influxdata / influxdata/influxdb
Make it easier to run influxd with TLS
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Proposal:__
Lower the barrier-to-entry for enabling TLS by automating more of the certificate setup process.
__Current behavior:__
The `influxd` launcher takes parameters for:
* `tls-cert`
* `tls-key`
* `tls-min-version`
* `tls-strict-ciphers`
Users need to know how to get the right files / values for these config options.
__Desired behavior:__
A single config option to auto-enable TLS. `influxd` does all the hard work in setting up & renewing the TLS cert (for example, similar to [Caddy](https://github.com/caddyserver/caddy)).
__Alternatives considered:__
Recommend users run dedicated proxy software (i.e. Caddy) to handle TLS.
Contributor guide
Research direction
Start with the influxd launcher and its existing tls-cert, tls-key, tls-min-version, and tls-strict-ciphers options. Work out the automatic certificate setup and renewal requirements, then determine how a single TLS option would enable them without user-provided certificate files. No specific file or test is named in the issue.
Written by the indexing model from the issue text.
Assessment
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100