Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add mutual TLS (mTLS) support for Immich server connections. immich supports client certificate in the app and web, it secures the installation considerably without a need for VPN (assuming sharing pfx with immich instance users).
Originally I implemented a hackish way to hook into original node immich-cli but immich-go is so much lighter and easier to use, why not here as well.
Adds three client options and their matching CLI flags so immich-go can authenticate to servers that require a client certificate:
--client-cert PEM client certificate
--client-key PEM private key matching the certificate
--ca-cert PEM CA bundle used to verify the server certificate
OptionClientCertificate loads the pair with tls.LoadX509KeyPair and appends it to the transport's TLS config; supplying only one of the two is rejected up front. OptionCACertificate extends a copy of the system cert pool, so a private CA can be added without losing public trust roots. Both are no-ops when their flags are unset, leaving the default TLS behaviour unchanged.
The flags are registered on Client.RegisterFlags, so they are picked up by every command that opens a server connection (upload, stack) and are configurable via config file and IMMICH_GO_* environment variables like any other client setting.
Covered by immich/mtls_test.go: a client cert is accepted, a connection without one is refused, and a mismatched cert/key pair errors.
Documentation is in a separate commit.