Security
========

Typically, internal DevOps tools like Graphite are deployed in intranet without any external access,
so you can skip authentication and leave everything accessible to everyone. But powerful Moira
features, like separate subscriptions for tags, work best when you have some way to tell apart users.

Moira doesn't provide any authentication mechanism. It is hard to find one that fits all situations.
Instead, Moira accepts ``X-WebAuth-User`` header with some user id, like login name. You are free to
set up any reverse proxy and configure it to provide this header.

If you don't, Moira will assume that user id is "anonymous".

.. warning:: Even if you do provide authentication header, please note that most parts of Moira are
             read and write accessible to every user, and there is no meaningful way of authorization
             in Moira. This is by design, because Moira is an internal DevOps tool. Separating users
             is a convenience, not protection feature.

Security
========

Typically, internal DevOps tools like Graphite are deployed in intranet without any external access,
so you can skip authentication and leave everything accessible to everyone. But powerful Moira
features, like separate subscriptions for tags, work best when you have some way to tell apart users.

Moira doesn't provide any authentication mechanism. It is hard to find one that fits all situations.
Instead, Moira accepts ``X-WebAuth-User`` header with some user id, like login name. You are free to
set up any reverse proxy and configure it to provide this header.

If you don't, Moira will assume that user id is "anonymous".

.. warning:: Even if you do provide authentication header, please note that most parts of Moira are
             read and write accessible to every user, and there is no meaningful way of authorization
             in Moira. This is by design, because Moira is an internal DevOps tool. Separating users
             is a convenience, not protection feature.


Simple Nginx configuration
^^^^^^^^^^^^^^^^^^^^^^^^^^

Assuming that Moira UI static files are in ``/var/www/moira-web`` and API is running on port 8081, here is an example
of Nginx configuration:

.. code-block:: text

   server {
     listen 127.0.0.1:8888 default_server;
     location / {
       root /var/www/moira-web;
       index index.html;
     }
     location /api/ {
       proxy_pass http://127.0.0.1:8081;
     }
   }

   server {
     listen 0.0.0.0:80 default_server;
     location / {
       auth_basic "Moira";
       auth_basic_user_file /etc/nginx/htpasswd;
       proxy_set_header X-WebAuth-User $remote_user;
       proxy_pass http://127.0.0.1:8888;
     }
   }

Add sample Nginx Basic Auth config
Add sample Nginx Basic Auth config
