5 ms·

YESSS so happy there's now an apt install method: echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.li

YESSS so happy there's now an apt install method: echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list apt update && apt install caddy

francislavoie 6y ago
Yay! That was my pet project for the past couple weeks, I'm so glad to see people appreciate it!
- nikisweeting 6y ago
  Thank you so much for investing the time to do it, this was the only thing holding me back from using Caddy for everything over the last ~2 years. I know it's a painful process for Go packages in particular, but it's definitely worth it to be more easily installable for diehard apt users like myself.
jbverschoor 6y ago
Yeah, not gonna use just any apt source. I'll pass.
- m_sahaf 6y ago
  It's not a random source. The package is created by the release script in Caddy's repo: https://github.com/caddyserver/caddy/blob/e051e119d1dff75972ed9b07cf97bbb989ba8daa/.github/workflows/release.yml#L62-L68 https://github.com/caddyserver/caddy/blob/e051e119d1dff75972... There's ongoing effort to package Caddy into Debian. Until then, this is the alternative as stopgap.
  - jbverschoor 6y ago
    Nowhere on the website old or new is any info available. Thanks for pointing out
    - m_sahaf 6y ago
      It's mentioned on the "Install" page in the "Documentation" part of the website https://caddyserver.com/docs/install#debian-ubuntu-raspbian https://caddyserver.com/docs/install#debian-ubuntu-raspbian :)
    - jbverschoor 6y ago
      I swear I couldn't find that page... been looking for half an hour.
      - francislavoie 6y ago
        It's the second link in the top-left of the docs sidebar! I'm surprised you found that difficult to find.
        jbverschoor 6y ago
        Yeah guess I should go and sleep
        Silhouette 6y ago
        That sidebar doesn't show on major landing pages, so it's not as silly a mistake as it might seem. I missed it for several minutes while looking around myself, as I started by following the prominent links on those landing pages. I only found the separate installation information page when someone else here helpfully linked to it.
        mholt 6y ago
        Have you tried our site search? It's the same service that powers the HN search.
        Silhouette 6y ago
        Honestly, I hadn't even noticed the search box. It appears in a slightly unusual place and styled sufficiently subtly that I totally overlooked it throughout my entire browsing session. (FWIW, this is on a very large and colour-calibrated monitor on my PC, so my experience here may not be typical.) In case it's of interest, as a new visitor, I started browsing from your main v2 landing page, scanning down most of that information. Then I followed the prominent download and get started links near the top. I think I next went to the documentation area, and started browsing the links on the left, though I totally missed the "Install" link just under "Welcome" because my eye was drawn first to the Tutorials section and its getting started link, and then I went exploring from there on down. I suppose that was an unfortunate combination of two things to miss. :-)
- francislavoie 6y ago
  You may already know this, but it's very tricky to package Golang projects in official debian repos because they require that every dependency be a separate package. This is a ton work both upfront and to maintain in the long-term, so we haven't made much progress on that front. We'd love to get some help from people who are more comfortable with the debian ecosystem though! It's definitely something we want to achieve, but for the short term we had to make the decision to simply release the .deb via https://gemfury.com https://gemfury.com which provides us with free APT repo hosting for open source projects.
  - jbverschoor 6y ago
    So you’re saying that even if your app compiles to a single binary, that’s a requirement? I understand why, but it’s indeed quite a pain.
    - francislavoie 6y ago
      Yup. It's a bummer. https://go-team.pages.debian.net/packaging.html https://go-team.pages.debian.net/packaging.html
      - thayne 6y ago
        Unless I'm missing something, that only says you need to package all dependencies if it is a library. Which means you could make a binary-only statically compiled package without adding a bunch of dependencies right? Of course, that isn't helpful if you need to compile with extra plugins, but in that case you are probably using standard go tools and not apt packages anyway.
        francislavoie 6y ago
        See https://github.com/Debian/dh-make-golang/issues/131 https://github.com/Debian/dh-make-golang/issues/131 We were specifically told that we would need to have all our dependencies packaged. Debian needs to be able to validate that it was built entirely from source code from library packages, not from a binary built externally.
jamieweb 6y ago
Be aware that the [trusted=yes] config disables GPG signature verification for the repository, which does slightly break the security model of Apt (where repositories can be untrusted/HTTP-only as long as all packages are signed by trusted keys). Unless I'm mistaken, a malicious package with the same name as a critical system package could be added to that untrusted repository by an attacker who had compromised it, and if the version number is higher than that of the 'official' package and your Apt priority config prioritises it, your system would download and install it without any verification. This is a fairly niche attack vector that may not be considered a significant risk in some environments, but it's one to consider when establishing your threat model and risk appetite. As a side note, it's worth noting that GPG signing packages is not a silver bullet either, especially if the signing keys and administrative access to the repository fall within the same security boundary (e.g. developer doing both from their PC without any segregation/sandboxing). However, it has proven to be a robust method so far, and definitely beats explicit [trusted=yes].
- francislavoie 6y ago
  Yeah, we're aware. Unfortunately Gemfury doesn't support GPG signing yet (see https://gemfury.com/help/apt-repository#apt-setup https://gemfury.com/help/apt-repository#apt-setup) but we will set that up as soon as they do. Their service made it the easiest to get set up on short notice.

