How to deal with components that use x509 certificate for authentication (like RavenDB)

[espenrl]

I've been playing with Aspire and RavenDB

var builder = DistributedApplication.CreateBuilder(args);

var ravendb = builder
    .AddContainer("aspire-ravendb", "ravendb/ravendb", "6.0-ubuntu-latest")
    .WithVolumeMount("aspire-ravendb.data", "/opt/RavenDB/Server/RavenData", VolumeMountType.Named, isReadOnly: false)
    .WithEnvironment("RAVEN_Setup_Mode", "None")
    .WithEnvironment("RAVEN_License_Eula_Accepted", "true")
    .WithEnvironment("RAVEN_Security_UnsecuredAccessAllowed", "PrivateNetwork")
    .WithServiceBinding(8080, scheme: "http")
    .WithServiceBinding(38888, scheme: "tcp");

For now I add RAVEN_Security_UnsecuredAccessAllowed=PrivateNetwork to enable unsecured access. But for all practical purposes RavenDB uses x509 certificate which ensures secure access.

I would like to implement a component for RavenDB, but I'm unsure about how I would go about with the x509 certificate that needs to be both uploaded to RavenDB and be made available to the services configured through Aspire.

The things that need to be dealt with is very much akin to #1151 persist generated password for SQL container. x509 certificate must be generated, persisted and made available to services that uses WithServiceBinding.

In the end, what I'm asking is, have you guys made any plans about dealing with components that uses other mechanisms than a connection string?

[davidfowl]

I would like to implement a component for RavenDB, but I'm unsure about how I would go about with the x509 certificate that needs to be both uploaded to RavenDB and be made available to the services configured through Aspire.

Generating a cert seems fine, but what does the cert installation look like for each application? There's some prior art here with the Cosmos DB emulator which exposes an endpoint that applications can use at development time to download the cert. That would require SDK changes though. It doesn't need to be an endpoint, you can pass a path to the cert or pass it in an env variable.

In the end, what I'm asking is, have you guys made any plans about dealing with components that uses other mechanisms than a connection string?

We have some patterns. You can add an overload of WithReference that takes your concrete type and injects whatever configuration is necessary to make the reference work.

[adambajguz]

@davidfowl do you plan to add official RavenDB support like it was added for MongoDB?

[davidfowl]

Nope. It might be a better fit for https://github.com/communityToolkit/Aspire/.

[adambajguz]

Ok, fair enough, raven is not as popular and commonly used as mongo. Thanks!