hubcio opened a new issue, #4451: URL: https://github.com/apache/iggy/issues/4451
## Problem - TLS over TCP: the CLI always validates the server certificate (`core/sdk/src/client_provider.rs:141`), and it trusts only the built-in `webpki_roots` (`core/sdk/src/tcp/tcp_client.rs:1219`). The SDK `Args` has `tcp_tls_ca_file` (`core/common/src/types/args/mod.rs:269`), but the CLI flags in `ArgsOptional` (`:29`) do not. So the CLI cannot reach a TCP TLS server with a self-signed or private CA certificate. - TLS over WebSocket: `ArgsOptional` has none of the `websocket_tls_*` fields (`:344-353`), so the CLI cannot enable WebSocket TLS. `context create` has no WebSocket address flag. TLS keys that you add to `contexts.toml` by hand are ignored. - Secrets: `user create` takes the password only as a positional argument, so the password goes into shell history. `context create` stores the password and the token as plaintext in `~/.iggy/contexts.toml` (mode 0600 on Unix). PATs and login sessions already use the OS keyring. - Environment: the only Iggy variables that the CLI reads are `IGGY_HOME` and the pair `IGGY_USERNAME` and `IGGY_PASSWORD`, and `--help` lists none of them. No variable holds a token. So a CI job passes the token with `-t`, where the process list shows it, or writes it to `contexts.toml`. ## Proposal - Add `--tcp-tls-ca-file` and the `--websocket-tls-*` flags. Validate WebSocket certificates by default, as TCP does. Today the WebSocket default is off (`core/common/src/types/args/mod.rs:418`). - Remove the `localhost` default of the TLS domain (`:389`), so that the SDK uses the host of the server address (`core/sdk/src/tcp/tcp_client.rs:1234`). - Flatten `ArgsOptional` into the `context create` arguments, so that a context can hold every connection flag. - If the `user create` password is missing, prompt on a TTY or read one line from stdin, like `-p` (`core/cli/src/credentials.rs:126`). - Store context secrets in the keyring, keyed by `IGGY_HOME` and the context name, and remove them on `context delete`. If no keyring is available, keep the current file. - Read `IGGY_TOKEN` next to the `IGGY_USERNAME` and `IGGY_PASSWORD` pair (`core/cli/src/credentials.rs:148`). The flags win over it, and it wins over the pair. - Give the connection flags `env` attributes with explicit names and `hide_env_values`, through `mut_arg` in the CLI. The data seeder also uses `ArgsOptional`. This needs the clap `env` feature in the workspace `Cargo.toml`. ## Notes - Keep the credential variables in `credentials.rs`. In its conflict rules, clap treats an environment value like a flag. If `-u` reads `IGGY_USERNAME` through clap, `-t` fails while that variable is set. - Pick the variable names by hand. Names that come from the flags collide with server variables, for example `IGGY_TCP_TLS_ENABLED` and `IGGY_ENCRYPTION_KEY`. - A release server warns about unknown `IGGY_*` variables, and a debug build refuses to boot (`core/configs/src/configs_impl/file_provider.rs:130`). Add each new name to `SERVER_PROCESS_ENV_VARS` (`core/configs/src/server_config/server.rs:50`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