YESSS so happy there's now an apt install method: echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list apt update && apt install caddy

francislavoie 6y ago

Yay! That was my pet project for the past couple weeks, I'm so glad to see people appreciate it!

nikisweeting 6y ago
Thank you so much for investing the time to do it, this was the only thing holding me back from using Caddy for everything over the last ~2 years. I know it's a painful process for Go packages in particular, but it's definitely worth it to be more easily installable for diehard apt users like myself.

jbverschoor 6y ago

Yeah, not gonna use just any apt source. I'll pass.

m_sahaf 6y ago
It's not a random source. The package is created by the release script in Caddy's repo: https://github.com/caddyserver/caddy/blob/e051e119d1dff75972ed9b07cf97bbb989ba8daa/.github/workflows/release.yml#L62-L68 https://github.com/caddyserver/caddy/blob/e051e119d1dff75972... There's ongoing effort to package Caddy into Debian. Until then, this is the alternative as stopgap.
- jbverschoor 6y ago
  Nowhere on the website old or new is any info available. Thanks for pointing out
  - m_sahaf 6y ago
    It's mentioned on the "Install" page in the "Documentation" part of the website https://caddyserver.com/docs/install#debian-ubuntu-raspbian https://caddyserver.com/docs/install#debian-ubuntu-raspbian :)
  - jbverschoor 6y ago
    I swear I couldn't find that page... been looking for half an hour.
    - francislavoie 6y ago
      It's the second link in the top-left of the docs sidebar! I'm surprised you found that difficult to find.
      - jbverschoor 6y ago
        Yeah guess I should go and sleep
      - Silhouette 6y ago
        That sidebar doesn't show on major landing pages, so it's not as silly a mistake as it might seem. I missed it for several minutes while looking around myself, as I started by following the prominent links on those landing pages. I only found the separate installation information page when someone else here helpfully linked to it.
        mholt 6y ago
        Have you tried our site search? It's the same service that powers the HN search.
        Silhouette 6y ago
        Honestly, I hadn't even noticed the search box. It appears in a slightly unusual place and styled sufficiently subtly that I totally overlooked it throughout my entire browsing session. (FWIW, this is on a very large and colour-calibrated monitor on my PC, so my experience here may not be typical.) In case it's of interest, as a new visitor, I started browsing from your main v2 landing page, scanning down most of that information. Then I followed the prominent download and get started links near the top. I think I next went to the documentation area, and started browsing the links on the left, though I totally missed the "Install" link just under "Welcome" because my eye was drawn first to the Tutorials section and its getting started link, and then I went exploring from there on down. I suppose that was an unfortunate combination of two things to miss. :-)
francislavoie 6y ago
You may already know this, but it's very tricky to package Golang projects in official debian repos because they require that every dependency be a separate package. This is a ton work both upfront and to maintain in the long-term, so we haven't made much progress on that front. We'd love to get some help from people who are more comfortable with the debian ecosystem though! It's definitely something we want to achieve, but for the short term we had to make the decision to simply release the .deb via https://gemfury.com https://gemfury.com which provides us with free APT repo hosting for open source projects.
- jbverschoor 6y ago
  So you’re saying that even if your app compiles to a single binary, that’s a requirement? I understand why, but it’s indeed quite a pain.
  - francislavoie 6y ago
    Yup. It's a bummer. https://go-team.pages.debian.net/packaging.html https://go-team.pages.debian.net/packaging.html
    - thayne 6y ago
      Unless I'm missing something, that only says you need to package all dependencies if it is a library. Which means you could make a binary-only statically compiled package without adding a bunch of dependencies right? Of course, that isn't helpful if you need to compile with extra plugins, but in that case you are probably using standard go tools and not apt packages anyway.
      - francislavoie 6y ago
        See https://github.com/Debian/dh-make-golang/issues/131 https://github.com/Debian/dh-make-golang/issues/131 We were specifically told that we would need to have all our dependencies packaged. Debian needs to be able to validate that it was built entirely from source code from library packages, not from a binary built externally.

jamieweb 6y ago

Be aware that the [trusted=yes] config disables GPG signature verification for the repository, which does slightly break the security model of Apt (where repositories can be untrusted/HTTP-only as long as all packages are signed by trusted keys). Unless I'm mistaken, a malicious package with the same name as a critical system package could be added to that untrusted repository by an attacker who had compromised it, and if the version number is higher than that of the 'official' package and your Apt priority config prioritises it, your system would download and install it without any verification. This is a fairly niche attack vector that may not be considered a significant risk in some environments, but it's one to consider when establishing your threat model and risk appetite. As a side note, it's worth noting that GPG signing packages is not a silver bullet either, especially if the signing keys and administrative access to the repository fall within the same security boundary (e.g. developer doing both from their PC without any segregation/sandboxing). However, it has proven to be a robust method so far, and definitely beats explicit [trusted=yes].

francislavoie 6y ago
Yeah, we're aware. Unfortunately Gemfury doesn't support GPG signing yet (see https://gemfury.com/help/apt-repository#apt-setup https://gemfury.com/help/apt-repository#apt-setup) but we will set that up as soon as they do. Their service made it the easiest to get set up on short notice.