mirror of
https://github.com/pomerium/pomerium.git
synced 2025-08-03 00:40:25 +02:00
* update enterprise config doc * add anchors to key names Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
This commit is contained in:
backport-actions-token[bot]
GitHub
parent
0be12d6a90
commit
4e8faf222e
4 changed files with 70 additions and 210 deletions
|
|
@ -10,182 +10,34 @@ meta:
|
|||
|
||||
The keys listed below can be applied in Pomerium Console's `config.yaml` file, or applied as environment variables (in uppercase, replacing `-` with `_`).
|
||||
|
||||
## administrators
|
||||
|
||||
a list of user ids, names or emails to make administrators, useful for bootstrapping
|
||||
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## audience
|
||||
|
||||
A list of audiences for verifying signing key
|
||||
|
||||
**Default value:** `[]`
|
||||
|
||||
## authenticate-service-url
|
||||
|
||||
URL for the authenticate service
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## bind-addr
|
||||
|
||||
the address to listen on
|
||||
|
||||
**Default value:** `:8701`
|
||||
|
||||
## customer-id
|
||||
|
||||
the customer id
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## database-encryption-key
|
||||
|
||||
base64-encoded encryption key for encrypting sensitive data in the database
|
||||
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## database-url
|
||||
|
||||
the database to connect to
|
||||
|
||||
**Default value:** `postgresql://pomerium:pomerium@localhost:5432/dashboard?sslmode=disable
|
||||
`
|
||||
|
||||
## databroker-service-url
|
||||
|
||||
the databroker service url
|
||||
|
||||
**Default value:** `http://localhost:5443`
|
||||
|
||||
## debug-config-dump
|
||||
|
||||
dump databroker configuration
|
||||
|
||||
**Default value:** `false`
|
||||
|
||||
## disable-validation
|
||||
|
||||
disable config validation
|
||||
|
||||
**Default value:** `false`
|
||||
|
||||
## enable-remote-diagnostics
|
||||
|
||||
enable remote diagnostics
|
||||
|
||||
**Default value:** `false`
|
||||
|
||||
## grpc-addr
|
||||
|
||||
the address to listen for gRPC on
|
||||
|
||||
**Default value:** `:8702`
|
||||
|
||||
## help
|
||||
|
||||
help for serve
|
||||
|
||||
**Default value:** `false`
|
||||
|
||||
## license
|
||||
|
||||
license JWT
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## override-certificate-name
|
||||
|
||||
override the certificate name used for the databroker connection
|
||||
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## prometheus-data-dir
|
||||
|
||||
path to prometheus data
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## prometheus-listen-addr
|
||||
|
||||
embedded prometheus listen address as host:port
|
||||
|
||||
**Default value:** `127.0.0.1:9090`
|
||||
|
||||
## prometheus-scrape-interval
|
||||
|
||||
prometheus scrape frequency
|
||||
|
||||
**Default value:** `10s`
|
||||
|
||||
## prometheus-url
|
||||
|
||||
url to access prometheus metrics server
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## shared-secret
|
||||
|
||||
base64-encoded shared secret for signing JWTs
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## signing-key
|
||||
|
||||
base64-encoded signing key (public or private) for verifying JWTs
|
||||
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## tls-ca
|
||||
|
||||
base64-encoded string of tls-ca
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## tls-ca-file
|
||||
|
||||
file storing tls-ca
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## tls-cert
|
||||
|
||||
base64-encoded string of tls-cert
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## tls-cert-file
|
||||
|
||||
file storing tls-cert
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## tls-insecure-skip-verify
|
||||
|
||||
disable remote hosts TLS certificate chain and hostname check
|
||||
|
||||
|
||||
**Default value:** `false`
|
||||
|
||||
## tls-key
|
||||
|
||||
base64-encoded string of tls-key
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## tls-key-file
|
||||
|
||||
file storing tls-key
|
||||
|
||||
**Default value:** `none`
|
||||
|
||||
## use-static-assets
|
||||
|
||||
when false, forward static requests to localhost:3000
|
||||
|
||||
**Default value:** `true`
|
||||
| Name | Description | Default Value |
|
||||
|:--------|:-------------|---------------|
|
||||
| <a class="entRef-anchor" id="administrators">#</a><a href=#administrators>administrators</a> | A list of user ids, names or emails to make administrators. Useful for bootstrapping. | none |
|
||||
| <a class="entRef-anchor" id="audience">#</a><a href=#audience>audience</a> | A list of audiences for verifying the signing key. | `[]` |
