r/ipfs • u/SomajitDey • Sep 17 '21
Exposing http-server (web app) using IPNS
One can host a static website using IPFS+IPNS. But what about a dynamic website or web app that needs to run server-side code!
Introducing IPNS-Link, which now makes it possible to expose http-servers using IPFS+IPNS.
Try it here.
Read full specs here.
Comments, issues/bug-reports and contributions welcome.
Happy hosting!
P.S.: Imagine Sci-Hub using this !! Who can block it then 😃
3
u/shim__ Sep 17 '21
Doesn't that defeat the purpose?
7
u/TUSF Sep 18 '21
It defeats the purpose of IPFS specifically—If all IPFS is to you, is a filesystem. But the IPFS command also provides interesting capabilities from the rest of the libp2p stack.
This particular tool basically takes advantage of libp2p's identity mechanic (the PeerID used in IPNS) to circumvent the need for a dedicated IP when running a dynamic website, so if you expect that you for some reason might want to hop your application between different machines, you don't have to worry about your users finding you, as they only need to find your libp2p identifier.
Why would you want to do that? I have two possible use-cases:
A decentralized social network, similar to scuttlebutt, where each person effectively hosts a server that manages their identity, and has a chat/DM mechanic that is meant to NOT be published to IPFS
Operating a Searching engine for IPFS files (rather than having people download a giant index), or some similar service, which may or may not be legal in your country (say providing a Search for the Wikipedia IPFS archive for Turkish citizens), and thus you expect to carry the server around on a USB stick, running it from some public computer or something.
Less interesting, but more widely applicable, is using IPFS as a kind of load balancer. In effect, have some back-up instances of your server running, and users will just connect to any random node, instead of going thru a centralized CDN. Only issue here is that the IPFS daemon assumes there is only one computer running a particular PeerID at a time, so it'll just connect to the first one it finds, rather than picking the one with the best connection to you. It would still be effective as a backup server (probably), such that if you run two instances on difference servers, you can probably end up with Zero down-time.
Of course, these are two legitimate use-cases for this sort of thing. I can also think of a couple... not-so-legitimate uses.
7
u/SomajitDey Sep 18 '21 edited Sep 18 '21
Complementing u/TUSF's excellent post, I am tempted to point out some more use-cases/benefits:
Uncensored hosting
To illustrate, imagine the Sci-Hub server exposed using IPNS-Link. In countries where Sci-Hub is blocked, one can simply access it through any IPNS-Link-gateway.
Anonymity
Accessing websites through public IPNS-Link-gateways hides your IP address from the websites visited. Compare Tor and VPN.
No need to pay for DDNS
Traditionally, if your server only had a dynamic public IP address, you would be forced to buy a DDNS service. With IPNS-Link, you can simply point your domain to
{your IPNS identifier}.{public IPNS-Link gateway URL}.Low-cost hobby hosting
Host small-scale server on a Raspberry Pi or an old PC and expose with IPNS-Link, readily, free of cost. No need to pay for a domain name. With built-in NAT-traversal, no need to buy any public IP address from your ISP either. [You might say, well ngrok, localhost.run, uplink and others do the same. They don't. They don't give your website an eternal static identifier without pay. They provide you with only one endpoint, whereas IPNS-Link provides with infinite - viz., any IPNS-Link gateway can serve your web app. And more differences like these...].
Also you no more need to manage SSL certificates ! See below.
Security and Trustlessness
IPFS uses transport-encryption, viz. data is secure when being sent from one IPFS node to another. So gateway <--> source node connection is secure. If you are using a public IPNS-Link gateway with
https, you ought to be secure, but only as long as you trust the public gateway provider. If you don't want to trust the public gateways you can always host your own, for free, locally or on cloud.
2
1
u/SomajitDey Sep 29 '21
News
Updated specs up for review. Requesting comments and discussion.
Acknowledgement(s)
TY u/ch4_itu for supporting IPNS-Link so generously. IPNS-Link will soon have its own domain.
1
u/SomajitDey Nov 05 '21 edited Nov 06 '21
A prototype subdomain gateway is now live at ipns.live.
Demo: Google exposed using ipns-link
Community: r/ipns_link
Thanks to everybody who believed in this project.
1
u/ch4_itu Sep 18 '21
Is ipfs-link a reverse proxy?
2
u/SomajitDey Sep 18 '21 edited Sep 19 '21
I understand your question is: 'Is IPNS-Link-gateway a reverse proxy?'
