- Don't hijack the entire SSL site for sake of Plinth.
- Serve both HTTP and HTTPS sites with default configuration.
- plinth-ssl configuration only make SSL compulsory.
- Document modules required for configuration to work properly.
- Don't disable default site during FreedomBox setup run. This is no
longer required.
- Request Apache to send X-Forwarded-Proto header.
- Use X-Forwarded-Proto header to understand original protocol
requested.
- Use X-Forwarded-Host header to understand original host requested.
- Allow any incoming host header so that FreedomBox can have any
hostname and when user requests for Plint with that hostname, it
works.
- Don't depend on Apache to rewrite the Location: header. Instead use
the original host and original scheme to set proper Location: header.
When Apache proxy forwards a request it usually makes the request to the
backend server with a new Host: header but sends the original host
information using a special header X-FORWARDED-HOST: header. It is a
common practise. The backend can be make the choice of which header to
use based on the knowledge that it is running behind a proxy server.
Since hostname of a FreedomBox machine could be anyting and it could
change during the operation of Plinth, having a list of incoming Host:
header values is not going to be easy in Plinth. If Apache were not to
force override this header, managing list of Host: header values will
become easiler in Plinth. If Plinth indeed wants to know the original
host name by which user refferred to it, it can use the
X-FORWARDED-HOST: header which is the norm in these situtations.
We are allowing modules to bring their own static content. If we need
to configure Apache to serve static URLs directly, Apache will have know
all the static URLs generated by all the modules. If these details are
provided, it will likely effect our modularity.
The current static URL given in Apache configuration is anyway
incorrect.
The package license (AGPL3+) implicitly indicates the license of each
file. However, it is desirable to have license headers in each file.
This is the case for many prominent projects like GNU project, Mozilla
etc.
- Remove dependency on withsqlite and use Django models.
This avoids depending on a module that is not available in PyPi.
Withsqlite does not have Python3 support. It does not work when
we choose a different database backend. Atleast partly duplicates
what Django models are meant for.
- Check and update database schema on every run so that
newly added modules can add tables and old ones can update.
