| <div role="region"><a href="#" class="skipToContent_fXgn">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/logo.svg" alt="apache devlake" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/logo.svg" alt="apache devlake" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate">Apache DevLake</b></a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">Docs</a><ul class="dropdown__menu"><li><a class="dropdown__link" href="/docs/Overview/Introduction">Next</a></li><li><a class="dropdown__link" href="/docs/v1.0/Overview/Introduction">v1.0 (Stable)</a></li><li><a class="dropdown__link" href="/docs/v0.21/Overview/Introduction">v0.21</a></li><li><a class="dropdown__link" href="/docs/v0.20/Overview/Introduction">v0.20</a></li><li><a class="dropdown__link" href="/docs/v0.19/Overview/Introduction">v0.19</a></li><li><a class="dropdown__link" href="/docs/v0.18/Overview/Introduction">v0.18</a></li><li><a class="dropdown__link" href="/docs/v0.17/Overview/Introduction">v0.17</a></li><li><a class="dropdown__link" href="/docs/v0.16/Overview/Introduction">v0.16</a></li><li><a class="dropdown__link" href="/docs/v0.15/Overview/Introduction">v0.15</a></li></ul></div><a class="navbar__item navbar__link" href="/livedemo/EngineeringLeads/DORA">Use Cases</a><a class="navbar__item navbar__link" href="/community/">Community</a><a class="navbar__item navbar__link" href="/team">Team</a><a class="navbar__item navbar__link" href="/blogOverview">Blog</a><a href="https://github.com/apache/devlake" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><a class="navbar__item navbar__link" href="/download">Download</a><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">ASF</a><ul class="dropdown__menu"><li><a href="https://www.apache.org/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Foundation</a></li><li><a href="https://www.apache.org/licenses/" target="_blank" rel="noopener noreferrer" class="dropdown__link">License</a></li><li><a href="https://www.apache.org/events/current-event" target="_blank" rel="noopener noreferrer" class="dropdown__link">Events</a></li><li><a href="https://www.apache.org/security/" target="_blank" rel="noopener noreferrer" class="dropdown__link">Security</a></li><li><a href="https://privacy.apache.org/policies/privacy-policy-public.html" target="_blank" rel="noopener noreferrer" class="dropdown__link">Privacy</a></li><li><a href="https://www.apache.org/foundation/sponsorship.html" target="_blank" rel="noopener noreferrer" class="dropdown__link">Sponsorship</a></li><li><a href="https://www.apache.org/foundation/thanks.html" target="_blank" rel="noopener noreferrer" class="dropdown__link">Thanks</a></li></ul></div><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type="button" disabled="" title="Switch between dark and light mode (currently light mode)" aria-label="Switch between dark and light mode (currently light mode)"><svg viewBox="0 0 24 24" width="24" height="24" class="lightToggleIcon_pyhR"><path fill="currentColor" d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" class="darkToggleIcon_wfgR"><path fill="currentColor" d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"></path></svg></button></div><div class="searchBox_ZlJk"><div class="navbar__search searchBarContainer_NW3z"><input placeholder="Search" aria-label="Search" class="navbar__search-input"><div class="loadingRing_RJI3 searchBarLoadingRing_YnHq"><div></div><div></div><div></div><div></div></div></div></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/Overview">Overview</a><button aria-label="Toggle the collapsible sidebar category 'Overview'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" href="/docs/GettingStarted">Getting Started</a><button aria-label="Toggle the collapsible sidebar category 'Getting Started'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/GettingStarted/QuickStart">Quick Start</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/GettingStarted/DockerComposeSetup">Install via Docker Compose</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/GettingStarted/HelmSetup">Install via Helm</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/GettingStarted/Upgrade">Upgrade</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/docs/GettingStarted/Authentication">Security and Authentication</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/GettingStarted/Environment">Environment Variables</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/Config UI">Config UI</a><button aria-label="Toggle the collapsible sidebar category 'Config UI'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/docs/DORA">DORA</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/Metrics">Metrics</a><button aria-label="Toggle the collapsible sidebar category 'Metrics'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/DataModels">Data Models</a><button aria-label="Toggle the collapsible sidebar category 'Data Models'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/DeveloperManuals">Developer Manuals</a><button aria-label="Toggle the collapsible sidebar category 'Developer Manuals'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/Plugins">Plugins</a><button aria-label="Toggle the collapsible sidebar category 'Plugins'" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/docs/Troubleshooting">Troubleshooting</a><button aria-label="Toggle the collapsible sidebar category 'Troubleshooting'" type="button" class="clean-btn menu__caret"></button></div></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/docs/GettingStarted"><span itemprop="name">Getting Started</span></a><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Security and Authentication</span><meta itemprop="position" content="2"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: Next</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Security and Authentication</h1></header><p>The document explains how you can set up Apache DevLake securely. </p><p>First of all, there are 4 services included in the deployment:</p><ul><li>database: <code>mysql</code> is supported, you may use it or any other compatible DBS like cloud-based systems. You should follow the document from the database to make it secure.