yosev / private-ghp

publish github pages privately secured by github sso (oauth2)

private-ghp

Serves static sites from private repositories to members with read access (or higher), secured using GitHub OAuth2.
The server is written in Go.

Why

Github forces users to pay for an enterprise license in order to share github pages only with members of an organization.
It is not even included in the paid Team plan.

This repository is a workaround for that - it also works for free tier plans as it doesn't rely on github pages nor public repositories.

Features

• Supports multiple pages, one per subdomain
• Define your own branch
• No need to publish a repository nor use of github pages
• Works with github free tier
• Selfhosted

Config

You need to create a Github OAuth2 App.

Check out the sample.config.yaml for more informations.
The callback URL must point to http(s)://domain:publicPort/login/github/callback (not subdomain).

Secure using HTTPs

To protect your site using SSL, we advice to use a reverse proxy like Traefik.

Usage

• First, build using:
  • make prepare
  • make build+linux or
  • make build+docker (optional)
• Second, set up a configuration
  • checkout sample.config.yaml for more informations
• Third, execute the binary or docker image
  • ./prviate-ghp --config=<path_to_config>

localhost as domain does not work

localhost does not work as the app uses cross origin resource sharing which is not applied to localhost.
You need to use a FQDN like local.host to work.

Architecture

This is a high level explanation of how this project works.

For more information of how GitHub OAuth works, see the official documentation.

• The client requests a resource
  • If the session cookie is present and valid, skip the next two steps
  • Otherwise, redirects to the provider's OAuth page
• Provider's (e.g. GitHub) OAuth page
  • If successful, redirects to the callback URL (this service)
• The callback request is received from the OAuth provider
  • Get an OAuth token, then store it client-side in a cookie
• A call is performed to the Github API using the token the client sends with each request (as cookie) to get the resource, which is then served to the client

Serving from a documentation directory

GitHub Pages allows to serve from a /docs directory, which is supported by private-ghp too, if the hosted page uses /docs as basePath.

For any question, create an issue here on Github.

private-ghp's Issues

Running private-ghp with localhost

I'm testing the code running it in local host for start, setting the OAUTH app's callback URL pointing to http://test.localhost:8080/login/github/callback

Also I'm building using the following config.yaml:

port: 8080
publicPort: 8080
domain: localhost
log:
  level: debug
github:
  client:
    id: (UserID)
    secret:  (UserSecret)
pages:
  - subdomain: test #the sub-domain part WITHOUT the main domain
    index: index.html
    cache:
      duration: 1800   
    repository:
      owner: kiwicampus
      name: kronos-project-docs
      branch: privpage # eg. gh-pages

After building it, entering test.localhost:8080 and clicking the "Authorize" button; I get redirected to the same authorization path over and over.

This is the terminal I get by doing so:

fran@fran:~/Desktop/GITREP/private-ghp$ ./bin/linux/private-ghp --config=sample.config.yaml
DEBU[2022-04-28 13:05:33] loaded config file: sample.config.yaml       
INFO[2022-04-28 13:05:33] listening on 0.0.0.0:8080                    
DEBU[2022-04-28 14:09:41] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:42] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:43] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:43] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:44] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:46] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:46] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:47] token recevied from github, redirecting to http://test.localhost:8080// 
DEBU[2022-04-28 14:09:48] token recevied from github, redirecting to http://test.localhost:8080// 

It seems I'm getting into some kind of loop, can you tell me what I'm doing wrong?

Project not working with port 80

I tried running using default public port 80, but since this one get's deleted from the URL once you press enter, the project seems to work only if the port si explicit in the URL, so when I changed it for port 9090 it worked fine.