Using client certificate to secure self-hosted couchdb

[t00]

On my home network, to avoid it being hacked, I use nginx reverse proxy with client certificate enforced over domain with letsencrypt https certificate.

It seems couchdb supports client certificates natively but I would like to rather rely on couchdb nginx reverse proxy solution.

All good so far, but is it somehow possible to add client certificate in obsidian-livesync so that I can safely expose couchdb to the internet without worrying that someone eventually will hack the version I use before I will have time to upgrade it?

[hilsonp]

I would really like this as well but how would we add the client certificate and private key on the ios device ? Thanks to the setup string generated by the plugin ?

[t00]

I use Android and installing a certificate on the OS is a matter of opening it in Files application and accepting installation dialog after choosing the certificate is about custom identity or VPN. I hope iOS has similar behavior regarding such certificates.
With the amount of options in obsidian-sync plugin I hope even if the feature will work only on some clients, it will be worth adding and even encouraging users to enable it if self-hosting of couchdb is planned.

[hilsonp]

I think that the installation you describe is a server certificate that you install so that your device will trust the server it connects to.
The server certificate is added to the mobile truststore.

What we would like to have is the possibility to have the Obsidian client encrypt his communication using his client certificate and his private key.

This is mutual tls.

To do so:

• The server needs to secure the communication with a server certificate. This is easily done with Nginx and a certificate (eg: zerossl or let's encrypt)
• The client needs to have a way to store a certificate (eg: self signed) and a private key to present himself and be recognised be the server.
• The server (eg: Nginx) must be configured to allow connections from those known certificates only)

This is pretty well described here: https://smallstep.com/hello-mtls/doc/server/nginx

I may be wrong but I think only the second point is missing in the plug-in to allow this.

Best regards,