</li><li>grafana: You are likely to use it most of the time, browsing built-in dashboards, and creating your own customized metric. grafana supports <a href="https://grafana.com/docs/grafana/latest/administration/user-management/" target="_blank" rel="noopener noreferrer">User Management</a>, please follow the official document to set it up based on your need.</li><li>devlake: This is the core service for Data Collection and Metric Calculation, all collected/calculated data would be stored to the database, and accessed by the <code>grafana</code> service. <code>devlake</code> itself doesn't support User Management of any kind, so we don't recommend that you expose its port to the outside world.</li><li>config-ui: A web interface to set up <code>devlake</code> to do the work. You may set up an automated <code>blueprint</code> to collect data. <code>config-ui</code> supports <code>Basic Authentication</code>, by simply set up the Environment Variable <code>ADMIN_USER</code> and <code>ADMIN_PASS</code> for the container. There are commented lines in <code>config-ui.environment</code> section in our <code>docker-compose.yml</code> file for your convenience. |
| In General, we suggest that you reduce the Attack Surface as small as possible.</li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="internal-deployment-recommended">Internal Deployment (Recommended)<a class="hash-link" href="#internal-deployment-recommended" title="Direct link to heading"></a></h3><ul><li>database: Remove the <code>ports</code> if you don't need to access the database directly</li><li>devlake: Remove the <code>ports</code> section. If you want to call the API directly, do it via <code>config-ui/api</code> endpoint.</li><li>grafana: We have no choice but to expose the <code>ports</code> for people to browse the dashboards. However, you may want to set up the User Management, and a read-only database account for <code>grafana</code></li><li>config-ui: Normally, exposing the <code>ports</code> with <code>Basic Authentication</code> is sufficient for Internal Deployment, you may choose to remove the <code>ports</code> and use techniques like <code>k8s port-forwarding</code> or <code>expose-port-when-needed</code> to enhance the security. Keep in mind config-ui is NOT designed to be used by many people, and it shouldn't be. Do NOT grant access if NOT necessary.</li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="internet-deployment-not-recommended">Internet Deployment (NOT Recommended)<a class="hash-link" href="#internet-deployment-not-recommended" title="Direct link to heading"></a></h3><p>THIS IS DANGEROUS, DON'T DO IT. If you insist, here are some suggestions you may follow, please consult Security Advisor before everything:</p><ul><li>database: Same as above.</li><li>grafana: Same as above. In addition, set up the <code>HTTPS</code> for the transportation.</li><li>devlake: Same as above.</li><li>config-ui: Same as above. In addition, use port-forward if you are using <code>k8s</code>, otherwise, set up <code>HTTPS</code> for the transportation.</li></ul><h2 class="anchor anchorWithStickyNavbar_LWe7" id="disclaimer">Disclaimer<a class="hash-link" href="#disclaimer" title="Direct link to heading"></a></h2><p>Security is complicated, all suggestions listed above are based on what we learned so far. Apache Devlake makes no guarantee of any kind, please consult your Security Advisor before applying.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="troubleshooting">Troubleshooting<a class="hash-link" href="#troubleshooting" title="Direct link to heading"></a></h2><p>If you run into any problem, please check the <a href="/docs/Troubleshooting/Installation">Troubleshooting</a> or <a href="https://github.com/apache/incubator-devlake/issues" target="_blank" rel="noopener noreferrer">create an issue</a></p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/apache/devlake-website/edit/main/docs/GettingStarted/Authentication.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/docs/GettingStarted/Upgrade"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Upgrade</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/docs/GettingStarted/Environment"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Environment Variables</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#internal-deployment-recommended" class="table-of-contents__link toc-highlight">Internal Deployment (Recommended)</a></li><li><a href="#internet-deployment-not-recommended" class="table-of-contents__link toc-highlight">Internet Deployment (NOT Recommended)</a></li><li><a href="#disclaimer" class="table-of-contents__link toc-highlight">Disclaimer</a></li><li><a href="#troubleshooting" class="table-of-contents__link toc-highlight">Troubleshooting</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="row footer__links"><div class="col footer__col"><div class="footer__title">Docs</div><ul class="footer__items clean-list"><li class="footer__item"><a class="footer__link-item" href="/docs/GettingStarted">Getting Started</a></li><li class="footer__item"><a class="footer__link-item" href="/docs/DataModels/DevLakeDomainLayerSchema">Data Models</a></li><li class="footer__item"><a class="footer__link-item" href="/docs/Metrics">Engineering Metrics</a></li></ul></div><div class="col footer__col"><div class="footer__title">Community</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://join.slack.com/t/devlake-io/shared_invite/zt-1lkgbdmys-AU2azidzO1u~mtjlg9my7A" target="_blank" rel="noopener noreferrer" class="footer__link-item">Slack</a></li><li class="footer__item"><a href="https://github.com/apache/incubator-devlake/issues" target="_blank" rel="noopener noreferrer" class="footer__link-item">GitHub Issue Tracker</a></li><li class="footer__item"><a href="https://github.com/apache/devlake-website/issues" target="_blank" rel="noopener noreferrer" class="footer__link-item">GitHub Issue Tracker For Docs</a></li></ul></div><div class="col footer__col"><div class="footer__title">More</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://github.com/apache/devlake" target="_blank" rel="noopener noreferrer" class="footer__link-item">GitHub</a></li><li class="footer__item"><a href="https://twitter.com/ApacheDevLake" target="_blank" rel="noopener noreferrer" class="footer__link-item">Twitter</a></li><li class="footer__item"><a class="footer__link-item" href="/community/trademark">Trademark Guidelines</a></li></ul></div></div><div class="footer__bottom text--center"><div class="footer__copyright"> |
