M7d follow-ups — remote TLS/auth polish

未关闭
  • 哪里不对？
#57 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
54/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
rust
领域
authentication, cli, security

调研方向

从 docs/remote-tls.md 和 M7d 设计规范开始，然后检查 crates/clowder-daemon/src/main.rs 和 remote_tls.rs::load_or_generate。在处理仅涉及设计的事项之前，重点关注两个具体的后续事项：防止启动凭据暴露在日志中，并确保 token 轮换不会使证书或 TOFU pin 失效。issue 中没有指定测试，因此请与维护者确认验收标准。

由索引模型根据 Issue 内容生成。

描述

enhancement priority: high rust

Context

M7d (#53) shipped opt-in TLS + bearer-token auth + TOFU for the remote daemon. These are the deferred minors from its review and threat model (docs/remote-tls.md, docs/superpowers/specs/2026-08-03-clowder-m7d-remote-tls-auth-design.md). None block use; all are polish/hardening.

Note: the "exposure warning still says NO authentication under TLS" minor was already fixed in the cleanup batch (#54).

Follow-ups

  • Token logged in cleartext at info-level (crates/clowder-daemon/src/main.rs) — the bearer token is printed to the daemon log on startup so the operator can copy it, but it then lands in any log aggregation. Consider redacting from the log and pointing operators at clowder remote-token (which reads the state-dir file) instead, or writing it to a 0600 file only.
  • Credential rotation is all-or-nothing (crates/clowder-daemon/src/remote_tls.rs::load_or_generate) — it only takes the "load" path when all three files (remote-cert.pem, remote-key.pem, remote-token) exist; deleting any one regenerates all three, so "rotate the token" silently also rotates the cert and breaks every client's TOFU pin. Consider independent token rotation (e.g. clowder remote-token --rotate that regenerates only the token) and/or an explicit --rotate-cert.

Larger deferred items (design-only in the M7d spec)

  • mTLS / client certificates — channel-bound client auth instead of a bearer token.
  • QUIC transport (quinn) — if roaming/mux ever matters (M7 deliberately deferred this; TCP+TLS is adequate for a terminal).
  • Configured-fingerprint pin / pairing UX — an alternative to TOFU that closes the first-connect window (a single pasted "pairing string" of fingerprint + token).
  • macOS Keychain storage for the client token (currently config/env only; the Rust forwarder would need security-framework).
主要语言
Rust
星标
0
派生
0
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

richardcase/clowder 的其他 Issue

查看 richardcase/clowder 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。