Transport Layer Security (TLS)
LeilFS can encrypt its internal communication channels with TLS — client‑to‑master, client‑to‑chunkserver, chunkserver‑to‑master, chunkserver‑to‑chunkserver (replication) and master‑to‑shadow.
TLS support is relatively new and the chunkserver implementation is marked experimental. Benchmark your workload with TLS enabled before relying on it in production, and confirm the exact option set against the installed man pages (man leil-master.cfg, man leil-chunkserver.cfg).
Enabling TLS
TLS is configured per component by pointing each daemon at its certificate, private key and the CA certificate. The same three options appear in leil-master.cfg, leil-chunkserver.cfg and leil-metalogger.cfg:
| Option | Meaning |
|---|---|
TLS_CERT_FILE | Path to this node's TLS certificate |
TLS_KEY_FILE | Path to this node's private key |
TLS_CA_CERT_FILE | Path to the trusted CA certificate |
# /etc/saunafs/leil-master.cfg
TLS_CERT_FILE = /etc/saunafs/ssl/leil-master.crt
TLS_KEY_FILE = /etc/saunafs/ssl/leil-master.key
TLS_CA_CERT_FILE = /etc/saunafs/ssl/ca.crt
# /etc/saunafs/leil-chunkserver.cfg
TLS_CERT_FILE = /etc/saunafs/ssl/leil-chunkserver.crt
TLS_KEY_FILE = /etc/saunafs/ssl/leil-chunkserver.key
TLS_CA_CERT_FILE = /etc/saunafs/ssl/ca.crt
All nodes must present certificates issued by the same CA. Restart each service after editing its configuration.
Protect private keys with strict permissions (mode 0600, owned by the service user). A leaked TLS_KEY_FILE lets an attacker impersonate that node.
Certificate management
Generate a CA and per‑node certificates with standard OpenSSL tooling. Every node must trust the same CA certificate (TLS_CA_CERT_FILE).
Because both a certificate (TLS_CERT_FILE) and the CA (TLS_CA_CERT_FILE) are configured on every node, each side can validate the other's certificate — this is mutual TLS (mTLS), where both ends of a connection authenticate. mTLS is stronger than server‑only TLS and is the recommended posture for a LeilFS cluster.
Handle compromised keys by rotating the affected certificate and distributing an updated CA/CRL to every node.
TLS adds CPU overhead for encryption on every channel. See Performance tuning for related tuning and measure before and after enabling it.