The default token location is confusing

[rcritten]

The default token file location is determined in this order:

1. If KRYOPTIC_CONF is defined
2. if XDG_DATA_HOME is defined then $XDG_DATA_HOME/kryoptic/token.sql
3. if HOME is defined then $HOME/.local/share/kryoptic/token.sql
4. /var/kryoptic/public/token.sql

I'd suggest moving 4 to before 2.

The problem with relying on the environment variable is it has to be set or inherited by every user that will interact with the token. I think this would be cumbersome to do for IPA development (we don't recommend users use software HSMs in production). It is very difficult to troubleshoot just exactly which file is being opened. I had to resort to strace and sift through the output.

This is likely to cause issues with any secondary tooling like certmonger which runs as a daemon. We'd have to, only for this one provider, set an environment variable in the systemd scripts.

Similarly we'd have to add it to .bashrc to ensure that the token will be visible to tools like certutil.

An alternative, which might bring new issues, would be to define a configuration file that describes the location. I think the problem with my location suggestion and with a configuration file it could preclude users from having a nice default of their own if there is a system-level token because it is an existence check. If the file exists then it is used.

[simo5]

I was wondering if ti made sense to create a default config file in /etc/kryoptic/kryoptic.conf, but allow a $XDG_CONFIG_DIR one to override it if present.

What do you think ?

[simo5]

and change KRYOPTIC_CONF to point to a config file rather then directly to a database file ...

[rcritten]

Yes that makes sense.

[rcritten]

It would be nice if the configuration file and its directives was documented in README.md

[simo5]

Yep, I'll open an issue for improving docs