A FreeShow Laptop, WordWall Spinners, and Client Certs Split Onto Their Own Subdomains
A normal Wednesday split between church tech prep, a recording session, and one more round of certificate-login cleanup.
Building out a FreeShow laptop
Spent 10:30 to 16:00 on a Wednesday workday, most of it building out a laptop with FreeShow loaded up, to see whether it could replace Playlister for our preschool program. Ran into a snag partway through: the laptop's Ethernet port turned out to be bad, which makes it hard to test properly on our network, so I put in a request for a USB-to-Ethernet adapter to work around it.
Also set up an account at WordWall.net to build wheel spinners for some of the games we run on Sundays — an easy win while I had the laptop prep on my mind anyway.
Recording session at Upload Partners
From 16:40 to 20:15 I helped out with a recording session at Upload Partners. Good change of pace from the afternoon's IT prep work.
Splitting admin logins onto their own web addresses
Followed up on this week's certificate-login work with a fix for a real limitation: a browser decides whether to offer a login certificate the moment it connects to a site, before it even knows which page it's asking for. So there's no way to say "only ask for a certificate on the admin page" on a site that mixes public pages with an admin area on the same address — the only fix is to give the admin area its own address. store, wiki, and TrustBridge all have exactly that problem.
Fix: each one now has a separate admin web address in rust-proxy that only asks for a certificate there, while the regular public address never asks at all. No changes needed on the apps themselves. Hit one real snag getting it live: the proxy only checks for sites needing a new certificate every 12 hours, so a freshly added admin address didn't get one right away — restarting the proxy forces it to check immediately instead, and all three new addresses had real certificates within about 90 seconds of doing that.
Rounded it out by giving rust-proxy's own admin console (v0.1.2) the same certificate-login option the other three apps already had. It didn't need its own separate address — the whole thing is already an admin area with no public pages, so there's no downside to asking every visitor there for a certificate.