Open scottlamb opened 3 years ago
The crux of this issue is done: there is a config file format with a [[binds]]
section now that supports customizing some things. Not all the specific ideas mentioned here are implemented but I think the missing things are covered by other issues.
Oops, mentioned the wrong issue in that commit. Reopening this one.
Context: this comment on #132, #35 , #27, #31 .
It'd be nice to have more than a single
--http-addr=ipaddr:port
and allow them to differ in configuration (different--allow-unauthenticated-permissions
,--trust-forward-hdrs
, etc). I think it's cheap to have severalhyper::Server
s in the process. Eg, I'd like to run my server in the following configuration:https
proxy server. It requires authentication and trusts theX-Real-IP
andX-Forwarded-For
headers. (I probably should also a header from the proxy with a shared secret to avoid being insecure on accidental misconfiguration.)moonfire-nvr login
expects now) or to have already created and stored session cookie.Another use: Bobberty just mentioned wanting an IPv4 binding + a IPv6 binding.
Per-bind address knobs might grow to include:
FileDescriptorName=
andsd_listen_fds_with_names
.]SO_PEERCRED
-based uid authentication rather just trusting the peer. (Theuser
table has long had aunix_uid
for this but it's unimplemented.)--allow-unauthenticated-permissions
--trust-forward-hdrs
, with the additional ability to configure a shared secret as mentioned abovehttps
: letsencrypt challenge config or supplied certificate file paths.Seems way too awkward to specify all the stuff above on the commandline, and I don't think it belongs well in the database (I don't want to add a configuration tool for it and folks are used to configuration files for stuff like this), so I think we should introduce a config file. toml, text proto, json, yaml, something like that.