feat: opt-in tls for rpc #1767
feat: opt-in tls for rpc #1767
Conversation
- This is just focusing client-side atm - Refactor = done - Get CA = wip - update URL - Test(s) - Error handling - Make RemoteClient using CA cert - Then I'll update the server-side
This comment was marked as resolved.
This comment was marked as resolved.
greyscaled
changed the title
Co-authored-by: Sam Kleinman <[email protected]>
greyscaled
changed the title
greyscaled
changed the title
We know we're changing to disable_tls in the future, so we'll pass down !enable_tls
|
|
||
| let client = reqwest::Client::new(); | ||
| let res = client |
There was a problem hiding this comment.
client creation is expensive (ish) and part of my "can we do this closer to the startup or when we construct the remote client". I'm not sure how re-connections are handled, but
another option would be to pass the credential config in as a future, if you didn't want to resolve the certs until you try to connect. This way (I think) subsequent attempts to resolve the future would get an effectively cached value, and you would end up doing the request only once.
crates/sqlexec/src/remote/client.rs
Outdated
| let ca = std::fs::read_to_string(tls_conf.ca_cert_path)?; | ||
|
|
||
| let mut api_url = "https://console.glaredb.com/api/internal/authenticate/client"; | ||
| let host = dst.uri().host().expect("invalid host"); |
There was a problem hiding this comment.
| let host = dst.uri().host().expect("invalid host"); | |
| let host = dst.uri().host()?; |
To not panic here
There was a problem hiding this comment.
FYI: I merged without this change, because it required updating the error/signature (ie: this change as-is would fail to compile). If I was more familiar with Rust and the cb I would've been more able to make that change, but I just wanted to get the ball rolling for e2e.
Issues created and added. Issues now on the epci: Additional issues: |
Summary
Adds
--diable-tls(true by default) to glaredb local and glaredb rpcsrv.Details
This is opt-in while we're still working on the feature and ensuring end-to-end experience
works as expected. At some point in the near future, it will be on by default and opt-out
will be flag for local use. Note that opting out will only work when running both the rpcsrv
and local with opt-out.
Resolves: #1784