mirror of https://github.com/pomerium/pomerium.git synced 2025-05-02 11:56:02 +02:00

* authorize: authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details.
 * docs: updated `env.example` to include a `POLICY` setting example.
 * docs:  added `IDP_SERVICE_ACCOUNT` to  `env.example` .
 * docs: removed `PROXY_ROOT_DOMAIN` settings which has been replaced by `POLICY`.
 * all: removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files.
 * proxy: `ROUTES` settings which has been replaced by `POLICY`.
* internal/log: `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one.

Closes #54
Closes #41
Closes #61
Closes #58

2019-03-07 12:47:07 -08:00

2 KiB

Raw Blame History

Docker

Docker and docker-compose are tools for defining and running multi-container Docker applications. We've created an example docker-compose file that creates a minimal, but complete test environment for pomerium.

Prerequisites

A configured identity provider
Install docker
Install docker-compose

Download

Copy and paste the contents of the provided example basic.docker-compose.yml.

Configure

Docker-compose

Edit the docker-compose.yml to match your specific identity provider's settings. For example, basic.docker-compose.yml:

<<< @/docs/docs/examples/docker/basic.docker-compose.yml

Policy configuration

Next, create a policy configuration file which will contain the routes you want to proxy, and their desired access-controls. For example, policy.example.yaml:

<<< @/policy.example.yaml

Certificates

Place your domain's wild-card TLS certificate next to the compose file. If you don't have one handy, the included script generates one from LetsEncrypt.

Run

Docker-compose will automatically download the latest pomerium release as well as two example containers.

docker-compose up

Pomerium is configured to delegate access to two test apps helloworld and httpbin.

Navigate

Open a browser and navigate to hello.your.domain.com or httpbin.your.domain.com. You should see something like the following in your browser.

And in your terminal.

2 KiB Raw Blame History