Cloudron Forum

@robi if you open an issue on Codeberg, i'll take a look.

@jadudm thanks so much!

also, updated to the latest base image, which let me shave ~2GB off of the package. even smaller and lighter weight now!

@timconsidine thanks for the reminder! done:
https://ca.cloudron.io/app/simple-static

Despite switching everything else away from Codeberg, I'll keep Simple Static there indefinitely. It's a nothing package that would take more effort to switch than not.

fixed screenshots! also launched 4.0.0--see the main thread:
https://forum.cloudron.io/topic/14756/hecapte-a-stateless-privacy-first-captcha-service-you-can-embed-almost-anywhere./

TheMeerkat said:

As a result of the first entry, the CloudronVersions.json link has changed:
https://api.tangled.org/xrpc/org.tangled.temp.git.getBlob?repo=did%3Aplc%3Apomgtubhgnuew7wmpwgk7dzd&ref=main&path=CloudronVersions.json

I'll manually update the Codeberg one for a while, but you should change it at some point.

actually, turns out I won't! good timing: 4.0.0 (and now 4.0.1) has breaking changes, so you should manually upgrade anyway.

most notably: the secret key needs to be sent to the HeCAPTe server now, not just the public site key, bringing it in-line with other CAPTCHA services.

Think it’s Codeberg’s anti-bot changes. Will fix today.

Mentioning it here too, by the way: new home!
https://tangled.org/katsuricata.com/HeCAPTe

@james had no idea that was a thing! thanks for the tip

https://ca.cloudron.io/app/hecapte

As a result of the first entry, the CloudronVersions.json link has changed:
https://mirror.tangled.network/xrpc/sh.tangled.git.temp.getBlob?path=CloudronVersions.json&ref=main&repo=did%3Aplc%3Apomgtubhgnuew7wmpwgk7dzd

I'll manually update the Codeberg one for a while, but you should change it at some point.

The significantly improved v3.0.0 is out now!

[3.0.0]

• Moved the project home to https://tangled.org/katsuricata.com/HeCAPTe (from Codeberg) and the container image to Docker Hub (docker.io/katsuricata/hecapte).
• Fixed browser-flow regressions that shipped in 2.0.0: the first-run setup page never loaded wasm_exec.js (so new Go() threw and setup could never complete through the UI), and the password page called bufferDecode/bufferEncode without loading admin.js. Added a template test that fails when a page uses new Go(), solveChallenge(), or bufferDecode/bufferEncode without loading the script that defines it.
• Added an Equihash difficulty floor (crypto.MinN = 60). ValidateParams, tokens.GenerateChallenge, and VerifySolution all reject parameters below the floor, so no configuration path can turn the verifier into a free token oracle. The server warns loudly when the global preset or a site override uses low, and flags weak sites on the admin dashboard.
• Added per-IP rate limiting (token bucket) on the unauthenticated admin endpoints: 10 req/min (burst 5) on the login/setup challenge fetches and 5 req/min (burst 2) on the login POST. Buckets key on the peer address and honor X-Forwarded-For only behind TRUST_PROXY=1.
• Added security response headers: X-Content-Type-Options: nosniff, frame-ancestors 'none', X-Frame-Options: DENY, and Referrer-Policy: same-origin.
• Added a one-time startup warning when X-Forwarded-Proto arrives but TRUST_PROXY is unset, turning a silent reverse-proxy misconfiguration into an observable one.
• Upgraded modernc.org/sqlite from 1.55.0 to 1.56.0 (bundled SQLite C library; staying current is the only CVE mitigation).
• Expired WebAuthn reauthentication tokens are now swept on each store, so the map cannot grow without bound.
• Updated the README (difficulty floor, rate limiting, response headers, forwarded-header warning, project layout) and added/refreshed tests for every change.

@andreasdueren Three reasons I chose nginx:

1. nginx is already in the base image and central to the Cloudron model.
2. nginx is incredibly light.
3. Caddy’s biggest selling point (auto-HTTPS) is completely irrelevant to Cloudron apps, which are behind a reverse proxy anyway.

@joseph Surfer never really seemed to cache any static assets for me; every time I reloaded the page, it seemed to serve it fresh again. Simple Static has these default options just for caching:

# --- Caching ---

caching:
  # Enable ETag and Last-Modified headers. Default: true.
  etag: true

  # Cache-Control max-age for static assets (seconds). Default: 3600.
  # Set to 0 to send no-cache.
  max_age: 3600

  # File extensions to cache (if set, only these are cached; unset = all).
  # extensions:
  #   - css
  #   - js
  #   - png
  #   - jpg
  #   - svg
  #   - woff2

Then there are things like custom redirects, custom headers, etc. It's a large degree of direct control with no app running on top.

I was dissatisfied with the two options for hosting static sites on Cloudron, Surfer (no server control for, e.g., caching) and the generic LAMP app (unnecessary). So I made my own! Simple Static uses only nginx and a YAML config file.

Repo: https://codeberg.org/TheMeerkat/Simple-Static
CloudronVersions.json: https://codeberg.org/TheMeerkat/Simple-Static/raw/branch/main/CloudronVersions.json
For the CLI: cloudron install --versions-url https://codeberg.org/TheMeerkat/Simple-Static/raw/branch/main/CloudronVersions.json

Extremely simple app with included instructions.

Massive 2.0 update. Following SemVar, that means a breaking change, and... yeah, it's breaking all right!

