Raito BezariusandNiko Klanecek
728d2bfee7
Adds an example plugin implementing an mTLS-enabled binary cache store (https+mtls:// scheme) using client certificates for authentication. Darwin fix: don't link liblix* into plugins (host resolves symbols at runtime via dynamic_lookup). Explicitly link curl so it binds to Nix-store libcurl, not /usr/lib/libcurl. This prevents the plugin's curl_easy_setopt calls from operating on the wrong libcurl instance. Test portability: BSD sed -i wrapper, OpenSSL -sha256 for cert signing, redirect test server output to log file. Change-Id: I652b987d3ac45e31df50ff4ba1f523294438c2b6
1.7 KiB
synopsis, issues, cls, category, credits
| synopsis | issues | cls | category | credits | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| mTLS store connections via a plugin |
|
Improvements |
|
To support use cases requiring mutual TLS (mTLS) authentication when connecting to remote Nix stores, e.g. private stores, we have introduced a contributed mTLS plugin extending the Lix store interface.
This design follows an extensibility model which was brought up by a proposal of making Kerberos authentication possible in Lix directly.
This mTLS plugin serves as a concrete example of how store connection mechanisms can be modularized through external plugins, without extending Lix core. This idea can be generalized to integrate automatic certificate renewal or advanced integrations with secrets engine or posture checks.
It enables custom TLS client certificates to be used for authenticating against a remote store that enforces mTLS.
To use the plugin, configure Lix manually by setting in your nix.conf:
plugin-files = /a/path/to/libplugin_mtls_store.so
Currently, this must be done explicitly. In the future, Nixpkgs will provide a mechanism to reference an up-to-date and curated set of plugins automatically.
Making plugins easily consumable outside of Nixpkgs (e.g., from external plugin registries or binary distributions) remains an open question and will require further design.
Contributed plugins come with significantly reduced stability and maintenance guarantees compared to the Lix core. We encourage users who depend on a given plugin to take on maintenance responsibilities and apply for ownership within the Lix mono-repository. These plugins are subject to removal at any time.