influxdata / influxdata/influxdb

Add `--https-bind` for HTTPS-only connections on a different port

Open
#26,263 0 comments 1 reaction 0 assignees View on GitHub
v3
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

It's not a strong use case, but since I was [asked](https://github.com/influxdata/influxdb/issues/26253#issuecomment-2801987353) to share it, I'll register it.

__Use case:__
If HTTPS port can be made available on a different port at the same time:
- InfluxDB 3 clients can choose the port/protocol that suits their needs
- No need to deal with the various burdens of workarounds such as reverse proxies to accommodate the "other" protocol
- Less guesswork for developers and users. The fact that one is using the wrong protocol isn't difficult to spot, but it's harder and more annoying to do that from clients such as Grafana.

__Proposal:__
- Allow both `--http-bind` and `--https-bind` for convenience and choice
- I have no opinion on how `--https-bind` should behave if `--tls-*` args or ENV vars aren't available (ignore, generate self-signed, etc.)

__Current behaviour:__
As described in the documentation, client has to know what to use at given port - HTTP or HTTPS - and all clients must pick whatever is offered.
If HTTP is selected because not all clients can use HTTPS, that's one extreme. If HTTPS is selected for everyone's good, older (e.g. TLS v1.1) clients may not be able to access InfluxDB even when all they do is just make simple non-mission critical read-only queries.

__Desired behaviour:__
Clients can choose to connect without or with TLS encryption if the server offers both.

__Alternatives considered:__
Currently there's no alternative to using whichever protocol is in place (HTTP or HTTPS) cluster-wide, so I guess the only way is to stand up and maintain a separate reverse proxy which isn't insignificant (cost, performance, maintenance, etc.).

Contributor guide

Open the contributing guide

Research direction

Start by locating the existing --http-bind configuration and the documentation describing the current HTTP/HTTPS binding behavior. Review how the --tls-* arguments and environment variables are handled; done means the server can expose separate HTTP and HTTPS ports while the behavior without TLS configuration is explicitly decided and documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cli, networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.