Setting Up a Secure Webapp

As a person who prefers full access to data in the simplest format, while at the same time having it useful with latest technologies, my quest for trying things out is an ongoing activity.

Earlier, I blogged about my needs of collating news feeds in a simple format, readily accessible offline, while still being useful and aligned with the modern paradigm.

In today’s age, the other common aspect of our life, is digitization of moments. With the advent of great technology and affordable economics, the world now has access to great devices to capture moments in digital form. Most people, these days, are equipped with smart devices, like mobile phones, that come with pretty good image capturing devices. Our lives, our societies, how we interact; a lot of it is now built around the assumption of smart devices and digital services.

A lot of good things have happened of it. We are now able to send messages to people, securely, in a matter of seconds. We are now able to capture moments, which otherwise we’d often miss; all thanks to devices like smart mobile phones that most of all carry almost all along with us.

In this regard, we are quite indebted to the technology revolution that has improved life styles all over. Of course, like every coin has a flip side, thus too, too much of obsession with digital life, also has its drawbacks. A simple reminder to self should always be about what a human life is designed for and try to live by its rules.

Moments

Given the tools general availability, we are all more used to capturing moments. Once upon a time, taking a photo meant going to a photo studio.

Then came a generation where we’d have personal devices with roll films, to which we captured the moments. And then get it processed from a photo developing service provider. And that is when we’d know which all moments came out correct and which ones were spoilt. In such cases, there’s always the wish I could have that moment again.

Thankfully, now, in our current generation, we have the liberty to take pictures and validate them almost immediately. We also have the flexibility to take multiple shots of the moment and do the filtering later. There’s also many intelligent and invasive services, all mostly provided free, to help you organize these moments; at a small cost of keeping an eye on your life activity.

In a summary, mankind, now, generates lots and lots of data. So much lot that now even mammoths like Google are forced to make a call whether it is more profitable to sniff user activity while providing them a service for free, or ask people to pay otherwise too.

Privacy

Many of us are wary of the amount of personal data we generate, which is our asset; and how the big tech giants want a piece of it in the name of free services. And in such quest, free aside, there’s always a lookout for privacy savvy tools that can help us draw a bold line in between Public and Private

Google Photos

Google Photos has been a great tool. The way it organizes, siphons and present your data is simply amazing. No good would have been the photos taken, if they weren’t easily searchable, organized, annotated, and presented.

But Google Photos is proprietary and invasive. The amount of information they have access to should be a concern to all people. For services that invade so much, the world needs Free Services.

PhotoPrism

I only came across this project around a month ago, while the project has been around since 2019. So far, in my exploration, this is one of the best Free Software tools to manage and organize my digital photos. The other favorite tool that I regularly depend on is Digikam and it still is a gem.

In a gist, PhotoPrism aims to be the equivalent of Google Photos, for the privacy savvy people.

As of date, it has a decent list of features available. And for some of the missing ones, I’ve come up with a fairly okay workflow with other tools, which is one of the reasons of this blog post.

PhotoPrism is a web app, written in the Go Programming Language. Its layout and workflow as a Photo Management application is similar to Google Photos. It is very performant compared to other applications. Since it is a Progressive Web App, access through a Laptop, Tablet or Mobile is almost the same. It uses Google TensorFlow for some of its features and thus you feel like using Google Photos in some regard.

Some shortcomings and workarounds

• Facial Recognition: To date, facial recognition is a planned feature. But this was easy to tackle given that Digikam has pretty solid facial recognition. So I use Digikam to detect, recognize and annotate faces. And then PhotoPrism is happy enough to use those annotations and present relevant data.

• HTTP Web App: The upstream project has done a good job of making use of Docker container technology in presenting this web app solution. A software solution, the equivalent of a Google Photos, does need a heavyweight config. In free software, it is all about reusing available tools. PhotoPrism makes use of tools like MySQL, Vue.js, TensorFlow, GoLang, GoLibs and strives to provide a single package solution, all thanks to Docker containers.

In its current offering, PhotoPrism is run as a HTTP Web App. I wanted to have an added layer of security on top of it. And thus run an nginx reverse proxy on top of it. Along with it, I run the proxy service on HTTPS, thus making all traffic from clients to the proxy encrypted. I also wanted an added layer of HTTP AUTH on top, so I explored some options and finally settled down with http-auth-digest

Also, in the current implementation, PhotoPrism doesn’t have a strong notion of normal and private photos in its data organization. I wanted normal photos available under a standard auth realm and private photos under a different realm. And along with a different realm, I also wanted some added security directives for it. So far, it looks like I’ve put together a decent solution with the help of nginx.

• First of all, since the port from the host is forwarded to the docker instance, that needed to be controlled. Instead of the default of listening on all interfaces, I changed it to loopback only. Because my primary and only interface is going to be the nginx reverse proxy

• Setup nginx with a self-signed certificate to have all communication encrypted.

• Setup nginx as a reverse proxy to talk to PhotoPrism.

  server {
  
     listen 80;
     listen [::]:80;
     server_name lenovo;
     return 302 https://$host$request_uri;
     rewrite ^ https://$http_host$request_uri? permanent;    # force redirect http to https
  
      server_tokens off;
  }
  
  server {
  listen 443 ssl http2 default_server;
  listen [::]:443 ssl http2 default_server;
  ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
  ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
  server_tokens off;
  server_name lenovo;
  client_max_body_size 500M;
      auth_digest_expires 900s;
      auth_digest_evasion_time 5s;
      auth_digest_replays 500;
  
  location /private {
      auth_digest 'abc';
      auth_digest_user_file /etc/nginx/htdigest;
      auth_digest_expires 900s;
      auth_digest_evasion_time 5s;
      auth_digest_replays 500;
  
      proxy_pass http://localhost:2342/private;
  }
  location /discover {
      auth_digest 'abc';
      auth_digest_user_file /etc/nginx/htdigest;
      auth_digest_expires 900s;
      auth_digest_evasion_time 5s;
      auth_digest_replays 500;
  
      proxy_pass http://localhost:2342/discover;
  }
  location / {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $host;
      proxy_buffering off;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_pass http://localhost:2342;
  
      auth_basic "Priv";
      auth_basic_user_file /etc/nginx/htpasswd;
  }
  }
  

• nginx packaging: I was so happy to see the simplicity of the nginx packaging in Debian. Becuase http-auth-digest is not upstream, it needs to be pulled in separately and compiled. I was happy to see how simple the packaging structure of nginx in Debian is. It was just a matter of putting in the module in the right modules location, which as structured such in the packaging falls under the debian/ packaging sub-folder, that any future upgrades will be quite easy to manage.

• http-auth-digest: I’d love to see http-auth-digest module be part of the upstream package. While I’m a web n00b, I felt this module perfect for my use case. From what I’ve understood, set up and tested so far, this module fills in all my requirements; which is more of like a session management.

With the combined setup in place, https://host is authenticated with a different set of credentials. On the other hand, https://host/discover and /private get covered with a different set of credentials and policies. While, this will continue to be an ongoing effort and audit of the services that I build, so far now, I feel this is in decent shape that I can use it as my daily driver.

The end result is:

Updates

• Things can really get frustrating at times. These days, it is Google that contributes to it. https://bugs.chromium.org/p/chromium/issues/detail?id=544244
  • It is is now fair to say that Google is big enough to rewrite all the standards. Or at least break them. Or best, their arrogance of it. This bug report is a fine example of what other ways it could have been dealt.

See also

• Systemd Service Hang
• Btrfs Subvol Fix
• apt-offline 1.8.4
• ThinkPad AMD Debian
• Wayland KDE X11