the statbus.yaml and its parameters

[kannthus]

Hey again.

Almost everything is working so far, just one last jigsaw piece.

I have ensured that in my .local.env ALLOW_NONADMINS is set to false, the website ensures as much stating the "only admins can log in", Great.
However, despite making a packages/prod/statbus.yaml, anyone can access: Rounds and polls, despite not being public

Here is the production yaml:

[nfreader]

ALLOW_NONADMINS only controls whether or not non-admins are allowed to log in to Statbus. There's not really a way to require access for stuff like the round listing. Additionally, packages/prod/statbus.yaml only controls what features are enabled; e.g. not all codebases have database tickets, so that can be be disabled.

Thank you for helping me find the shortcomings in my documentation! This is very helpful :)

[kannthus]

I see, thats unfortunate. I do have a backup plan though if that was the case, so all in all it's not too bad.

Appreciate the quick response, thank you

[nfreader]

Do you care to share what you're trying accomplish? I'd love to see if there's anything I can do to help :)

[kannthus]

Do you care to share what you're trying accomplish? I'd love to see if there's anything I can do to help :)

I was intending to just have statbus be used only by our admin team, rather than anyone being able to access: Round information (logs, stats), public bans, admin rank log changes, polls and roster.

We are an invite only community not on the Hub, so having that information be forcefully public is awkward.
There is a way around it by having Caddy need a password to access the site, which is clunky and would require us to manually rehash a password every once in a while.

It's not the end of the world, some things are functional (haven't gotten logs working yet, my game theory is that its assuming we have public logs like TG does, but I'll do some more diving and see)

[nfreader]

Ah ha. I might be able to whip something up. You may also be able to park an OAuth middleware(?) on caddy and pass an x-user-header(?) to Statbus and I can set it up to do header auth. Hmm... 🤔

[kannthus]

Ah ha. I might be able to whip something up. You may also be able to park an OAuth middleware(?) on caddy and pass an x-user-header(?) to Statbus and I can set it up to do header auth. Hmm... 🤔

That's a good idea, it would however be awkward as accessing most of the website still requires having Verification through a Discord Bot.

We don't have any policies in place for the TG "Verify" system. Having a 2Auth would require: Getting Verified by a Bot, than having a seperate thing; messy but entirely possible.