🌺 self-reliantly posting on the #Fediverse with painless hosting and security in mind: 1. Rent any web space from EUR 2 mo… https://demo.mro.name/shaarligo
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Marcus Rohrmoser 🌍 cb798ebfae phase out 0x4c.de 2 years ago
static phase out 0x4c.de 2 years ago
testdata also use <title>. 3 years ago
tpl back to shaarligo.cgi. 3 years ago
.gitattributes fix github language detection 5 years ago
.gitignore Add en theme and make default. 3 years ago
.travis.yml template & travis 4 years ago
README.md phase out 0x4c.de 2 years ago
ShaarliGo.go phase out 0x4c.de 2 years ago
ShaarliGo_test.go comply with go version go1.15.6 darwin/amd64 2 years ago
api0.go - silence Cookie warning, 2 years ago
api0_test.go Copyright 2 years ago
atom.go Copyright 2 years ago
atom_test.go Copyright 2 years ago
ban.go Copyright 2 years ago
ban_test.go Copyright 2 years ago
build.sh update to go 1.16 toolchain, migrate to modules. 2 years ago
cgi-fake.sh - rename, 2nd. 5 years ago
comb.go Copyright 2 years ago
comb_test.go Copyright 2 years ago
config-core.go Copyright 2 years ago
config-core_test.go Copyright 2 years ago
config.go Copyright 2 years ago
config_test.go Copyright 2 years ago
doap.rdf Brush up. 3 years ago
emoji_map.go make #§ and #† proper tags and make emojis implicit tags. 4 years ago
feedwriter.go comply with go version go1.15.6 darwin/amd64 2 years ago
feedwriter_test.go Copyright 2 years ago
flow.dot - rename, 2nd. 5 years ago
go.mod update to go 1.16 toolchain, migrate to modules. 2 years ago
go.sum update to go 1.16 toolchain, migrate to modules. 2 years ago
http.go Copyright 2 years ago
mastodon.go Copyright 2 years ago
mini-build.sh rename ‚pub/posts‘ to ‚=/p and according. 5 years ago
pinboard.go Copyright 2 years ago
pinboard_test.go Copyright 2 years ago
post-test.sh - trailing slashes 5 years ago
search.go Copyright 2 years ago
search_test.go Copyright 2 years ago
tags.go Copyright 2 years ago
tags_test.go Copyright 2 years ago
tools.go Copyright 2 years ago
tools_test.go Copyright 2 years ago
version.go version bump. 4 years ago


🌩 Lightning Talk at the 34c3 🚀

Build Status


🌺 Self-reliant publishing for laypeople like your loved ones and mine. Have a say and not be subjected to any T&Cs, just local law. All without setup headaches, but truly self-sustained and enduringly independent:

Install / Update

  1. Rent any web space from EUR 2 monthly with a domain-name as your enduring digital property (e.g. https://variomedia.de/hosting),
  2. download https://mro.name/Linux-x86_64/shaarligo.cgi and
  3. copy it to the webspace, see e.g. https://www.variomedia.de/faq/Wie-uebertrage-ich-meine-Seite-auf-den-Server/article/177,
  4. set the file permissions (chmod) to read-only+execute for all (numeric 555), see e.g. https://wiki.filezilla-project.org/Other_Features#Chmod,
  5. visit http://example.com/shaarligo.cgi and off you go!

That's if the webserver is Apache (Linux, 64 bit, modules cgi and rewrite) as common with shared hosting.

For lighttpd see static/app/lighttpd.conf. Nginx lacks CGI support (srsly?).

Or build from source at http://mro.name/ShaarliGo

Responsible Disclosure

In case you are reluctant to file a public issue, feel free to email security@mro.name (🔏key).


POSSE is an abbreviation for Publish (on your) Own Site, Syndicate Elsewhere, a content publishing model that starts with posting content on your own domain first, then syndicating out copies to 3rd party services with permashortlinks back to the original on your site.

(says https://indieweb.org/POSSE)

You can POSSE to


enter your Pinboard Auth Token from https://pinboard.in/settings/password at the end of app/config.yaml like this

- pinboard: https://api.pinboard.in/v1?auth_token=johndoe:XOG6EJIYMIZZ

It's ok to leave prefix empty. Each pinboard post gets a backlink as an additional footer line. If prefix is set, the footer line is prefix + id.


at first manually obtain an access token (example server here is https://social.tchncs.de/):

  1. create an application in https://social.tchncs.de/settings/applications
  2. give it permission write:statuses
  3. note the access token and enter it below.

Then enter the server endpoint plus /api/v1/ and access token into app/config.yaml like so:

- mastodon: https://social.tchncs.de/api/v1/
  token: …boph1koomie4eikaiG…

It's ok to leave prefix empty. Each mastodon post gets a backlink as an additional footer line. If prefix is set, the footer line is prefix + id.

Also, if you don't know the token but the endpoint accepts basic auth (pleroma), you may add the credentials to the url for the time being until I figure out how to get a token from pleroma or do proper OAuth2.

Design Goals

  • backwards compatible posting (https://code.mro.name/mro/Shaarli-API-test)
  • trivial installation and minimal hosting requirements (run on simple hosted webspace),
  • keep server lean, especially for readers,
  • standards compliant (Atom, Atompub, WebSub),
  • easy migration from existing shaarlis,
  • run ok without javascript,
  • visitor reading operates on static flat files only (no server code),
  • secure against brute force login attacks,
  • easy translation & skinning,
  • leverage existing, widely deployed web tec (CGI, XSLT, HTML, CSS),
  • easy fail2ban integration / DOS mitigation,
Quality very good good normal irrelevant
Functionality ×
Reliability ×
Usability ×
Efficiency ×
Changeability ×
Portability ×


tl;dr: a webserver that can execute CGIs and serve files from disc.

ShaarliGo is an old-school CGI binary executable, so it needs a webserver to drive it. Configurations come for Apache (automatic, see static/.htaccess) and Lighttpd (see static/app/lighttpd.conf).

As a self-contained, statically linked, Go executable, it has no runtime dependencies and works on a variety of platforms.

ShaarliGo needs write access to the webroot filesystem to once unpack the web assets and when posting update the content.

Storage footprint is <25 KiB per post.

When posting a page, it is once accessed via HTTP GET to infer title, tags and a thumbnail image URL.


  1. pinned posts,
  2. private posts,
  3. PuSH/PubSubhubbub / WebSub,
  4. import shaarlis (login?),
  5. pwd reset (maybe deleting from app/config.yaml is acceptable),
  6. images/enclosures,
  8. trackback/pingback


inspired by and compatible to http://sebsauvage.net/wiki/doku.php?id=php:shaarli.