|
||||
| <a class="entRef-anchor" id="authenticate-service-url">#</a><a href=#authenticate-service-url>authenticate-service-url</a> | URL for the Authenticate Service. Required for Device Registration. | none |
|
||||
| <a class="entRef-anchor" id="bind-addr">#</a><a href=#bind-addr>bind-addr</a> | The address the Pomerium Console will listen on. | `:8701` |
|
||||
| <a class="entRef-anchor" id="customer-id">#</a><a href=#customer-id>customer-id</a> | The customer ID | none |
|
||||
| <a class="entRef-anchor" id="database-encryption-key">#</a><a href=#database-encryption-key>database-encryption-key</a> | The base64-encoded encryption key for encrypting sensitive data in the database. | none |
|
||||
| <a class="entRef-anchor" id="database-url">#</a><a href=#database-url>database-url</a> | The database Pomerium Enterprise Console will use. | `postgresql://pomerium:pomerium@localhost:5432/dashboard?sslmode=disable` |
|
||||
| <a class="entRef-anchor" id="databroker-service-url">#</a><a href=#databroker-service-url>databroker-service-url</a> | The databroker service URL. | `http://localhost:5443` |
|
||||
| <a class="entRef-anchor" id="debug-config-dump">#</a><a href=#debug-config-dump>debug-config-dump</a> | Dumps the Databroker configuration. This is a debug option to be used only when specified by Pomerium Support. | `false` |
|
||||
| <a class="entRef-anchor" id="disable-remote-diagnostics">#</a><a href=#disable-remote-diagnostics>disable-remote-diagnostics</a> | Disable remote diagnostics. | `true` |
|
||||
| <a class="entRef-anchor" id="disable-validation">#</a><a href=#disable-validation>disable-validation</a> | Disable config validation. | `false` |
|
||||
| <a class="entRef-anchor" id="grpc-addr">#</a><a href=#grpc-addr>grpc-addr</a> | The address to listen for gRPC on. | `:8702` |
|
||||
| <a class="entRef-anchor" id="help">#</a><a href=#help>help</a> | help for serve | `false` |
|
||||
| <a class="entRef-anchor" id="license-key">#</a><a href=#license-key>license-key</a> | Required: Provide the license key issued by your account team. | none |
|
||||
| <a class="entRef-anchor" id="override-certificate-name">#</a><a href=#override-certificate-name>override-certificate-name</a> | Overrides the certificate name used for the databroker connection. | none |
|
||||
| <a class="entRef-anchor" id="prometheus-data-dir">#</a><a href=#prometheus-data-dir>prometheus-data-dir</a> | The path to Prometheus data | none |
|
||||
| <a class="entRef-anchor" id="prometheus-listen-addr">#</a><a href=#prometheus-listen-addr>prometheus-listen-addr</a> | When set, embedded Prometheus listens at this address. Set as `host:port` | `127.0.0.1:9090` |
|
||||
| <a class="entRef-anchor" id="prometheus-scrape-interval">#</a><a href=#prometheus-scrape-interval>prometheus-scrape-interval</a> | The Prometheus scrape frequency | `10s` |
|
||||
| <a class="entRef-anchor" id="prometheus-url">#</a><a href=#prometheus-url>prometheus-url</a> | The URL to access the Prometheus metrics server. | none |
|
||||
| <a class="entRef-anchor" id="shared-secret">#</a><a href=#shared-secret>shared-secret</a> | The base64-encoded secret for signing JWTs, shared with OSS Pomerium. | none |
|
||||
| <a class="entRef-anchor" id="signing-key">#</a><a href=#signing-key>signing-key</a> | base64-encoded signing key (public or private) for verifying JWTs. This option is deprecated in favor of `authenticate-service-url`. | none |
|
||||
| <a class="entRef-anchor" id="tls-ca">#</a><a href=#tls-ca>tls-ca</a> | base64-encoded string of tls-ca | none |
|
||||
| <a class="entRef-anchor" id="tls-ca-file">#</a><a href=#tls-ca-file>tls-ca-file</a> | file storing tls-ca | none |
|
||||
| <a class="entRef-anchor" id="tls-cert">#</a><a href=#tls-cert>tls-cert</a> | base64-encoded string of tls-cert | none |
|
||||
| <a class="entRef-anchor" id="tls-cert-file">#</a><a href=#tls-cert-file>tls-cert-file</a> | file storing tls-cert | none |
|
||||
| <a class="entRef-anchor" id="tls-insecure-skip-verify">#</a><a href=#tls-insecure-skip-verify>tls-insecure-skip-verify</a> | Disable remote hosts TLS certificate chain and hostname checks. | `false` |
|
||||
| <a class="entRef-anchor" id="tls-key">#</a><a href=#tls-key>tls-key</a> | base64-encoded string of tls-key | none |
|
||||
| <a class="entRef-anchor" id="tls-key-file">#</a><a href=#tls-key-file>tls-key-file</a> | file storing tls-key | none |
|
||||
| <a class="entRef-anchor" id="use-static-assets">#</a><a href=#use-static-assets>use-static-assets</a> | When false, forward static requests to `localhost:3000`. | `true` |
|
||||
Loading…
Add table
Add a link
Reference in a new issue