Port of Pomerium

Cible

80

Défaut

8801

Debug enables colored, human-readable logs to be streamed to standard out (opens new window). In production, it is recommended to be set to false.

Cible

POMERIUM_DEBUG

Défaut

false

Valeur

false

Address specifies the host and port to serve HTTP requests from.

Cible

ADDRESS

Défaut

:80

Valeur

:80

Turning on insecure server mode will result in pomerium starting, and operating without any protocol encryption in transit. This setting can be useful in a situation where you have Pomerium behind a TLS terminating ingress or proxy. However, even in that case, it is highly recommended to use TLS to protect the confidentiality and integrity of service communication even behind the ingress using self-signed certificates or an internal CA. Please see our helm-chart for an example of just that.

Cible

INSECURE_SERVER

Défaut

true

Valeur

true

Forward authentication creates an endpoint that can be used with third-party proxies that do not have rich access control capabilities. Forward authentication allows you to delegate authentication and authorization for each request to Pomerium.

Cible

FORWARD_AUTH_URL

Défaut

http://fwdauth.domain.duckdns.org

Valeur

http://fwdauth.[domain].duckdns.org

Authenticate Service URL is the externally accessible URL for the authenticate service.

Cible

AUTHENTICATE_SERVICE_URL

Défaut

https://authenticate.domain.duckdns.org

Valeur

https://authenticate.[domain].duckdns.org

Secret used to encrypt and sign session cookies. You can generate a random key with head -c32 /dev/urandom | base64.

Cible

COOKIE_SECRET

Défaut

OWTV2fONR7expoexvhzYBnkdVtrwTh0XhJsQqFMzJuk=

Valeur

OWTV2fONR7expoexvhzYBnkdVtrwTh0XhJsQqFMzJuk=

Shared Secret is the base64 encoded 256-bit key used to mutually authenticate requests between services. It's critical that secret keys are random, and stored safely. Use a key management system or /dev/urandom to generate a key. Example head -c32 /dev/urandom | base64

Cible

SHARED_SECRET

Défaut

wB/J+7Fgc+XdCufhjnn/LVZhxjGmgsTaBr7VcjMBHTA=

Valeur

wB/J+7Fgc+XdCufhjnn/LVZhxjGmgsTaBr7VcjMBHTA=

Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication. To use a generic provider,set to oidc.

Cible

IDP_PROVIDER

Défaut

google

Valeur

google

Client ID is the OAuth 2.0 Client Identifier retrieved from your identity provider. See your identity provider's documentation, and our identity provider docs for details.

Cible

IDP_CLIENT_ID

Client Secret is the OAuth 2.0 Secret Identifier retrieved from your identity provider. See your identity provider's documentation, and our identity provider docs for details.

Cible

IDP_CLIENT_SECRET

Pomerium config.yaml file. Mostly defines routes and authorizations but also anything else not available through this template

Cible

/pomerium/config.yaml

Défaut

/mnt/user/appdata/Pomerium/config.yaml