GizStack

Private preview

gizstack.com is invite-only while it is in preview. stack/access.giz owns the gate.

  • Who gets in. Emails on the access list, the platform owner (STACK_ADMIN) and the host's own test accounts (STACK_INVITED). They sign in with their Giz account (giz.ai) when the platform has the giz.ai client (GIZSTACK_GIZ_CLIENT_ID); without it, by password, GitHub or Google.
  • What others see.
    • The home page / shows a teaser with a request-access form. Requests are mailed to STACK_ADMIN. It is the only indexed page.
    • Every other path answers 401: a plain "private preview" page for a browser, or text for the CLI and APIs. This covers docs, /install, /download, /api/releases, /objects, packages, /deploy and the console.
    • Gated answers carry X-Robots-Tag: noindex, and robots.txt allows / only.
  • What stays public. Hosted apps on the app domain (*.giz.sh).
  • Opening the install and the docs. STACK_ACCESS=public keeps the gate for people (sign-up and sign-in need an invite; the console, /token, /deploy, packages and the editors answer 401) and lets anyone read with GET or HEAD the pages and docs of the site, /install, /install.ps1, /api/releases, /objects/* and the brand files. robots.txt then allows the pages and keeps the downloads out. A release object carries Cache-Control: public, max-age=31536000, immutable (its name is its digest), and one client may download 2 GiB a minute; past that the answer is 429 with Retry-After. Other requests keep the limit of 600 a minute.
  • Opening up fully. Set STACK_ACCESS=open in the platform's environment and restart. That removes the gate; there is no second code path.

Adding or removing a person

The owner runs these with their terminal token (from /token):

sh
curl -sS https://gizstack.com/_admin/access -H "Authorization: Bearer $GIZ_TOKEN" -d op=add -d email=person@example.com -d note="why"
curl -sS https://gizstack.com/_admin/access -H "Authorization: Bearer $GIZ_TOKEN" -d op=remove -d email=person@example.com
curl -sS https://gizstack.com/_admin/access -H "Authorization: Bearer $GIZ_TOKEN"     # the list

Removing an email locks that person out at once. Every request checks the list, so their sessions and access keys stop working too.

Access keys

An invited person makes keys on /token ("New access key"). Each key is shown once, with its install command:

sh
curl -fsSL https://gizstack.com/install -H "Authorization: Bearer gsi_…" | sh
  • The script served for that request carries the key and stores it in ~/.config/gizstack/access-token. GIZ_ACCESS_TOKEN overrides the file.
  • The installer, giz upgrade and package reads send the key to gizstack.com, and to no other host.
  • Only the key's SHA-256 is stored. Each key is revoked on its own from /token.
  • A terminal token (GIZ_TOKEN) also passes the gate, for /deploy and MCP.