-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Less "open" public website #554
Comments
Config options to manage which parts are public already exist: ArchiveBox/archivebox/config.py Line 71 in e4d2ac4
archivebox config --set PUBLIC_SNAPSHOTS=True
archivebox config --set PUBLIC_INDEX=False
archivebox config --set PUBLIC_ADD_VIEW=False You can also manage the Snapshot view/edit/add/delete permissions on a per-user basis under http://127.0.0.1:8000/admin/core/user/ |
Ok, I think I figured out what those settings do. Are they documented somewhere? Similarly, is there some documentation for the various user account permissions? I havnt found them in the wiki. |
They are not documented yet because it's sort of a "beta" feature. We're planning on improving the permissions system in the future and this is just the bare minimum first version we implemented. I may add them to the Wiki but I haven't decided yet if we want to advertise these config options because they might change soon. |
k. In that case, Ill try to keep an eye out for that. Thanks! |
@pirate we can close this one, right? |
Type
What is the problem that your feature request solves
Occasionally I would like to share links to pages I have clipped. However, the public ArchiveBox site is rather "open" (very easy for anyone to look at everything stored in there) and Id rather if that was not the case. Im not asking for iron-clad security here but Id like to keep people (and bots) from snooping.
Describe the ideal specific solution you'd want, and whether it fits into any broader scope of changes
Ideally: Implement granular access controls to the website which are tied to user accounts which can exist in an external system (ie Okta, Authelia, LDAP, etc).
Minimally: Make it so the directory structure is not publicly visible, provide an option to disable public access to the archive root, and an option to entirely disable public archive access.
What hacks or alternative solutions have you tried to solve the problem?
Since I want to make ArchiveBox Internet accessible so I can archive sites from my mobile devices, the minimal solution above should provide a modicom of privacy and is better than expecting the user to somehow figure out how to do this via Nginx or the like.
How badly do you want this new feature?
The text was updated successfully, but these errors were encountered: