input-output-hk / input-output-hk/Developer-Experience-working-group
Evaluate node-to-client communication via TCP
- Dominant language
- No language data
- Stars
- 24
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
The node-to-client mini-protocols are only available via unix-socket connections. AFAIK, the goal of this constraint is to reduce the attack surface, improving security.
Although valid, this approach limits the deployment options at the infrastructure level. A setup that includes Cardano Node, DBSync, Ogmios, Submit-API, etc forces the operator to merge the workload under a single host, which is far from ideal.
Allowing each component to run in a different hosts brings several benefits: horizontal scaling, high-availability, resource isolation, etc. Many operators from the community have relied on workarounds (eg: UNIX <=> TCP socat tunnels) to escape the constrained imposed by the Node.
On a private network topology, having a way to enable node-to-client communication via TCP would simplify configuration and introduce new deployment options. This option should be disabled by default and would require an explicit opt-in from the operator to enable it.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the node-to-client mini-protocols and their current Unix-socket-only deployment described in the issue; no file or test entry point is named. Evaluate the security and opt-in requirements for TCP against the Cardano Node, DBSync, Ogmios, and Submit-API deployment scenario, with a clear recommendation as the outcome.
Written by the indexing model from the issue text.
Assessment
- Domain
- infrastructure, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100