Skip to content

Conversation

Koenvh1
Copy link
Contributor

@Koenvh1 Koenvh1 commented Sep 24, 2025

The idea is to use a local unix domain socket and authenticate via the local user (root by default, other users are configurable). This allows for the use of krillc without explicitly supplying a token.

The configuration looks like this:

unix_socket = "/tmp/krill.sock"
unix_users = { root = "admin", koen = "readonly" }

This allows for running krillc without KRILL_CLI_TOKEN:

koen@beta:~/Code/krill/target/debug$ ./krillc list
testca

@Koenvh1 Koenvh1 requested a review from a team September 25, 2025 15:07
@Koenvh1 Koenvh1 marked this pull request as ready for review September 26, 2025 13:55
Copy link
Member

@partim partim left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like this is the point where we should start having separate HTTP client implementations for the client and server portions. So my suggestion would be to copy src/commons/httpclient.rs into a new src/cli/httpclient.rs and only modify that to be able to use Unix sockets.

Maybe it would be useful to then also create a HttpClient type and move the possible socket and possible token in there (this would also allow to have either a token or a socket). This way you don’t need to do splitting of the URL – I feel uneasy relying on the socket having a filename ending in .sock or else stuff breaking – but rather work with a http://localhost prefix.

@Koenvh1
Copy link
Contributor Author

Koenvh1 commented Oct 3, 2025

I'm fine with pulling the two clients apart, although I would rename them to avoid mixing them up. Not sure about whether a generic type would really work for this, though a type that contains the socket separately rather than parsing the URI over and over is something I can get behind.

I'm happy to hear what you suggest as URI scheme - keep unix://something/that/could/be/a/path and make every request to http://localhost/api/do/something?

@partim
Copy link
Member

partim commented Oct 3, 2025

I would probably have two entirely separate implementations. The overlap is relatively small, the two use cases are quite different.

I would indeed keep the current scheme for configuration but translate that internally into an HTTP URI (I think the host portion doesn’t matter at all) and a correctly configure reqwest client.

@Koenvh1 Koenvh1 requested a review from partim October 3, 2025 12:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants