Module Kafka_securitySource

Security transport configuration shared by producer and consumer.

Sourcetype protocol = [
  1. | `Plaintext
    (*

    No encryption or authentication. Local dev default.

    *)
  2. | `Ssl
    (*

    TLS encryption, no SASL authentication.

    *)
  3. | `Sasl_plaintext
    (*

    SASL authentication, no TLS encryption.

    *)
  4. | `Sasl_ssl
    (*

    SASL authentication over TLS. Production default.

    *)
]
Sourcetype sasl_mechanism =
  1. | Plain
  2. | Scram_sha256
  3. | Scram_sha512
Sourcetype sasl = {
  1. mechanism : sasl_mechanism;
  2. username : string;
  3. password : string;
}
Sourcetype t =
  1. | Plaintext
  2. | Ssl of {
    1. ssl_ca_location : string option;
    }
  3. | Sasl_plaintext of sasl
  4. | Sasl_ssl of {
    1. ssl_ca_location : string option;
    2. sasl : sasl;
    }
Sourceval default : t

Plaintext. Use for local dev and unit tests. Do not use in production — requires explicit Ssl or Sasl_ssl.

Sourceval protocol_of_string : string -> (protocol, string) result

Parse a finite Kafka security protocol value. Accepted values are "plaintext", "ssl", "sasl_plaintext", and "sasl_ssl", case insensitively.

Sourceval of_env : unit -> (t, string) result

Build from environment variables:

  • KAFKA_SECURITY_PROTOCOL — "plaintext" | "ssl" | "sasl_plaintext" | "sasl_ssl" (default: "plaintext", unknown values return Error)
  • KAFKA_SSL_CA_LOCATION — path to CA cert bundle
  • KAFKA_SASL_MECHANISM — "PLAIN" | "SCRAM-SHA-256" | "SCRAM-SHA-512"
  • KAFKA_SASL_USERNAME
  • KAFKA_SASL_PASSWORD
Sourceval apply : Kafka_raw.kafka_conf -> t -> (unit, string) result

Set librdkafka security.protocol, ssl.ca.location, and sasl.* keys on conf. Returns Error msg if any key is rejected by librdkafka. SASL credentials are required by the Sasl_plaintext and Sasl_ssl constructors. Called internally by producer and consumer conf_of_config; not part of the public API.