mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-15 10:07:47 +02:00
envoy: Initial changes
This commit is contained in:
Travis Groth
parent
8f78497e99
commit
99e788a9b4
107 changed files with 2542 additions and 3322 deletions
|
|
@ -5,6 +5,7 @@ sidebarDepth: 2
|
|||
meta:
|
||||
- name: keywords
|
||||
content: pomerium community help bugs updates features
|
||||
|
||||
description: >-
|
||||
This document describes how you users can stay up to date with pomerium,
|
||||
report issues, get help, and suggest new features.
|
||||
|
|
@ -85,15 +86,15 @@ Customize for your identity provider run `docker-compose up -f nginx.docker-comp
|
|||
|
||||
- Uses Google Kubernetes Engine's built-in ingress to do [HTTPS load balancing]
|
||||
|
||||
<<< @/docs/configuration/examples/helm/helm_gke.sh
|
||||
<<< @/scripts/helm_gke.sh
|
||||
|
||||
### AWS ECS
|
||||
|
||||
- Uses Amazon Elastic Container Service
|
||||
|
||||
<<< @/docs/configuration/examples/helm/helm_aws.sh
|
||||
<<< @/scripts/helm_aws.sh
|
||||
|
||||
### Kubernetes
|
||||
## Kubernetes
|
||||
|
||||
- Uses Google Kubernetes Engine's built-in ingress to do [HTTPS load balancing]
|
||||
- HTTPS (TLS) between client, load balancer, and services
|
||||
|
|
@ -128,43 +129,3 @@ Customize for your identity provider run `docker-compose up -f nginx.docker-comp
|
|||
[helloworld]: https://hub.docker.com/r/tutum/hello-world
|
||||
[httpbin]: https://httpbin.org/
|
||||
[https load balancing]: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress
|
||||
|
||||
## Istio
|
||||
|
||||
[istio]: https://github.com/istio/istio
|
||||
[certmanager]: https://github.com/jetstack/cert-manager
|
||||
[grafana]: https://github.com/grafana/grafana
|
||||
|
||||
- Istio provides mutual TLS via sidecars and to make Istio play well with Pomerium we need to disable TLS on the Pomerium side.
|
||||
- We need to provide Istio with information on how to route requests via Pomerium to their destinations.
|
||||
- The following example shows how to make Grafana's [auth proxy](https://grafana.com/docs/grafana/latest/auth/auth-proxy) work with Pomerium inside of an Istio mesh.
|
||||
|
||||
#### Gateway
|
||||
|
||||
We are using the standard istio-ingressgateway that comes configured with Istio and attach a Gateway to it that deals with a subset of our ingress traffic based on the Host header (in this case `*.yourcompany.com`). This is the Gateway to which we will later attach VirtualServices for more granular routing decisions. Along with the Gateway, because we care about TLS, we are using Certmanager to provision a self-signed certificate (see Certmanager [docs](https://cert-manager.io/docs) for setup instructions).
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/gateway.yml
|
||||
|
||||
#### Virtual Services
|
||||
|
||||
Here we are configuring two Virtual Services. One to route from the Gateway to the Authenticate service and one to route from the Gateway to the Pomerium Proxy, which will route the request to Grafana according to the configured Pomerium policy.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/virtual-services.yml
|
||||
|
||||
#### Service Entry
|
||||
|
||||
If you are enforcing mutual TLS in your service mesh you will need to add a ServiceEntry for your identity provider so that Istio knows not to expect a mutual TLS connection with, for example `https://yourcompany.okta.com`.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/service-entry.yml
|
||||
|
||||
#### Pomerium Configuration
|
||||
|
||||
For this example we're using the Pomerium Helm chart with the following `values.yaml` file. Things to note here are the `insecure` flag, where we are disabling TLS in Pomerium in favor of the Istio-provided TLS via sidecars. Also note the `extaEnv` arguments where we are asking Pomerium to extract the email property from the JWT and pass it on to Grafana in a header called `X-Pomerium-Claim-Email`. We need to do this because Grafana does not know how to read the Pomerium JWT but its auth-proxy authentication method can be configured to read user information from headers. The policy document contains a single route that will send all requests with a host header of `https://grafana.yourcompany.com` to the Grafana instance running in the monitoring namespace. We disable ingress because we are using the Istio ingressgateway for ingress traffic and don't need the Pomerium helm chart to create ingress objects for us.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/pomerium-helm-values.yml
|
||||
|
||||
#### Grafana ini
|
||||
|
||||
On the Grafana side we are using the Grafana Helm chart and what follows is the relevant section of the `values.yml` file. The most important thing here is that we need to tell Grafana from which request header to grab the username. In this case that's `X-Pomerium-Claim-Email` because we will be using the user's email (provided by your identity provider) as their username in Grafana. For all the configuration options check out the Grafana documentation about its auth-proxy authentication method.
