So I installed ipfs (Kubo) on several nodes in an internal network and let those daemons run for a few days. Then I came back behind that installation and installed/configured those same nodes with IPFS-Cluster services.
I used the cluster secret for all pre-existing ipfs nodes with the option of trusted peers set to “*”. That being said my understanding of the docs is such that even with that trusted peers setting, the content pinned to the cluster “should” be private.
My expectations after installing ipfs cluster and seeing the nodes connect to the cluster successfully is that anything pinned explicitly to the cluster would not be available using public gateways. However, when I did a test pin of a file directly to the cluster I was able to access it using a public gateway.
The IPFS-Cluster network and its related secret are independent from the IPFS network that the ipfs daemons are using and it is only used for communications between cluster peers.
You need to configure your ipfs daemons to be a private network themselves.
Thank you for your reply. That definitely makes sense. Also wondering if there are docs I missed on the ipfs-cluster site that point this out. It kind of reads like the IPFS Cluster does all of that out the box. For context I went through the production docs several times although I may have missed a key point somewhere.
IPFS Cluster is a fully distributed application. ipfs-cluster-service runs a Cluster peer and all peers are equal. Cluster peers form an separate, isolated libp2p [private] network, which uses the cluster_secret (a 32-bit hex-encoded passphrase present in the configuration of every peer).
This network does not interact with the main IPFS network, nor with other private IPFS networks and is solely used so that Cluster peers can communicate and operate. The network uses a number of blocks also used by IPFS (DHT, PubSub, Bitswap…) but, unlike IPFS, does not enjoy public bootstrappers.
This means that Cluster peers will normally need their own bootstrappers (it can be any peer in the Cluster), although sometimes they can rely on mDNS discovery.
This also means that Cluster peers operate separately from IPFS with regards to NAT hole punching, ports etc.