I've consolidated the two repositories and made several improvements that did, unfortunately, invalidate existing installs; I figured it was best to do this now, while everything is still early. It does mean that updates of the old app are no longer possible, however. You will need to reinstall from scratch as a new community app with https://codeberg.org/TheMeerkat/HeCAPTe/raw/branch/main/CloudronVersions.json as the source file.

Sorry about this. It allowed for me to implement the requested aliasing, plus made it much easier for me to localize it (per a Codeberg issue) in the future. I won't have to do that again.

@james Could you update the link to the versions file in the masterlist, please?

@luckow Hey there! I can definitely put that on the to-do list.

I don't check this forum on an overly regular basis; could you open a Codeberg issue on the project so I can keep development feedback centralized, please?

@james said:

Hello @themeerkat

With Cloudron 9.1 we have added community app support.
Please check the latest documentation for package publishing https://docs.cloudron.io/packaging/publishing
Could you update your repo to include these changes?

Done. Also, the issue with the previous version is now resolved!

To install it as a community app, use this link:
https://codeberg.org/TheMeerkat/HeCAPTe-Cloudron/raw/branch/main/CloudronVersions.json

new! Updated to 1.0.2, after a hefty delay. Sorry about that.

I significantly improved the security of the project, most importantly. Not far behind, refactoring the entire /admin panel to be... well, an actual admin panel. It's been redone almost from the ground up for maintainability going forward. Finally, it's more resilient to OOM bugs in unlucky situations.

codeberg.org/themeerkat/hecapte-cloudron:1.0.2

Nope. Tested all of the local code to within an inch of its life; tested the Docker image locally; then watched as it completely shattered into splinters as I tried to update the demo site running on Cloudron. Good lesson to learn before I embarrass myself publicly, next time?

Please keep using 1.0.1 for right now (if anyone's using it at all). I need to sleep right now, but I'll take another look in the morning.

new! Updated to 1.0.1.

codeberg.org/themeerkat/hecapte-cloudron:1.0.1

I added customization options: renaming sites, deleting sites, and specifying CORS(!) on registration. This should make it a lot easier to use.

@girish said in HeCAPTe: a stateless, privacy-first CAPTCHA service you can embed almost anywhere.:

Then, some CORS into nginx (would be great if the hecapte server can have this configurable)

Definitely. There's next-to-no "easy" config right now; I have an informal checklist for changes I'd want to make before it goes from alpha to beta, and I'll make a note for CORS specifically.

@girish said in HeCAPTe: a stateless, privacy-first CAPTCHA service you can embed almost anywhere.:

w00h00 . @themeerkat works I was sending the /verify incorrectly to surfer instead of hecapte.

Awesome! Thanks so much for trying it out! I genuinely appreciate your feedback and testing.

Sorry, it's 3:30AM where I am right now. I may not have been quite as clear as I intended.

Basically, due to the ideal of being embeddable and invisible, there's no easy widget; implementations are semi-manual affairs, manually threaded through the thing you're protecting, with the HeCAPTe server's response processed by your own backend.

Obviously, the ideal for adoptability and ease-of-use would be to create a bunch of pre-fab implementations (e.g., WordPress plugin and npm module), but I probably lack both the skill and the time to make these "quickly."

For this specifically:

is there an example where I can copy/paste the wasm stuff needed?

/static/worker.js calls the .wasm module directly; you just need to invoke $HeCAPTeInstance/static/worker.js.

Thanks so much! I appreciate it.

@girish said in HeCAPTe: a stateless, privacy-first CAPTCHA service you can embed almost anywhere.:

5. <stuck here> . is there an example where I can copy/paste the wasm stuff needed?

Documentation is definitely the weakest link right now, I think. Here's a cobbled-together example:
EDIT: Slightly more coherent. Edited five minutes after posting.

Form:

<!-- ...existing code... -->
<input type="hidden" id="hecapte-payload" name="hecapte_payload">
<script>
  const SITE_KEY = "YOUR_SITE_KEY";
  const worker = new Worker("https://hecate.eris.host/static/worker.js");
  let solverReady = false;

  worker.onmessage = (e) => {
    const { type, payload } = e.data;
    if (type === "STATUS" && payload === "READY") solverReady = true;
    if (type === "RESULT") {
      document.getElementById("hecapte-payload").value = JSON.stringify(payload);
    }
  };

  async function solveHeCAPTe() {
    if (!solverReady) return;
    const resp = await fetch(`https://hecate.eris.host/challenge?site_key=${SITE_KEY}`);
    if (!resp.ok) return;
    const challenge = await resp.json();
    const msgId = Date.now();
    worker.postMessage({
      id: msgId,
      type: "SOLVE",
      payload: {
        salt: challenge.salt,
        ts: challenge.ts,
        n: challenge.diff.n,
        k: challenge.diff.k,
        nonceStart: 0
      }
    });
    worker.addEventListener("message", function handler(e) {
      const { id, type, payload } = e.data;
      if (id !== msgId || type !== "SOLVE_RESULT") return;
      worker.removeEventListener("message", handler);
      document.getElementById("hecapte-payload").value = JSON.stringify({
        site_key: SITE_KEY,
        data: {
          nonce: payload.nonce,
          salt: challenge.salt,
          ts: challenge.ts,
          diff: challenge.diff,
          sig: challenge.sig,
          sol: payload.solution
        }
      });
    });
  }

  window.addEventListener("load", solveHeCAPTe);
</script>
<!-- ...existing code... -->

Super basic backend pseudo-code:

payload = json.loads(form["hecapte_payload"])
resp = requests.post("https://example.com/verify", json=payload, timeout=5)
if resp.json().get("status") != "ok":
    return 403