|
||||
|
||||
<<< @/docs/configuration/examples/kubernetes/istio/grafana.ini.yml
|
||||
|
|
|
|||
|
|
@ -15,12 +15,10 @@ export AUTHENTICATE_SERVICE_URL=https://authenticate.corp.beyondperimeter.com
|
|||
|
||||
# Certificates can be loaded as files or base64 encoded bytes.
|
||||
# See : https://www.pomerium.io/docs/reference/certificates
|
||||
export AUTOCERT=TRUE # Use Let's Encrypt to fetch certs. Port 80/443 must be internet accessible.
|
||||
# export AUTOCERT_DIR="./certs" # The path where you want to place your certificates
|
||||
# export CERTIFICATE_FILE="xxxx" # optional, defaults to `./cert.pem`
|
||||
# export CERTIFICATE_KEY_FILE="xxx" # optional, defaults to `./certprivkey.pem`
|
||||
# export CERTIFICATE="xxx" # base64 encoded cert, eg. `base64 -i cert.pem`
|
||||
# export CERTIFICATE_KEY="xxx" # base64 encoded key, eg. `base64 -i privkey.pem`
|
||||
export CERTIFICATE_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer" # optional, defaults to `./cert.pem`
|
||||
export CERTIFICATE_KEY_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key" # optional, defaults to `./certprivkey.pem`
|
||||
# export CERTIFICATE="xxxxxx" # base64 encoded cert, eg. `base64 -i cert.pem`
|
||||
# export CERTIFICATE_KEY="xxxx" # base64 encoded key, eg. `base64 -i privkey.pem`
|
||||
|
||||
# Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64`
|
||||
export SHARED_SECRET="$(head -c32 /dev/urandom | base64)"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
#!/bin/bash
|
||||
|
||||
# See : https://www.pomerium.io/docs/reference/certificates
|
||||
export AUTOCERT=TRUE # Use Let's Encrypt to fetch certs. Port 80/443 must be internet accessible.
|
||||
export CERTIFICATE_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer" # optional, defaults to `./cert.pem`
|
||||
export CERTIFICATE_KEY_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key" # optional, defaults to `./certprivkey.pem`
|
||||
|
||||
# 256 bit random keys
|
||||
export SHARED_SECRET="$(head -c32 /dev/urandom | base64)"
|
||||
|
|
|
|||
|
|
@ -4,10 +4,8 @@
|
|||
authenticate_service_url: https://authenticate.localhost.pomerium.io
|
||||
|
||||
# certificate settings: https://www.pomerium.io/docs/reference/certificates.html
|
||||
autocert: true
|
||||
|
||||
# REMOVE FOR PRODUCTION
|
||||
autocert_use_staging: true
|
||||
certificate_file: "./_wildcard.localhost.pomerium.io.pem"
|
||||
certificate_key_file: "./_wildcard.localhost.pomerium.io-key.pem"
|
||||
|
||||
# identity provider settings : https://www.pomerium.io/docs/identity-providers.html
|
||||
idp_provider: google
|
||||
|
|
|
|||
|
|
@ -1,18 +0,0 @@
|
|||
version: "3"
|
||||
services:
|
||||
pomerium:
|
||||
image: pomerium/pomerium:v0.8.0
|
||||
environment:
|
||||
# Generate new secret keys. e.g. `head -c32 /dev/urandom | base64`
|
||||
- COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
|
||||
volumes:
|
||||
# Use a volume to store ACME certificates
|
||||
- pomerium:/data:rw
|
||||
ports:
|
||||
- 443:443
|
||||
|
||||
# https://httpbin.corp.beyondperimeter.com --> Pomerium --> http://httpbin
|
||||
httpbin:
|
||||
image: kennethreitz/httpbin:latest
|
||||
expose:
|
||||
- 80
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
version: "3"
|
||||
services:
|
||||
pomerium:
|
||||
image: pomerium/pomerium:v0.8.0
|
||||
image: pomerium/pomerium:v0.7.0
|
||||
environment:
|
||||
# Generate new secret keys. e.g. `head -c32 /dev/urandom | base64`
|
||||
- COOKIE_SECRET=V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ services:
|
|||
- /var/run/docker.sock:/tmp/docker.sock:ro
|
||||
|
||||
pomerium-authenticate:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=authenticate
|
||||
|
|
@ -39,7 +39,7 @@ services:
|
|||
- 443
|
||||
|
||||
pomerium-proxy:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=proxy
|
||||
|
|
@ -61,7 +61,7 @@ services:
|
|||
- 443
|
||||
|
||||
pomerium-authorize:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=authorize
|
||||
|
|
@ -77,7 +77,7 @@ services:
|
|||
- 443
|
||||
|
||||
pomerium-cache:
|
||||
image: pomerium/pomerium:v0.8.0 # or `build: .` to build from source
|
||||
image: pomerium/pomerium:v0.7.0 # or `build: .` to build from source
|
||||
restart: always
|
||||
environment:
|
||||
- SERVICES=cache
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
#!/bin/bash
|
||||
# PRE-REQ:
|
||||
# 1) Install Helm : You should verify the content of this script before running.
|
||||
# curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash
|
||||
# 2) Install https://eksctl.io/
|
||||
# For more information see:
|
||||
# - https://eksworkshop.com/helm_root/helm_intro/install/
|
||||
|
||||
echo "=> [AWS] creating cluster"
|
||||
eksctl create cluster --name=pomerium --nodes=1 --region=us-west-2
|
||||
|
||||
echo "=> [AWS] get cluster credentials so we can use kubctl locally"
|
||||
eksctl utils write-kubeconfig --name=pomerium
|
||||
|
||||
echo "=> [AWS] configure Helm access with RBAC"
|
||||
cat <<EOF >.helm-rbac.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: tiller
|
||||
namespace: kube-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: tiller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: tiller
|
||||
namespace: kube-system
|
||||
EOF
|
||||
|
||||
kubectl apply -f .helm-rbac.yaml
|
||||
# cleanup
|
||||
rm .helm-rbac.yaml
|
||||
|
||||
echo "=> initialize Helm to install Tiller in your cluster"
|
||||
helm init --service-account=tiller
|
||||
helm repo update
|
||||
|
||||
echo "=> install pomerium with helm substituting configuration values as required; be sure to change these"
|
||||
helm install $HOME/charts/stable/pomerium/ \
|
||||
--name pomerium \
|
||||
--set config.sharedSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set config.cookieSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set config.cert=$(base64 -i cert.pem) \
|
||||
--set config.key=$(base64 -i privkey.pem) \
|
||||
--set config.policy="$(cat policy.example.yaml | base64)" \
|
||||
--set authenticate.idp.provider="google" \
|
||||
--set authenticate.proxyRootDomains="pomerium.io" \
|
||||
--set authenticate.redirectUrl="https://auth.corp.pomerium.io/oauth2/callback" \
|
||||
--set authenticate.idp.clientID="REPLACE_ME" \
|
||||
--set authenticate.idp.clientSecret="REPLACE_ME" \
|
||||
--set proxy.authenticateServiceUrl="https://auth.corp.pomerium.io" \
|
||||
--set proxy.authorizeServiceUrl="https://access.corp.pomerium.io"
