Ren'Py Any working RenPy web updater?

[RichyCapy]

Hello, does someone knows how this works?

You must be registered to see the links

Or has a working script of it

This would be great to solve patch bugs which requiere one or two scripts so the player doesnt have to download the complete game again :/

 

[Rell games]

It is not easy, but doable. You will need to:

• Get the cheapest virtual machine from Google Cloud, AWS, or Microsoft Azure.
• Install Ubuntu (22 LTS) during the creation of a new VM
• Connect to it using SSH (or through the browser directly if your provider supports it, GC and AWS for sure does)
• open the 80 port for your virtual machine so it allows HTTP requests. Each hosting platform has its own way of doing it, just google it.
• Install Nginx using "apt-get update && apt-get install nginx"
• Upload your update to the server
• Move your update files into /usr/share/nginx/html folder on your VM.

Then after it is done, add a new option into settings (or call it on every launch if you prefer it):

textbutton _("check for updates") action updater.Update("http://your-public-ip/updates.json")

 

[RichyCapy]

It is not easy, but doable. You will need to:

• Get the cheapest virtual machine from Google Cloud, AWS, or Microsoft Azure.
• Install Ubuntu (22 LTS) during the creation of a new VM
• Connect to it using SSH (or through the browser directly if your provider supports it, GC and AWS for sure does)
• open the 80 port for your virtual machine so it allows HTTP requests. Each hosting platform has its own way of doing it, just google it.
• Install Nginx using "apt-get update && apt-get install nginx"
• Upload your update to the server
• Move your update files into /usr/share/nginx/html folder on your VM.

Then after it is done, add a new option into settings (or call it on every launch if you prefer it):

textbutton _("check for updates") action updater.Update("http://your-public-ip/updates.json")

I already have a dedicated server running Ubuntu 22.04.1 LTS

 

[CardinalRed]

This is also something that I am interested as well. I have the feeling that having the game connect with the internet will make AV more prone to call a false positive, and that a lot of people won't like it, though.

 

[anne O'nymous]

It is not easy, but doable. You will need to:

• Get the cheapest virtual machine from Google Cloud, AWS, or Microsoft Azure.
• Install Ubuntu (22 LTS) during the creation of a new VM

Or get any one of the hundreds shared hosting offers that exist, then only have to provide the needed files to the already installed and administrated HTTP server. It's even possible to do it with the forum hosting services that let you have your own storing space.

 

[Rell games]

Or get any one of the hundreds shared hosting offers that exist, then only have to provide the needed files to the already installed and administrated HTTP server. It's even possible to do it with the forum hosting services that let you have your own storing space.

If you want to risk your user base getting screwed with malicious code injected into your project by a person who administrates those services, then sure, this is a great idea. Otherwise, this is a serious security issue, because you don't have full control over the files you upload, and they can be replaced with anything and you wouldn't even know the source of the problem. VM costs around 4-7$ per month if you get the cheapest one, so it is not that bad.

 

[anne O'nymous]

If you want to risk your user base getting screwed with malicious code injected into your project by a person who administrates those services, then sure, this is a great idea.

One isn't more secured by default with a virtual machine on a cloud that with a shared hosted site. There's no more reasons to trust Google/AWS/whatever admins, than there's to trust Scaleway (or any other company you want) ones. And it's not because you installed the OS yourself that they'll not have an access to it if they really want ; especially with a VM on cloud solution.
In the same time, since it's someone who have near to no knowledge that will have to administrate the server, it will be less secured. Firstly because even if he believe the opposite, he will not know what he's doing. Secondly because he'll never dedicate enough time to check advisories and patch his system. Thirdly because he'll not have the starts of a clue regarding how to react in case of suspicious behavior ; anyway he will not even detect when there's a suspicious behavior.

Otherwise, this is a serious security issue, because you don't have full control over the files you upload, and they can be replaced with anything and you wouldn't even know the source of the problem.

Talking about serious security issues:

Connect to it using SSH (or through the browser directly if your provider supports it, GC and AWS for sure does)

As if TLS was flaws free and a HTTPS connection as secured as a SSH tunnel...


But this being said, you also have no control over the player connection, what make most of your preventive moves useless. If you effectively care about the integrity of your updates, it's client side that it apply.

VM costs around 4-7$ per month if you get the cheapest one, so it is not that bad.

And you can get shared hosting for the same price... with the peace of mind in top of this since you don't have to fear that you left a big hole in your system. So, your point is ?

 

[Rell games]

One isn't more secured by default with a virtual machine on a cloud that with a shared hosted site. There's no more reasons to trust Google/AWS/whatever admins, than there's to trust Scaleway (or any other company you want) ones. And it's not because you installed the OS yourself that they'll not have an access to it if they really want ; especially with a VM on cloud solution.
In the same time, since it's someone who have near to no knowledge that will have to administrate the server, it will be less secured. Firstly because even if he believe the opposite, he will not know what he's doing. Secondly because he'll never dedicate enough time to check advisories and patch his system. Thirdly because he'll not have the starts of a clue regarding how to react in case of suspicious behavior ; anyway he will not even detect when there's a suspicious behavior.




Talking about serious security issues:


As if TLS was flaws free and a HTTPS connection as secured as a SSH tunnel...


But this being said, you also have no control over the player connection, what make most of your preventive moves useless. If you effectively care about the integrity of your updates, it's client side that it apply.




And you can get shared hosting for the same price... with the peace of mind in top of this since you don't have to fear that you left a big hole in your system. So, your point is ?

Not sure what your point is in SSH if you are the one in control of granting/removing keys that has access to it, and even if you are still concerned, you can easily disable the port for ssh if you are not using it. Not to mention you can enable encryption of SSD with your own key, so even Google itself won't be able to access your VM (in case of Google Cloud). It is true that VM needs to be maintained - updating packages is important, and not everyone will do it, but my point is, it is still A LOT more secure than trusting your files to some random forum. Haven't used shared hosting, so can't say much about it.

But this being said, you also have no control over the player connection, what make most of your preventive moves useless. If you effectively care about the integrity of your updates, it's client side that it apply.

It is true we have no control over player connection, and the HTTP connection Ren'Py uses is far from being secure. But it does not mean we should not at least try to minimize the risks.