Non-TLS GMID server

[zod076]

Can I omit the cert/TLS configurations in gmid.conf ? I plan to test and use this with Yggdrasil network stack which is already encrypted by default..

[omar-polo]

Hello! it is on my TODO list but not implemented yet.

[zod076]

Cheers. in the mean time, I was using LetsEncrypt and decided to remove that as I read gemini prefers self-signed certificates.. This seems to work for now with a domain name pointed to a Yggdrasil addresses..

[snit-guckfung]

I imagine TLSless Gemini would work with most capsules, but how do the 6X status codes, which inherently rely on clientside certificates, work? Since Yggdrasil already has its own encryption layer, can client certificates be provided from Yggdrasil itself? Could an application running on Yggdrasil even see that certificate? Or do you just have to revert to standard Gemini in order to use 6X and client certificates? Would nonetheless love TLSless Gemini support for all the capsules that don't even have to worry about this.

Also, is there any consensus on a port and the protocol part in a URI (like http://*:80->https://:433)? I recall seeing somewhere a proposal for geminict:// with port 5691.

[zod076]

Hello! it is on my TODO list but not implemented yet.

Hello again, is this still on ?

I'm on version 2.11 and when I add a second server block with a Yggdrasil address without any cert/key, gmid -n complains about invalid vhost definition.

Also, can we use a literal IP address for the server block directive ? Example:

server "1.2.3.4" {
...
}

server "1:2:3::4" {
..
}

[omar-polo]

Hello @zod076

it is still pending, yes. I didn't had enough time to focus and implement this, even if in theory it's a short diff. we "just" have to skip the handshake phase and don't install the custom IO layer in the bufferevents; maybe the routines to check client-certificate need a touch as well to bail out without touching the tls context, but otherwise the rest should work as intended.

so for now cert and key are still mandatory.

Also, can we use a literal IP address for the server block directive ? Example:

Yes, it is supported. for example:

server "1.2.3.4" {
    listen on "1.2.3.4" port 9876
    # ...
}

[zod076]

Just following up, is the option to run TLSless mode being worked on ?

[zod076]

Hi, just following up on this again.. any updates on this ?