Unify all client/backend communication by letting it go through the client
Description
Risk & mitigation
Market Goal
Attachments
Checklist
Activity
Lluis CamposNovember 17, 2021 at 7:03 PMEdited
We have decided to reverse the direction of 3rd party integrations so this epic is mostly de-scoped.
Rejecting tasks , , , , and .
For future reference, the work done so far can be found in:
https://github.com/mendersoftware/mender/pull/878 (review not completed)
Complementary PRs to the above listed here (not reviewed)
Kristian AmlieSeptember 28, 2021 at 10:39 AM
We want it to be a drop-in solution which doesn't require any changes to the clients. If we switched to UNIX sockets, all of mender-connect, mender-configure, and mender-monitor would have to change. Besides, it's still speaking HTTP, and we plan to extend it to HTTP proxying later on, so using a network port seems like a natural choice.
There are some advantages to UNIX sockets, such as better control over who can access it. But this isn't needed, because we already use access control on the DBus endpoint to get the JWT token, and without that you cannot do anything with the localhost interface, even if you technically can access the port.
Peter GrzybowskiSeptember 28, 2021 at 10:08 AM
I was not into this a lot, but I have this comment: isn't UNIX socket a better interface than localhost?
Kristian AmlieAugust 31, 2021 at 9:11 AM
Planning done!
I have gone for extremely limited documentation. This is very advanced functionality, which requires implementing whole daemons from scratch. Therefore the only documentation I have included is that you can disable the built-in daemon in . Beyond that, I think we should get comfortable with writing IoT integrations ourselves before we try to steer anyone else in that direction.
eystein.maloy.stenbergAugust 30, 2021 at 5:31 PM
Thank you, indeed it seems like a good idea to start with this next sprint, so let's aim for that!
Details
Assignee
Kristian AmlieKristian AmlieReporter
Kristian AmlieKristian AmlieLabels
Epic Name
Unified communicationGoals
NonePriority
(None)Backlog
yesStory Points
82
Details
Details
Assignee
Reporter
Labels
Epic Name
Goals
Priority
Backlog
Story Points
Zendesk Support
Linked Tickets
Zendesk Support
Linked Tickets
Zendesk Support

Acceptance criteria:
Client DBus auth API returns localhost instead of the server
On this localhost address, client offers an HTTP API which is proxied to the backend
Local protocol is plain HTTP
The client handles all authentication and mTLS and HW crypto.
It is possible to turn the internal auth manager off, so that a different service can provide the connection.
Feature branch:
feature-unified_comms