[Feature Request] MTLs authentication support

[Underpath]

I'm using a Gonic instance as my media server for Supersonic. At the moment I'm having to keep the server public to be able to connect remotely. To add an extra layer of protection, I would love to use MTLs authentication on this service. I already use it for most all other services I host through a reverse proxy as it's straightforward to set it up when the client is a browser.

As an example, here's the MTLs implementation for Immich: immich-app/immich#10860

[dweymouth]

How should the client cert and private key be stored after import? is plaintext base64 in the config TOML file or an auxiliary plaintext file in the .config dir fine? Or to rephrase it: are they less of a secret from a security standpoint than the login password (which is stored securely in the OS keyring)?

[Underpath]

Ideally they should be stored in the keyring but I'm not sure how feasible that approach is with the intent to support multiple platforms. I would treat the key + cert file as another credential. The risk is different than with password since there's less risk of phishing and more risk of a threat actor reading it if they have file read permissions on the host. The blast radius is potentially bigger, I imagine most people use the same file to access all their services, even if they use different passwords for different services (and in some cases may use the file as a single authentication factor).

[dweymouth]

Another perhaps better option is that Supersonic imports the .p12 file by just copying it into its .config directory and saving the password to decrypt it in the keyring, and decrypts it on startup. The only downside is if the keyring is not available, it has to prompt at startup for both the server account password (which it currently does), and the password to decrypt the client key file.

And this is something that actually comes up, rather than a theoretical concern, because KDE does not ship with an implementation of the Dbus Secret Service interface (unless they changed it very recently) so KDE users have to enter their password on every startup of Supersonic unless they install Gnome Keyring