|
||||
|
||||
# When done, clean up by deleting the cluster!
|
||||
#
|
||||
# helm del $(helm ls --all --short) --purge #!!! DELETES ALL YOUR HELM INSTANCES!
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
#!/bin/bash
|
||||
# PRE-REQ: Install Helm : You should verify the content of this script before running.
|
||||
# curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash
|
||||
# NOTE! This will create real resources on Google's cloud. Make sure you clean up any unused
|
||||
# resources to avoid being billed. For reference, this tutorial cost me <10 cents for a couple of hours.
|
||||
# NOTE! You must change the identity provider client secret setting, and service account setting!
|
||||
# NOTE! If you are using gsuite, you should also set `authenticate.idp.serviceAccount`, see docs !
|
||||
|
||||
echo "=> [GCE] creating cluster"
|
||||
gcloud container clusters create pomerium --region us-west2 --num-nodes 1
|
||||
|
||||
echo "=> [GCE] get cluster credentials so we can use kubctl locally"
|
||||
gcloud container clusters get-credentials pomerium --region us-west2
|
||||
|
||||
echo "=> add pomerium's helm repo"
|
||||
helm repo add pomerium https://helm.pomerium.io
|
||||
|
||||
echo "=> add bitnami's helm repo"
|
||||
helm repo add bitnami https://charts.bitnami.com/bitnami
|
||||
|
||||
echo "=> install nginx as a sample hello world app"
|
||||
helm upgrade --install nginx bitnami/nginx --set service.type=ClusterIP
|
||||
|
||||
echo "=> update helm"
|
||||
helm repo update
|
||||
|
||||
echo "=> install pomerium with helm"
|
||||
helm install \
|
||||
pomerium \
|
||||
pomerium/pomerium \
|
||||
--set service.type="NodePort" \
|
||||
--set config.sharedSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set config.cookieSecret=$(head -c32 /dev/urandom | base64) \
|
||||
--set ingress.secret.name="pomerium-tls" \
|
||||
--set ingress.secret.cert=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer") \
|
||||
--set ingress.secret.key=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key") \
|
||||
--values docs/configuration/examples/kubernetes/values.yaml
|
||||
|
||||
# When done, clean up by deleting the cluster!
|
||||
# helm del $(helm ls --all --short) --purge # deletes all your helm instances
|
||||
# gcloud container clusters delete pomerium # deletes your cluster
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: internal-gateway
|
||||
namespace: istio-system
|
||||
spec:
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- port:
|
||||
number: 443
|
||||
protocol: HTTPS
|
||||
name: https-default
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
serverCertificate: "sds"
|
||||
privateKey: "sds"
|
||||
credentialName: internal-cert
|
||||
hosts:
|
||||
- *.yourcompany.com
|
||||
---
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: internal-cert
|
||||
namespace: istio-system
|
||||
spec:
|
||||
secretName: internal-cert
|
||||
issuerRef:
|
||||
name: self-signed-issuer
|
||||
kind: ClusterIssuer
|
||||
commonName: *.yourcompany.com
|
||||
dnsNames:
|
||||
- *.yourcompany.com
|
||||
---
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: self-signed-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
grafana.ini:
|
||||
users:
|
||||
allow_sign_up: false
|
||||
auto_assign_org: true
|
||||
auto_assign_org_role: Editor
|
||||
auth.proxy:
|
||||
enabled: true
|
||||
header_name: X-Pomerium-Claim-Email
|
||||
header_property: username
|
||||
auto_sign_up: true
|
||||
sync_ttl: 60
|
||||
enable_login_token: false
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
config:
|
||||
insecure: true
|
||||
policy:
|
||||
- from: https://grafana.yourcompany.com
|
||||
to: "http://prometheus-grafana.monitoring.svc.cluster.local"
|
||||
timeout: 30s
|
||||
allowed_domains:
|
||||
- yourcompany.com
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
extraEnv:
|
||||
JWT_CLAIMS_HEADERS: email
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: ServiceEntry
|
||||
metadata:
|
||||
name: external-idp
|
||||
namespace: pomerium
|
||||
spec:
|
||||
hosts:
|
||||
- yourcompany.okta.com
|
||||
location: MESH_EXTERNAL
|
||||
ports:
|
||||
- number: 443
|
||||
name: https
|
||||
protocol: TLS
|
||||
resolution: DNS
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: grafana-virtual-service
|
||||
namespace: pomerium
|
||||
spec:
|
||||
gateways:
|
||||
- istio-system/internal-gateway
|
||||
hosts:
|
||||
- grafana.yourcompany.com
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: pomerium-proxy
|
||||
---
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: authenticate-virtual-service
|
||||
namespace: pomerium
|
||||
spec:
|
||||
gateways:
|
||||
- istio-system/internal-gateway
|
||||
hosts:
|
||||
- authenticate.yourcompany.com
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: pomerium-authenticate
|
||||
---
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
authenticate:
|
||||
idp:
|
||||
provider: "google"
|
||||
clientID: YOUR_CLIENT_ID
|
||||
clientSecret: YOUR_SECRET
|
||||
service:
|
||||
annotations:
|
||||
cloud.google.com/app-protocols: '{"https":"HTTPS"}'
|
||||
|
||||
proxy:
|
||||
service:
|
||||
annotations:
|
||||
cloud.google.com/app-protocols: '{"https":"HTTPS"}'
|
||||
|
||||
service:
|
||||
type: NodePort
|
||||
|
||||
config:
|
||||
rootDomain: corp.beyondperimeter.com
|
||||
policy:
|
||||
- from: https://hello.corp.beyondperimeter.com
|
||||
to: http://nginx.default.svc.cluster.local:80
|
||||
allowed_domains:
|
||||
- gmail.com
|
||||
|
||||
ingress:
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: false
|
||||
|
|
@ -80,7 +80,7 @@ Enabling the debug flag will result in sensitive information being logged!!!
