Skip to content

Commit

Permalink
Remove Bearer monitoring content (#221)
Browse files Browse the repository at this point in the history
  • Loading branch information
markmichon authored Apr 19, 2021
1 parent 74d4719 commit dc53d01
Show file tree
Hide file tree
Showing 5 changed files with 5 additions and 104 deletions.
22 changes: 2 additions & 20 deletions docs/securing-your-instance.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
By default, your Pizzly's instance does not require an authentication method to access its data. It's great for local development but not recommended if you plan to use it with production data.
By default, your Pizzly instance does not require an authentication method to access its data. It's great for local development but not recommended if you plan to use it with production data.

In this guide, you will learn how to secure your Pizzly instance.

Expand Down Expand Up @@ -87,29 +87,11 @@ If you have SSH access to your server, you can use a configuration file.

## Extra options

### Enable Bearer

Bearer.sh provides an agent that can monitor and shield your Pizzly instance from API failures. For example, the agent will automatically retry a request that fails due to a network issue. You can create your own rules and be alerted when something goes wrong by email and more.

To enable Bearer, follow these steps:

1. [Create an account on Bearer.sh](https://www.bearer.sh/), it's free.
2. Retrieve your secret key [here](https://app.bearer.sh/settings/key).
3. Update the following environment variable:

```bash
BEARER_SECRET_KEY="..."
```

4. Restart or redeploy your instance. On most PaaS (e.g. Heroku), the instance is automatically restarted when you update an environment variables.

Each API request will be logged in your Bearer's dashboard, with monitoring, graphs and more. Please note that some features require a paid account.

### Disallow frontend requests to the proxy service

Pizzly's proxy accepts requests having a valid `publishableKey`. This means that someone that knows your `publishableKey` can query an API using your Pizzly's instance.

As the key is publicly available on your frontend, this might feel unsecure, but remind that the `publishableKey` is used only to authenticate the request with Pizzly. An attacker would need both a valid `publishableKey` and a valid `authId` to make request to a third-party API.
As the key is publicly available on your frontend, this might feel insecure, but remind that the `publishableKey` is used only to authenticate the request with Pizzly. An attacker would need both a valid `publishableKey` and a valid `authId` to make request to a third-party API.

Still, if you aren't feeling safe to accept frontend requests, you can easily refuse them.

Expand Down
8 changes: 0 additions & 8 deletions src/routes/dashboard.ts
Original file line number Diff line number Diff line change
Expand Up @@ -361,14 +361,6 @@ dashboard.get('/:integration/request', (req, res) => {
res.render('dashboard/api-request', { req })
})

/**
* Integration > Monitoring
*/

dashboard.get('/:integration/monitoring', (req, res) => {
res.render('dashboard/api-monitoring', { req })
})

/**
* Helpers
*/
Expand Down
31 changes: 0 additions & 31 deletions views/dashboard/api-monitoring.ejs

This file was deleted.

3 changes: 0 additions & 3 deletions views/dashboard/layout-header-api.ejs
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@
<li class="<%= active === 'request' ? 'active' : '' %>">
<a href="<%= base %>/request">Request</a>
</li>
<li class="<%= active === 'monitoring' ? 'active' : '' %>">
<a href="<%= base %>/monitoring">Monitoring</a>
</li>
</ol>
</nav>
</div>
Expand Down
45 changes: 3 additions & 42 deletions views/dashboard/settings-keys.ejs
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,9 @@
<header>
<h2 class="section-heading">Restrict access</h2>
<aside>
<a href="https://github.com/Bearer/Pizzly/blob/master/docs/securing-your-instance.md" class="button button-primary"
<a
href="https://github.com/Bearer/Pizzly/blob/master/docs/securing-your-instance.md"
class="button button-primary"
>Learn more about securing Pizzly →</a
>
</aside>
Expand Down Expand Up @@ -53,47 +55,6 @@
</table>
</div>
</section>

<section>
<h2 class="section-heading">Enable monitoring</h2>

<div class="table">
<table>
<thead>
<tr>
<th>Name</th>
<th>Value</th>
<th>Services concerned</th>
</tr>
</thead>
<tbody>
<% req.data.keys.forEach(function(key){ if (key.name !== "BEARER_SECRET_KEY") {return; } %>
<tr>
<td>
<div style="display: flex;">
<span style="margin-right: 8px;"><%= key.name %></span>
<a
href="https://github.com/Bearer/Pizzly/wiki/Secure-your-instance#<%= key.name %>"
data-icon="help"
title="Learn more"
>Learn more</a
>
</div>
</td>
<td class="col-ellipsis">
<% if (key.value) { %>
<span><%= (key.value || '').slice(0, 5) + '*'.repeat(15) %> </span>
<% } else { %>
<strong class="text-warning">Not set</strong>
</td>
<% } %>
<td><%= key.services.join(', ') %></td>
</tr>
<% }); %>
</tbody>
</table>
</div>
</section>
</main>

<!-- Footer -->
Expand Down

0 comments on commit dc53d01

Please # to comment.