[Galene] Anonymous access

[Galene] Anonymous access

[Francis Bolduc]

Hi galene users,

Is it possible to allow anonymous access to some groups so that people
can join without logging in? I really don't wanna manage
username/passwords.

I would appreciate some instructions on how to do so. The installation
guide did not mention it.

Regards,
Francis

[Galene] Re: Anonymous access

[Michael McMahon]

This is easily possible with wildcard users.

I setup rooms with the wildcard with the default permission that I 
expect people to use (either present of message) with wildcard. I send 
out the room and wildcard password to all that need it. Anyone else that 
is a special case such as known users and op, I create user accounts.

Best,
Michael
GPG Key: 4337 2794 C8AD D5CA 8FCF  FA6C D037 59DA B600 E3C0

On 11/1/26 17:53, Francis Bolduc wrote:
> Hi galene users,
> 
> Is it possible to allow anonymous access to some groups so that people
> can join without logging in? I really don't wanna manage
> username/passwords.
> 
> I would appreciate some instructions on how to do so. The installation
> guide did not mention it.
> 
> Regards,
> Francis
> _______________________________________________
> Galene mailing list -- galene@lists.galene.org
> To unsubscribe send an email to galene-leave@lists.galene.org
> 

[Galene] Re: Anonymous access

[Juliusz Chroboczek]

>> Is it possible to allow anonymous access to some groups so that people
>> can join without logging in? I really don't wanna manage
>> username/passwords.

> This is easily possible with wildcard users.

Yes.  The other solution is to use tokens ("invites", click on your own
name in a group and type "invite user").

Note that in either case you will need to click to join, since we need to
force the user to interact with the page to allow playing audio in Chromium-based
browsers.

>> I would appreciate some instructions on how to do so. The installation
>> guide did not mention it.

  <https://galene.org/galene.html#the-fallback-user>

I'm open to suggestions hgow to make this more visible.

-- Juliusz

[Galene] Re: Anonymous access

[Francis Bolduc]

Thanks Michael, Juliusz,

I was able to setup my groups with the following commands:


galenectl create-group -group alouette
galenectl create-group -group cacahuete
galenectl create-group -group pirouette

echo '{"public":true}' | galenectl update-group -group alouette -json
echo '{"public":true}' | galenectl update-group -group cacahuete -json
echo '{"public":true}' | galenectl update-group -group pirouette -json

galenectl create-user -group alouette -wildcard
galenectl create-user -group cacahuete -wildcard
galenectl create-user -group pirouette -wildcard

galenectl set-password -group alouette -wildcard -type wildcard
galenectl set-password -group cacahuete -wildcard -type wildcard
galenectl set-password -group pirouette -wildcard -type wildcard


Unfortunately, those commands cannot be used in my Dockerfile, which
looks like this:


FROM archlinux:base-20261025.0.616225
RUN pacman --noconfirm -Sy go
ADD https://github.com/jech/galene/archive/refs/tags/galene-1.2.1.tar.gz /src/
RUN cd /src; tar --strip-components=1 -xf galene-*.tar.gz; rm galene-*.tar.gz
RUN cd /src; CGO_ENABLED=0 go build -trimpath -ldflags='-s -w'; mv
galene /usr/bin/
RUN cd /src/galenectl; CGO_ENABLED=0 go build -trimpath -ldflags='-s
-w'; mv galenectl /usr/bin/
RUN mkdir /srv/galene; mv /src/static /srv/galene/
WORKDIR /srv/galene
CMD ["/usr/bin/galene", ...]


So instead I bake in the resulting JSON file obtained after running
the commands above and shutting down galene:


{
  "public": true,
  "wildcard-user": {
    "password": {
      "type": "wildcard"
    },
    "permissions": "present"
  }
}


I think what is missing in the installation guide is the reference
documentation for the JSON files. Then there would be no need for
galenectl.


Regards,
Francis

[Galene] Re: Anonymous access

[Juliusz Chroboczek]

> I think what is missing in the installation guide is the reference
> documentation for the JSON files.

It's here:

  https://galene.org/galene.html#group-description-reference

> Then there would be no need for galenectl.

I, for one, find it easier to use galenectl than to edit JSON files.
I also find it easier to write a script using galenectl than jq.  But both
ways remain supported, of course.

-- Juliusz

[Galene] Re: Anonymous access

[Francis Bolduc]

> I, for one, find it easier to use galenectl than to edit JSON files.
> I also find it easier to write a script using galenectl than jq.  But both
> ways remain supported, of course.


My only gripe with galenectl is that it needs galene to run to work
(at least from my understanding of it).

I understand the utility of changing configs on a live server. But
have you considered having galenectl work directly on the JSON files
and then send SIGHUP to the running galene process (if any) to reload
configs?


Regards,
Francis

[Galene] Re: Anonymous access

[Juliusz Chroboczek]

> My only gripe with galenectl is that it needs galene to run to work

Yes, that's the design.

> I understand the utility of changing configs on a live server. But
> have you considered having galenectl work directly on the JSON files

The API is required, since people want to be able to programatically
administer a running Galene server from arbitrary languages:

  - JavaScript: static/change-password.js
  - Python: <https://github.com/zulip/zulip/pull/39792>
  - PHP: <https://github.com/movim/movim/tree/master/app/Workers/Galener/>

Galenectl is just a thin wrapper around the API, it's a convenient
byproduct.  But I agree this has some limitations:

  - the server has to be running;

  - there is a need for a Galene-specific authorisation mechanism,
    adequate Unix permissions are not enough.

Since editing files on disk is still supported, I think this doesn't
warrant spending time on writing a second backend for galenectl.

> and then send SIGHUP to the running galene process (if any) to reload
> configs?

No need, if you modify a file on disk Galene will notice it at the next
login and invalidate its cached copy.  (Assuming your filesystem
implements modification time correctly, please don't put your config on
a CP/M filesystem.)

-- Juliusz