/Vyxal) (Vyxal:deepsource-fix-4c7b7263 → Vyxal:main): Remove unnecessary use of comprehension

[deepsource-autofix[bot]](github.com/deepsource-autofix[bot]) opened PR #427 (Vyxal/Vyxal) (Vyxal:deepsource-fix-8f539f9b → Vyxal:main): Remove assert statement from non-test files

[deepsource-autofix[bot]](github.com/deepsource-autofix[bot]) opened PR #428 (Vyxal/Vyxal) (Vyxal:deepsource-fix-3176f2be → Vyxal:main): Use `is` to compare type of objects

user

@lyxal ^

→ 3 branch creations moved to Trash

the rest are PRs that should stay

user

@VyxalBot wait what’s wrong with assert statements?

*assert statements outside of testing

they get optimised away when turned into byte code

raise AssertionStatement doesn't

Unrelated String

12:01 PM

also if you have an actual illegal state to possibly handle a more descriptive error might be preferable

as opposed to making sure you didn't fuck something up internally

Lyxal approved on PR #428 (Vyxal/Vyxal)

Lyxal approved on PR #427 (Vyxal/Vyxal)

Lyxal approved on PR #426 (Vyxal/Vyxal)

Lyxal approved on PR #425 (Vyxal/Vyxal)

@user it's still checking for the assertion conditions, it just isn't using the assert keyword

like it quite literally just turns the condition into an if statement containing a raise

user

12:33 PM

Bruh

@lyxal oh ok

1:46 PM

AMiller42 opened issue #429 in Vyxal/Vyxal: `l` doesn't work on numbers

Aaroneous Miller

2:58 PM

petition to change the description for the o flag to "Explicit implicit output"

11:30 PM

Lyxal created branch Vyxal/bug-fixing-frenzy

11:52 PM

→ 15 deepsource messages moved to Trash