Binaries

The following quick-start guide covers how to configure and run Pomerium using the official prebuilt binaries.

Prerequisites

Download

Download the latest release of Pomerium for your machine's operating system and architecture.

Configure

Pomerium supports setting configuration variables using both environmental variables and using a configuration file.

Configuration file

Create a config file (config.yaml). This file will be used to determine Pomerium's configuration settings, routes, and access-policies. Consider the following example:

# See detailed configuration settings : https://www.pomerium.io/docs/reference/reference/
authenticate_service_url: https://authenticate.corp.beyondperimeter.com

# identity provider settings : https://www.pomerium.io/docs/identity-providers.html
idp_provider: google
idp_client_id: REPLACE_ME
idp_client_secret: REPLACE_ME

policy:
  - from: https://httpbin.corp.beyondperimeter.com
    to: http://httpbin
    allowed_domains:
      - pomerium.io
  - from: https://external-httpbin.corp.beyondperimeter.com
    to: https://httpbin.org
    allow_public_unauthenticated_access: true

Environmental Variables

As mentioned above, Pomerium supports mixing and matching configuration. For example, we can specify our secret values and domains certificates as environmental configuration variables, and set the rest as part of the configuration file.

#!/bin/bash

# See : https://www.pomerium.io/docs/reference/certificates
export CERTIFICATE_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer"                      # optional, defaults to `./cert.pem`
export CERTIFICATE_KEY_FILE="$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key" # optional, defaults to `./certprivkey.pem`

# 256 bit random keys
export SHARED_SECRET="$(head -c32 /dev/urandom | base64)"
export COOKIE_SECRET="$(head -c32 /dev/urandom | base64)"

Run

Finally, source the the configuration env file and run pomerium specifying the config.yaml .

source ./env
./bin/pomerium -config config.yaml

Browse to external-httpbin.your.domain.example. Connections between you and httpbin will now be proxied and managed by Pomerium.

← Helm→