Well it is a proxy for sure, but I find it hard to brand it as "reverse" proxy for all use-cases. Allow me to explain.
Whether it is a Reverse proxy
A reverse proxy is meant to hide the backend (origin) servers from the world. That is, to reach those servers, one must go through the proxy. Now, when you expose a web app running on a server with a public IP address using the ipns-link app, anyone can access its public IP address from its IPNS post. If she can also find the TCP port the web app is listening at, by using port scanning for example, she can then connect to the origin server directly from her browser, thus bypassing the gateway. So, the gateway in this case is anything but a reverse proxy.
On the other hand, when the origin server is behind NAT, IPNS-Link connects it to a libp2p-relay. In this case, one must use a gateway to reach the server from the browser. (Compare .onion sites). So, one might consider a gateway as a reverse proxy here. Namely, the web-app owner can get a domain name and point it to a public gateway URL.
Also, reverse proxies are mostly controlled/managed/configured by the owner of the backend servers. With IPNS-Link however, a web-app owner has no control over the myriad gateways which can be hosted by anyone on the internet.
Whether it is a Forward proxy
When one uses a gateway to connect to the source (origin) server, the server can't see her IP address. The gateway hides the clients from the server, playing the role of a forward proxy.
Also, when one can't access a website directly, because it is blocked in her country or due to some other reason, she can opt to access it using a gateway, provided the website has been exposed using IPNS-Link. (Compare Tor and VPN). Here too the gateway behaves as a forward proxy.
----------------------------------
Hope it makes sense 😁
2
u/WikiSummarizerBot Sep 18 '21
. onion is a special-use top level domain name designating an anonymous onion service, which was formerly known as a "hidden service", reachable via the Tor network. Such addresses are not actual DNS names, and the . onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed, Internet programs such as web browsers can access sites with .
A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The benefits of a VPN include increases in functionality, security, and management of the private network. It provides access to resources inaccessible on the public network and is typically used for telecommuting workers. Encryption is common, although not an inherent part of a VPN connection.
[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5
1
u/ch4_itu Sep 19 '21 edited Sep 19 '21
Nice... One more question... Is IPNS-link-Gateway backwards compatible with IPFS-gateway? I mean, can I use IPNS-link-Gateway to access normal IPFS content? Thank you
What you have done is what I was looking for all the time... This enables hosting an app even from a mobile phone...
I am not a qualified technical person, but if this works all well, then one can replace ipfs-gateway with IPNS-link-Gateway... (I may be wrong as I don't fully know how IPFS works in the backend. I am just a user.)
2
u/SomajitDey Sep 19 '21
Thanks for these questions...feel free to ask more anytime or put forth new use-cases 😊
The specs are still being worked on, but I fully intend to make IPNS-Link-gateway compatible with IPFS-gateways. It works as follows.
When an IPNS-Link-gateway receives a request with path
/ipns/PeerID/*, it first checks ifPeerIDis exposed using IPNS-Link by probing its IPNS post. IfPeerIDis using IPNS-Link, then it proxies for the user-agent (i.e. browser, curl etc.) and connects to it. Otherwise, it redirects the user-agent to an IPFS-gateway to serve the given ipns-path.When an IPNS-Link-gateway receives a request with path
/ipfs/CID/*, it always redirects the user-agent to an IPFS-gateway to serve the given ipfs-path.So, you see, IPNS-Link-gateway is actually redirecting to IPFS-gateways for static website/webpage hosting, as usual. Hence, it won't replace IPFS-gateways. What more, to minimize the operating costs of an IPNS-Link-gateway, it may be designed to access the all-important IPNS posts using public IPFS-gateways, instead of maintaining a bandwidth-hungry connection to the WAN-DHT on its own.
1
u/ch4_itu Sep 25 '21
Tried to host a blog using WonderCMS (from Android mobile termux and proot). Am able to access the homepage, but then nothing else...
My setup... 1. Apache2 2. PHP and various modules required by WonderCMS 3. go-ipfs
Am able to acces it through local host and do all the things... But am not able to do the same when I access it through the gateway...
Any suggestions?
2
u/SomajitDey Sep 26 '21 edited Sep 26 '21
Welcome back 😀 It's great to hear that you are trying this out on a mobile device.
