helium-services
Privacy-first cloud services for the Helium Browser.
This repo includes exactly what we use and host, down to Ansible playbooks. All services are self-hostable.
Services
- nginx is a reverse proxy for all other services, and also serves spellcheck dictionaries.
- extension-proxy proxies extension downloads from the Chrome Web Store.
- ubo mirrors uBlock Origin filter lists, along with Helium's own filters.
- bangs provides the list of !bangs used in Helium, generated from Kagi's bangs with our own extras.
- minidumpster handles and symbolicates crash reports.
Utilities
- sparkler generates the Sparkle appcast for macOS updates from GitHub releases.
- release-collector builds a manifest of the latest Helium downloads for each platform, channel, and architecture.
Self-hosting
The main stack (nginx, extension-proxy, ubo, and !bangs) can be set up with setup.sh and the example .env file, which also issue a TLS certificate with acme.sh. To deploy it the same way we do, see the Ansible playbooks, which also include our network setup (firewall and BGP), rolling updates, and the preseed file for our Debian VMs.
Everything else runs on its own:
- minidumpster has its own compose.yml and example .env file, and runs alongside Sentry's symbolicator.
- minipush runs from its Dockerfile. Generate its secrets with
deno task gen. - sparkler writes its output to disk every hour, or once with
--oneshot. release-collector runs once, so it's meant to be run on a schedule. sparkler needs a GitHub repo, an Ed25519 signing key, and output dirs, as shown in its example .env file. release-collector only needsOUTPUT_JSON_PATH. Both accept an optionalGITHUB_ACCESS_TOKEN.
License
All code in this repo is licensed under AGPL-3.0. See LICENSE.