New Version - v0.5.1 (Leicmin)

Well, it's been four months since we introduced Leicmin. As far as we know, there is only one instance “in the wild” but that one instance has given us quite a list of issues, observations, and pain points.

Group Passwords

Probably the biggest one was how group passwords work. This is our attempt to handle providing accounts and passwords for static websites. Naturally, this is always a difficulty since we don't have a /auth/me endpoint that some sites have (mostly because we have no clue how to set it up), and OpenID Connect (OIDC) requires a bit of dynamic code (not to mention having Leicmin act as a OIDC provider, which is on the future list).

So that means we have an endpoint to generate htpasswd files directly which means the passwords are encrypted from the server down to the client, but it also means we have to decrypt the passwords in the server. This is in contrast to account passwords which are hashed with argon2 and not recoverable.

However, it wasn't obvious to some of the users that they also had to have their group password set for the htaccess file to work. So we “fixed” that by putting a notice on a couple key pages that give a link and dirctions to setting the password.

Obviously, once we figure out how OIDC can work with static sites, we'll provide that also. But, let's be honest, we aren't moving very quickly on this project.

Refactoring

This month's coding involved a couple nasty refactoring.

THe first was changing our template system. While we were using Minijinja for everything, it was getting a bit cumbersome (pain point on our case). We've switched Minijinja doing the page-level templating and generate the controls using Maud. It made it a lot easier to manage the code and catch typos.

But it also lead into our other refactor: challenges. Challenges were always intended to be part of the system. The idea of having a pluggable system for handling log in and registration was appealing, such as introducing an Anubis-like system for registration that automatically scales with load, or allow something to register with a SSH or GnuPG key instead of email has been one of our goals.

However, in the process of getting April's release, we ended up writing the login/registration process as a state machine. Well, switching to Maud made the checkbox to change password not work out well. So to do that, we migrated to challenges, which then encouraged us to also change our database strategy because of another pain point. So, now we can introduce a number of challenge steps into a generic work flow.

And that lead to us introducing SeaORM into the system. Originally we worked directly with SQLx and hand-written SQL statements but that got painful. We decided to go with SeaORM to reduce the boilerplate we were seeing in the code that made things a little painful.

Membership Expiration

One of the “we would really like this feature now” that we go was expiring groups. This is because some people pay directly and want access? Well, not entirely sure, but we implemented it. Since Leicmin is still pretty rough, the membership expiration has to be done via the CLI but it should work to let someone introduct temporary memberships.

Integration Tests

This isn't really useful for most people, but we figured out how to mock out the Patreon and Subscribe Star API, so we're in the process of also making sure those have some integration tests going because that section was always a manual effort.

Next Steps

Overall, there wasn't a lot of obvious changes in the code (except for the challenges). But, the code base is a lot easier to work with and hopefully that will set us up for the next few steps.

From the alpha tester, the biggest ones are:

• Email registration
• Password recovery
• Single sign-on for Patreon and Subscribe Star

Our longer-term goals are still frustrating that they are needed, but there is clearly a desire for it:

• Group membership limits (e.g., age verification)
• Auditing (legal requirements of some of the age verification laws)
• Geo blocking (so someone can do the Pornhub thing of banning entire states)

No idea of when the next time we'll circle around to this. Mostly depends on folks being interested, asking questions, or installing the still alpha-quality instance and try to use it. Other than that, we'll just keep plugging away.