Support Unix Sockets

[sloonz]

AFAICT Kratos can only listen on TCP sockets. Unix sockets have a few advantages over TCP sockets.From least important to more important:

• Minor performance gains
• Convenience for system administrators in some contexts : using /run/http/kratos.sock rather than localhost:31038 is more expressive and less error-prone (for example, when configuring the reverse-proxy). There's no need to keep track of ports assignments (which ports are assigned to which services, which should be open/closed on the firewall…).
• Security benefits : Unix sockets are never reachable from an external machine, so a misconfiguration (listening on 0.0.0.0:8080 instead of localhost:31038) has less of an impact. More importantly, Unix socket are subject to normal Unix permissions ; if a non-privileged user is compromised on the machine, he can access without any trouble to localhost:31038, but still be limited by normal filesystem restrictions to access on /srv/http/kratos.sock

[aeneasr]

I think this is a great idea which we already support in Ory Hydra. I don't quite remember the place where it is but I think we can extract the logic to github.com/ory/x or github.com/ory/graceful and make it available for all ory projects - hence also Ory Kratos :)

[sloonz]

It’s here in Hydra: https://github.com/ory/hydra/blob/24f91ab7038e4c612db5af86ff0f3ee5eb03c878/cmd/server/handler.go#L284

I think what could be done is extracting a MakeListener(add string, permission *config.UnixPermission) (l net.Listener, tlsPossible bool, err error) function and put it into github.com/ory/x. It would require to also move hydra's config.UnixPermission into ory/x.

I can try to do a pull request doing this if you’re okay with that approach.

[aeneasr]

SGTM!

[sloonz]

First attempt :

ory/x@master...sloonz:master
ory/hydra@master...sloonz:master
master...sloonz:master

How do I proceed from here ? Do we keep discussing this here ? Or do I create an issue (pull request ?) on each project ?

[aeneasr]

Oh great! I'll take a look now!

[aeneasr]

Yeah I think you can just create the PRs - looks good to me

[aeneasr]

merged!

[sloonz]

Thanks for taking the time of reviewing and merging this !

[aeneasr]

Thank you for making it! :)