|
|||
|
||||
:::
|
||||
|
||||
By default, JSON encoded logs are produced. Debug enables colored, human-readable logs to be streamed to [standard out](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)>>>). In production, it's recommended to be set to `false`.
|
||||
By default, JSON encoded logs are produced. Debug enables colored, human-readable logs to be streamed to [standard out](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)>). In production, it's recommended to be set to `false`.
|
||||
|
||||
For example, if `true`
|
||||
|
||||
|
|
@ -127,77 +127,23 @@ Pomerium should _never_ be exposed to the internet without TLS encryption.
|
|||
|
||||
:::
|
||||
|
||||
### Autocert
|
||||
### Certificate
|
||||
|
||||
- Environmental Variable: `AUTOCERT`
|
||||
- Config File Key: `autocert`
|
||||
- Type: `bool`
|
||||
- Optional
|
||||
- Environmental Variable: either `CERTIFICATE` or `CERTIFICATE_FILE`
|
||||
- Config File Key: `certificate` or `certificate_file`
|
||||
- Type: [base64 encoded] `string` or relative file location
|
||||
- Required
|
||||
|
||||
Turning on autocert allows Pomerium to automatically retrieve, manage, and renew public facing TLS certificates from [Let's Encrypt][letsencrypt] for each of your managed pomerium routes as well as for the authenticate service. This setting must be used in conjunction with [Autocert Directory](./#autocert-directory) as Autocert must have a place to persist, and share certificate data between services. Provides [OCSP stapling](https://en.wikipedia.org/wiki/OCSP_stapling).
|
||||
Certificate is the x509 _public-key_ used to establish secure HTTP and gRPC connections.
|
||||
|
||||
This setting can be useful in a situation where you do not have Pomerium behind a TLS terminating ingress or proxy that is already handling your public certificates on your behalf.
|
||||
### Certificate Key
|
||||
|
||||
:::warning
|
||||
|
||||
By using autocert, you agree to the [Let's Encrypt Subscriber Agreement](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf). There are [_strict_ usage limits](https://letsencrypt.org/docs/rate-limits/) per domain you should be aware of. Consider testing with `autocert_use_staging` first.
|
||||
|
||||
:::
|
||||
|
||||
:::warning
|
||||
|
||||
Autocert requires that ports `80`/`443` be accessible from the internet in order to complete a [TLS-ALPN-01 challenge](https://letsencrypt.org/docs/challenge-types/#tls-alpn-01).
|
||||
|
||||
:::
|
||||
|
||||
### Autocert Directory
|
||||
|
||||
- Environmental Variable: either `AUTOCERT_DIR`
|
||||
- Config File Key: `autocert_dir`
|
||||
- Type: `string` pointing to the path of the directory
|
||||
- Required if using [Autocert](./#autocert) setting
|
||||
- Default:
|
||||
|
||||
- `/data/autocert` in published Pomerium docker images
|
||||
- [$XDG_DATA_HOME](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html)
|
||||
- `$HOME/.local/share/pomerium`
|
||||
|
||||
Autocert directory is path in which autocert will store x509 certificate data.
|
||||
|
||||
### Autocert Use Staging
|
||||
|
||||
- Environmental Variable: `AUTOCERT_USE_STAGING`
|
||||
- Config File Key: `autocert_use_staging`
|
||||
- Type: `bool`
|
||||
- Optional
|
||||
|
||||
Let's Encrypt has strict [usage limits](https://letsencrypt.org/docs/rate-limits/). Enabling this setting allows you to use Let's Encrypt's [staging environment](https://letsencrypt.org/docs/staging-environment/) which has much more lax usage limits.
