mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-04 04:46:01 +02:00
c13459bb88
* authorize: authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details. * docs: updated `env.example` to include a `POLICY` setting example. * docs: added `IDP_SERVICE_ACCOUNT` to `env.example` . * docs: removed `PROXY_ROOT_DOMAIN` settings which has been replaced by `POLICY`. * all: removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files. * proxy: `ROUTES` settings which has been replaced by `POLICY`. * internal/log: `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one. Closes #54 Closes #41 Closes #61 Closes #58
60 lines
2 KiB
Markdown
60 lines
2 KiB
Markdown
# Docker
|
|
|
|
Docker and docker-compose are tools for defining and running multi-container Docker applications. We've created an example docker-compose file that creates a minimal, but complete test environment for pomerium.
|
|
|
|
## Prerequisites
|
|
|
|
- A configured [identity provider]
|
|
- Install [docker]
|
|
- Install [docker-compose]
|
|
|
|
## Download
|
|
|
|
Copy and paste the contents of the provided example [basic.docker-compose.yml].
|
|
|
|
## Configure
|
|
|
|
### Docker-compose
|
|
|
|
Edit the `docker-compose.yml` to match your specific [identity provider]'s settings. For example, `basic.docker-compose.yml`:
|
|
|
|
<<< @/docs/docs/examples/docker/basic.docker-compose.yml
|
|
|
|
### Policy configuration
|
|
|
|
Next, create a policy configuration file which will contain the routes you want to proxy, and their desired access-controls. For example, `policy.example.yaml`:
|
|
|
|
<<< @/policy.example.yaml
|
|
|
|
### Certificates
|
|
|
|
Place your domain's wild-card TLS certificate next to the compose file. If you don't have one handy, the included [script] generates one from [LetsEncrypt].
|
|
|
|
## Run
|
|
|
|
Docker-compose will automatically download the latest pomerium release as well as two example containers.
|
|
|
|
```bash
|
|
docker-compose up
|
|
```
|
|
|
|
Pomerium is configured to delegate access to two test apps [helloworld] and [httpbin].
|
|
|
|
## Navigate
|
|
|
|
Open a browser and navigate to `hello.your.domain.com` or `httpbin.your.domain.com`. You should see something like the following in your browser.
|
|
|
|
|
|
|
|
And in your terminal.
|
|
|
|
[](https://asciinema.org/a/tfbSWkUZgMRxHAQDqmcjjNwUg)
|
|
|
|
[basic.docker-compose.yml]: ../docs/examples.html#basic-docker-compose-yml
|
|
[docker]: https://docs.docker.com/install/
|
|
[docker-compose]: https://docs.docker.com/compose/install/
|
|
[helloworld]: https://hub.docker.com/r/tutum/hello-world
|
|
[httpbin]: https://httpbin.org/
|
|
[identity provider]: ../docs/identity-providers.md
|
|
[letsencrypt]: https://letsencrypt.org/
|
|
[script]: https://github.com/pomerium/pomerium/blob/master/scripts/generate_wildcard_cert.sh
|