Ensure all containers are password protected

[eerhardt]

Where possible, we should be enabling passwords on our containers.

The goal here is to provide a layer of redundancy. If ACA firewalling (or other system to from external access) fails, an external client will still not be able to access the container without knowledge of the authentication password.

The following containers don't have password protection:

• Garnet
• Kafka
• MongoDB Add authentication (username & password) to AddMongoDB (dotnet/aspire#5788)
• Nats (Add password protection to NATS #6259)
• Redis Revisit Redis password options (dotnet/aspire#3838)
• Seq
• Valkey

[Mrxx99]

For NATS I would like to contribute the password implementation, I already have explored and started work on this

[eerhardt]

For NATS I would like to contribute the password implementation, I already have explored and started work on this

Sounds great! Looking forward to the PR.

[Mrxx99]

For NATS I would like to contribute the password implementation, I already have explored and started work on this

Sounds great! Looking forward to the PR.

@eerhardt The PR #6259 is ready for review.

[eerhardt]

@liammclennan @nblumhardt - any interest in adding password support for Seq?

[nblumhardt]

@eerhardt sounds good!

The Seq container supports a couple of environment variables that would make this pretty easy.

One possible wrinkle; the variables are:

• SEQ_FIRSTRUN_ADMINUSERNAME - username for the automatically-created admin user account; default is admin
• SEQ_FIRSTRUN_ADMINPASSWORD - plain text password for same
• SEQ_FIRSTRUN_ADMINPASSWORDHASH - alternative to the above, provided as a salted cryptographic hash, for marginally better security when passing through configuration systems
• SEQ_FIRSTRUN_REQUIREAUTHENTICATIONFORHTTPINGESTION - sets the "require authentication for ingestion" flag

But, these only apply when the container's storage is first created, so modifying them once the Seq container has been initialized/has persistent data will have no effect. Would this be surprising/break expectations compared with the way other containers are doing it?

[eerhardt]

But, these only apply when the container's storage is first created, so modifying them once the Seq container has been initialized/has persistent data will have no effect. Would this be surprising/break expectations compared with the way other containers are doing it?

I don't think it would be surprising since it is consistent with other containers. Other containers (postgres, mongodb, etc) use the password in the stored data as well. Changing the password after the data was created basically invalidates the existing data.

See the Warning at: https://learn.microsoft.com/en-us/dotnet/aspire/database/sql-server-integration?tabs=dotnet-cli%2Cssms#add-sql-server-resource-with-data-volume

Warning

The password is stored in the data volume. When using a data volume and if the password changes, it will not work until you delete the volume.