|
||||
|
||||
### Certificates
|
||||
|
||||
- Config File Key: `certificates` (not yet settable using environmental variables)
|
||||
- Config File Key: `certificate` / `certificate_key`
|
||||
- Config File Key: `certificate_file` / `certificate_key_file`
|
||||
- Environmental Variable: `CERTIFICATE` / `CERTIFICATE_KEY`
|
||||
- Environmental Variable: `CERTIFICATE_FILE` / `CERTIFICATE_KEY_FILE`
|
||||
- Type: array of relative file locations `string`
|
||||
- Environmental Variable: either `CERTIFICATE_KEY` or `CERTIFICATE_KEY_FILE`
|
||||
- Config File Key: `certificate_key` or `certificate_key_file`
|
||||
- Type: [base64 encoded] `string`
|
||||
- Type: certificate relative file location `string`
|
||||
- Required (if insecure not set)
|
||||
- Required
|
||||
|
||||
Certificates are the x509 _public-key_ and _private-key_ used to establish secure HTTP and gRPC connections. Any combination of the above can be used together, and are additive. Use in conjunction with `Autocert` to get OCSP stapling.
|
||||
|
||||
For example, if specifying multiple certificates at once:
|
||||
|
||||
```yaml
|
||||
certificates:
|
||||
- cert: "$HOME/.acme.sh/authenticate.example.com_ecc/fullchain.cer"
|
||||
key: "$HOME/.acme.sh/authenticate.example.com_ecc/authenticate.example.com.key"
|
||||
- cert: "$HOME/.acme.sh/httpbin.example.com_ecc/fullchain.cer"
|
||||
key: "$HOME/.acme.sh/httpbin.example.com_ecc/httpbin.example.com.key"
|
||||
- cert: "$HOME/.acme.sh/prometheus.example.com_ecc/fullchain.cer"
|
||||
key: "$HOME/.acme.sh/prometheus.example.com_ecc/prometheus.example.com.key"
|
||||
```
|
||||
Certificate key is the x509 _private-key_ used to establish secure HTTP and gRPC connections.
|
||||
|
||||
### Global Timeouts
|
||||
|
||||
|
|
@ -967,7 +913,7 @@ Note: This setting will replace (not append) the system's trust store for a give
|
|||
- Type: [base64 encoded] `string` or relative file location
|
||||
- Optional
|
||||
|
||||
Pomerium supports client certificates which can be used to enforce [mutually authenticated and encrypted TLS connections](https://en.wikipedia.org/wiki/Mutual_authentication) (mTLS). For more details, see our [mTLS example repository](https://github.com/pomerium/examples/tree/master/mutual-tls) and the [certificate docs](../docs/reference/certificates.md).
|
||||
Pomerium supports client certificates which can be used to enforce [mutually authenticated and encrypted TLS connections](https://en.wikipedia.org/wiki/Mutual_authentication) (mTLS). For more details, see our [mTLS example repository](https://github.com/pomerium/examples/tree/master/mutual-tls) and the [certificate docs](./certificates.md).
|
||||
|
||||
### Set Request Headers
|
||||
|
||||
|
|
@ -1009,17 +955,16 @@ See [ProxyPreserveHost](http://httpd.apache.org/docs/2.0/mod/mod_proxy.html#prox
|
|||
- Type: [base64 encoded] `string`
|
||||
- Optional
|
||||
|
||||
Signing key is the base64 encoded key used to sign outbound requests. For more information see the [signed headers] docs.
|
||||
Signing key is the base64 encoded key used to sign outbound requests. For more information see the [signed headers](./signed-headers.md) docs.
|
||||
|
||||
If no certificate is specified, one will be generated for you and the base64'd public key will be added to the logs.
|
||||
|
||||
[base64 encoded]: https://en.wikipedia.org/wiki/Base64
|
||||
[environmental variables]: https://en.wikipedia.org/wiki/Environment_variable
|
||||
[identity provider]: ../docs/identity-providers/
|
||||
[identity provider]: ./identity-providers.md
|
||||
[json]: https://en.wikipedia.org/wiki/JSON
|
||||
[letsencrypt]: https://letsencrypt.org/
|
||||
[oidc rfc]: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
|
||||
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|
||||
[signed headers]: ./signed-headers.md
|
||||
[toml]: https://en.wikipedia.org/wiki/TOML
|
||||
[yaml]: https://en.wikipedia.org/wiki/YAML
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue