Support for mTLS (client certificates)

[YevPo]

Hello, kamal team!

Are there any plans to implement support for mTLS for kamal-proxy and kamal?

Right now, we use traefik accessory for that, but it will be nice to just use kamal.

Relevant Links:
https://doc.traefik.io/traefik/https/tls/#client-authentication-mtls
https://doc.traefik.io/traefik/middlewares/http/passtlsclientcert/#passtlsclientcert

[lumpidu]

I am also intereseted in that, can you elaborate on how you are using traefik in combination with kamal for this purpose ?

[lumpidu]

Thx for your configuration ! Highly appreciated. Frankly, kamal-proxy has so many limitations, this is just one out of many. I don't understand how this should be taken as "production-grade". At least not for the time being.

[YevPo]

@lumpidu , maybe it is good enough for most cases . I guess there are not many people, who need mTLS after all.

[polarctos]

I think there are actually some nice use-cases that depend on mTLS.
On of the more common usages is for example Cloudflare Authenticated Origin Pulls, which is just mTLS based on pinned client certs. Which was also requested here: basecamp/kamal#1628

[kevinmcconnell]

The Cloudflare use case is a good one! I'd be interested to know if anyone has other particular use cases in mind.

I think this is something we can add if it would be useful to enough people, and knowing any other use cases would be helpful in making sure we give it the right API.

I'd also add: Kamal Proxy isn't intended to do everything -- it exists to make deploying apps easier, and it has a bunch of built-in convenience functions to that end. And as much as possible, whatever it has should be minimal-config, and as automated as we can make it. We're keeping it small on purpose. But it's also absolutely fine to combine it with other infrastructure components when you need to do something it doesn't have! To put it another way, Kamal & Kamal Proxy aren't trying to cover 100% of use cases; they're trying to make the common 80% as simple as we can, and then you can plug in whatever else you need for the other 20%.

[AkashRajpurohit]

Interested to see this land in Kamal as well especially for the same use of being able to use Cloudflare Authenticated Origin Pulls.