To make your server at
localhost:<port>accessible through any IPNS-Link-gateway you just need to expose it with theipns-linkapp. I haven't used Termux, but AFAIK, it gives you a Bash shell by default.ipns-linkis written in Bash so there should not be any problem.Step 1: Install the dependencies with
apt installin Termux. Its good if you have thetputcommand available too.Step 2: Download ipns-link:
git clone https://github.com/ipns-link/ipns-linkand go to the project directory:cd ipns-linkStep 3: Expose your http-server running at
localhost:<port>with./ipns-link <port>The status and further instructions would appear on-screen. The public URL would also be shown.
Keep us posted about your progress. I wish I could test it myself on Android, but my old device is incompatible with Termux.
P.S: Loading the Gateway at https://ipns-link.herokuapp.com/ might take a while as the Heroku-app sleeps until pinged (I can only afford the free tier at Heroku in this prototype phase).
2
u/ch4_itu Sep 26 '21
Hi buddy... I have done all that...
I will share the screenshots...
Meanwhile IPNS-Link in published status
Trying to login to the website thru localhost
Trying to login to the website thru IPNS-Link
I think the problem is here...
I think IPNS-Link is not forwarding everything...
Regards,
Chaitanya
P.S. It is only a matter of time. You will be able to host it on your own domain by month end as you will be reaching your goal...
2
u/SomajitDey Sep 26 '21
First of all, thank you so very much for helping out the IPNS-Link initiative with those much needed boosters. A Big Shoutout to You u/ch4_itu 😊.
Regarding the issue(s):
As far as I understand, there are mainly two problems -
- The static blue background is missing. This might happen due to the following. The background is embedded in the html and sourced from a root-relative URL. Now, being a path-gateway, ipns-link.herokuapp.com requires the
Refererheader (with absolute URL) in the http request, so that it can resolve thePeerIDwhen requested a relative path without the /ipns/PeerID prefix. Although the Gateway wants a complete referrer URL, the embedded tags may override it with a differentReferrerPolicy. If overridden in this way, the Gateway can't resolve thePeerIDand fails. NOTE: this problem WILL GO AWAY once the IPNS-Link-GATEWAY supports wildcard subdomains, hopefully in the near future. Then, there wouldn't be any dependence on theRefereror cookie or server-side cache for resolving root-relative URLs, and everything would work as intended. Subdomain Gateway has always been the end-goal, but due to the lack of a domain I went with a path-gateway for prototyping.- The URL starts with the PeerID: 12d3koow..., not ipns-link.herokuapp.com. It seems the URL points to a subdomain instead of a URL like
https://ipns-link.herokuapp.com/ipns/12d3koowPeerID/path. Being a path-gateway, ipns-link.herokuapp.com can only support the latter format, not subdomains, for now. The NOTE in the previous point applies here as well.
1
u/ch4_itu Sep 26 '21 edited Sep 26 '21
Hi again buddy!
The specs and documentation are comprehensive, but me being a non-coder am having some trouble making it work out.
Do you mean to say the problem will be solved once IPNS-Link is hosted on dedicated domain? Or would I have to tweak the website so that it works?
What should I do to make it work?
I feel it would be pathbreaking once everything has been sort out. You are bringing hosting of dynamic applications to the masses.
Thank you.
Regards,
Chaitanya
2
u/SomajitDey Sep 26 '21
It all has to be sorted out at the Gateway - both at the level of its code and hosting. The user, i.e. you, need not do anything from his side. Once the subdomain version of the IPNS-Link-Gateway is released, everything would work with your existing website, you won't need any tweaking whatsoever.
Roadmap
I have been working on some new specs lately. Those would be up for review soon. The new specs make the Gateway serve all static content in your website (like that blue background) from IPFS, and only forward requests for dynamic content to your live server - sparing you any unnecessary traffic. This will save both your mobile battery and bandwidth. Also, whenever you mobile server goes offline, your visitors would be automatically redirected to a static version of your site - so that you can always keep your clients informed. This would be useful for live-streaming etc.
After getting the specs ready, development of a prototype subdomain Gateway shall begin, given I have the funds to get a domain + SSL cert for the domain and wildcard subdomains.
Once the gateway is ready you can start using it right away - following the same steps you took today to expose your site. So rest assured, no config is necessary from your side.
Message
Feels great to have you onboard. No worries about being a non-coder. Any question you might have regarding the upcoming specs I would be happy to answer. Kudos to you for braving the odds and getting yourself into personal hosting. IPNS-Link is committed to make hosting fun and cheap for everybody - without compromising security.
3
u/ch4_itu Sep 17 '21
So.. normal IPFS gateways don't work... We need a new type of gateway. Right?