TLS and security

Mandatory for external access

SASL/PLAIN and Basic transmit the password in the clear — expose them externally only over TLS.

TLS options

Recommended: a reverse proxy (Caddy/Nginx) with TLS termination in front of 8080 (the web console) and, if needed, in front of 9092/50051. Caddy issues Let's Encrypt certificates automatically.

The broker's native TLS — on the gRPC and Kafka ports, including mTLS (client certificate verification). Certificate/key paths are set in the TLS section of serve.toml; in the docker setup the certificates are mounted into the container. Clients:

# roxactl over TLS:
roxactl --endpoint https://SERVER:50051 --tls-ca ca.pem topic list

# kcat over TLS + SASL:
kcat -b SERVER:9092 -X security.protocol=SASL_SSL -X ssl.ca.location=ca.pem \
     -X sasl.mechanism=PLAIN -X sasl.username=app -X sasl.password=<pass> -L

Authentication

Layer	Mechanism
gRPC data-plane (roxactl, SDK)	Basic credentials from [[auth.users]]
Kafka wire	SASL/PLAIN (the same users)
Web console	login/password from admin.toml; argon2 hashes, CSPRNG sessions with a 24 h TTL

Data-plane roles (checked on every request): admin — all operations; manager — topic management only (create/delete/describe); writer — write only; viewer — read only. Diagnostics, cluster state and the consumer group list are available to admin only. Without the [[auth.users]] section access is open — acceptable for local development only.

In the Pro / Enterprise editions (the “RBAC” capability, see Licensing) you additionally get:

• per-topic ACLs — the topics field on a manager/writer/viewer user: a list of exact names or orders-* prefixes; the user sees and reads/writes only the allowed topics (topic lists and Kafka Metadata are filtered). For a manager the ACL also scopes management: they can create, alter and delete only the topics on their list. The ACL does not apply to the admin role — that is the superuser, and the broker refuses to start with such a config (and the web console will not let you set it), so that a restriction never merely looks enforced;
• dynamic users — create/edit/delete without a broker restart: the “Access” tab of the web console or roxactl user list|create|delete. Stored in data_dir (persistent together with the metadata); a static user from serve.toml always wins on a name collision — access is recoverable by editing the config.

Licensed editions also add RBAC users for the web console itself (the seat limit comes from the license).

Production checklist

1. All CHANGE_ME… passwords changed (serve.toml, admin.toml, .env).
2. [[auth.users]] enabled; no open access.
3. TLS on every externally reachable port.
4. The MinIO port (9000) is not published externally.
5. Secrets match in three places (see the production stack).