概述

Pomerium - Secure, identity-aware access from anywhere.

运行时参数

网络用户界面: http://[IP]:[PORT:80]
网络: bridge
特权: false

模板配置

Web UI PortPorttcp

Port of Pomerium

目标: 80
默认值: 8801

DebugVariable

Debug enables colored, human-readable logs to be streamed to standard out (opens new window). In production, it is recommended to be set to false.

目标: POMERIUM_DEBUG
默认值: false
价值: false

AddressVariable

Address specifies the host and port to serve HTTP requests from.

目标: ADDRESS
默认值: :80
价值: :80

InsecureVariable

Turning on insecure server mode will result in pomerium starting, and operating without any protocol encryption in transit. This setting can be useful in a situation where you have Pomerium behind a TLS terminating ingress or proxy. However, even in that case, it is highly recommended to use TLS to protect the confidentiality and integrity of service communication even behind the ingress using self-signed certificates or an internal CA. Please see our helm-chart for an example of just that.

目标: INSECURE_SERVER
默认值: true
价值: true

Forward Auth URLVariable

Forward authentication creates an endpoint that can be used with third-party proxies that do not have rich access control capabilities. Forward authentication allows you to delegate authentication and authorization for each request to Pomerium.

目标: FORWARD_AUTH_URL
默认值: http://fwdauth.domain.duckdns.org
价值: http://fwdauth.[domain].duckdns.org

Authenticate Service URLVariable

Authenticate Service URL is the externally accessible URL for the authenticate service.

目标: AUTHENTICATE_SERVICE_URL
默认值: https://authenticate.domain.duckdns.org
价值: https://authenticate.[domain].duckdns.org

Cookie SecretVariable

Secret used to encrypt and sign session cookies. You can generate a random key with head -c32 /dev/urandom | base64.

目标: COOKIE_SECRET
默认值: OWTV2fONR7expoexvhzYBnkdVtrwTh0XhJsQqFMzJuk=
价值: OWTV2fONR7expoexvhzYBnkdVtrwTh0XhJsQqFMzJuk=

Shared SecretVariable

Shared Secret is the base64 encoded 256-bit key used to mutually authenticate requests between services. It's critical that secret keys are random, and stored safely. Use a key management system or /dev/urandom to generate a key. Example head -c32 /dev/urandom | base64

目标: SHARED_SECRET
默认值: wB/J+7Fgc+XdCufhjnn/LVZhxjGmgsTaBr7VcjMBHTA=
价值: wB/J+7Fgc+XdCufhjnn/LVZhxjGmgsTaBr7VcjMBHTA=

IDP ProviderVariable

Provider is the short-hand name of a built-in OpenID Connect (oidc) identity provider to be used for authentication. To use a generic provider,set to oidc.

目标: IDP_PROVIDER
默认值: google
价值: google

Google Client IdVariable

Client ID is the OAuth 2.0 Client Identifier retrieved from your identity provider. See your identity provider's documentation, and our identity provider docs for details.

目标: IDP_CLIENT_ID

Google Client SecretVariable

Client Secret is the OAuth 2.0 Secret Identifier retrieved from your identity provider. See your identity provider's documentation, and our identity provider docs for details.