You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
cli: add TLS flags, keep secrets out of arguments, and read environment variables #4451
TLS over TCP: the CLI always validates the server certificate (core/sdk/src/client_provider.rs:141), and it trusts only the built-in webpki_roots (core/sdk/src/tcp/tcp_client.rs:1219). The SDK Args has tcp_tls_ca_file (core/common/src/types/args/mod.rs:269), but the CLI flags in ArgsOptional (:29) do not. So the CLI cannot reach a TCP TLS server with a self-signed or private CA certificate.
TLS over WebSocket: ArgsOptional has none of the websocket_tls_* fields (:344-353), so the CLI cannot enable WebSocket TLS. context create has no WebSocket address flag. TLS keys that you add to contexts.toml by hand are ignored.
Secrets: user create takes the password only as a positional argument, so the password goes into shell history. context create stores the password and the token as plaintext in ~/.iggy/contexts.toml (mode 0600 on Unix). PATs and login sessions already use the OS keyring.
Environment: the only Iggy variables that the CLI reads are IGGY_HOME and the pair IGGY_USERNAME and IGGY_PASSWORD, and --help lists none of them. No variable holds a token. So a CI job passes the token with -t, where the process list shows it, or writes it to contexts.toml.
Proposal
Add --tcp-tls-ca-file and the --websocket-tls-* flags. Validate WebSocket certificates by default, as TCP does. Today the WebSocket default is off (core/common/src/types/args/mod.rs:418).
Remove the localhost default of the TLS domain (:389), so that the SDK uses the host of the server address (core/sdk/src/tcp/tcp_client.rs:1234).
Flatten ArgsOptional into the context create arguments, so that a context can hold every connection flag.
If the user create password is missing, prompt on a TTY or read one line from stdin, like -p (core/cli/src/credentials.rs:126).
Store context secrets in the keyring, keyed by IGGY_HOME and the context name, and remove them on context delete. If no keyring is available, keep the current file.
Read IGGY_TOKEN next to the IGGY_USERNAME and IGGY_PASSWORD pair (core/cli/src/credentials.rs:148). The flags win over it, and it wins over the pair.
Give the connection flags env attributes with explicit names and hide_env_values, through mut_arg in the CLI. The data seeder also uses ArgsOptional. This needs the clap env feature in the workspace Cargo.toml.
Notes
Keep the credential variables in credentials.rs. In its conflict rules, clap treats an environment value like a flag. If -u reads IGGY_USERNAME through clap, -t fails while that variable is set.
Pick the variable names by hand. Names that come from the flags collide with server variables, for example IGGY_TCP_TLS_ENABLED and IGGY_ENCRYPTION_KEY.
A release server warns about unknown IGGY_* variables, and a debug build refuses to boot (core/configs/src/configs_impl/file_provider.rs:130). Add each new name to SERVER_PROCESS_ENV_VARS (core/configs/src/server_config/server.rs:50).
Problem
core/sdk/src/client_provider.rs:141), and it trusts only the built-inwebpki_roots(core/sdk/src/tcp/tcp_client.rs:1219). The SDKArgshastcp_tls_ca_file(core/common/src/types/args/mod.rs:269), but the CLI flags inArgsOptional(:29) do not. So the CLI cannot reach a TCP TLS server with a self-signed or private CA certificate.ArgsOptionalhas none of thewebsocket_tls_*fields (:344-353), so the CLI cannot enable WebSocket TLS.context createhas no WebSocket address flag. TLS keys that you add tocontexts.tomlby hand are ignored.user createtakes the password only as a positional argument, so the password goes into shell history.context createstores the password and the token as plaintext in~/.iggy/contexts.toml(mode 0600 on Unix). PATs and login sessions already use the OS keyring.IGGY_HOMEand the pairIGGY_USERNAMEandIGGY_PASSWORD, and--helplists none of them. No variable holds a token. So a CI job passes the token with-t, where the process list shows it, or writes it tocontexts.toml.Proposal
--tcp-tls-ca-fileand the--websocket-tls-*flags. Validate WebSocket certificates by default, as TCP does. Today the WebSocket default is off (core/common/src/types/args/mod.rs:418).localhostdefault of the TLS domain (:389), so that the SDK uses the host of the server address (core/sdk/src/tcp/tcp_client.rs:1234).ArgsOptionalinto thecontext createarguments, so that a context can hold every connection flag.user createpassword is missing, prompt on a TTY or read one line from stdin, like-p(core/cli/src/credentials.rs:126).IGGY_HOMEand the context name, and remove them oncontext delete. If no keyring is available, keep the current file.IGGY_TOKENnext to theIGGY_USERNAMEandIGGY_PASSWORDpair (core/cli/src/credentials.rs:148). The flags win over it, and it wins over the pair.envattributes with explicit names andhide_env_values, throughmut_argin the CLI. The data seeder also usesArgsOptional. This needs the clapenvfeature in the workspaceCargo.toml.Notes
credentials.rs. In its conflict rules, clap treats an environment value like a flag. If-ureadsIGGY_USERNAMEthrough clap,-tfails while that variable is set.IGGY_TCP_TLS_ENABLEDandIGGY_ENCRYPTION_KEY.IGGY_*variables, and a debug build refuses to boot (core/configs/src/configs_impl/file_provider.rs:130). Add each new name toSERVER_PROCESS_ENV_VARS(core/configs/src/server_config/server.rs:50).