Strong option for authenticating clients to a self-hosted nqserver, deferred until needed.
Already works today with no library change: the client passes a certificate via Options.HTTPClient (TLSClientConfig.Certificates), and a custom http.Server can set TLSConfig.ClientAuth = RequireAndVerifyClientCert around server.Handler. What's missing for it to be a first-class feature:
nqserver --client-ca <pem>: require and verify client certificates against that CA.nq --client-cert/--client-key (or document the library route only).- A recipe in the README and an in-process test (
server package) proving a client without a cert is rejected and one with a cert runs a full test.
Context: chosen order in #1 is bearer token (A) now, signed URLs (B) next, mTLS (C) when a deployment needs a PKI-backed identity.
Strong option for authenticating clients to a self-hosted
nqserver, deferred until needed.Already works today with no library change: the client passes a certificate via
Options.HTTPClient(TLSClientConfig.Certificates), and a customhttp.Servercan setTLSConfig.ClientAuth = RequireAndVerifyClientCertaroundserver.Handler. What's missing for it to be a first-class feature:nqserver --client-ca <pem>: require and verify client certificates against that CA.nq --client-cert/--client-key(or document the library route only).serverpackage) proving a client without a cert is rejected and one with a cert runs a full test.Context: chosen order in #1 is bearer token (A) now, signed URLs (B) next, mTLS (C) when a deployment needs a PKI-backed identity.