dattasoumya92/cerbos-admin-studio repository overview

⁠Cerbos Admin Studio

A web-based administration interface for managing Cerbos 0.53+ policies. It provides guided policy editing, YAML validation, authentication, and a secure server-side gateway to the Cerbos Admin API.

⁠Features

• Manage resource, principal, and derived-role policies
• Guided forms and YAML-based policy editing
• Policy validation before submission
• Microsoft Entra ID and generic OpenID Connect authentication
• Optional email-domain and group-based access restrictions
• Hardened Next.js runtime running as a non-root user
• Browser traffic never connects directly to Cerbos

⁠Quick start

Create an environment file containing your authentication and Cerbos configuration, then run:

docker run --detach \
  --name cerbos-admin-studio \
  --publish 3000:3000 \
  --env-file .env \
  --restart unless-stopped \
  YOUR_DOCKERHUB_NAMESPACE/cerbos-admin-studio:latest

Open http://localhost:3000⁠.

⁠Required configuration

NEXTAUTH_URL=http://localhost:3000
NEXTAUTH_SECRET=replace-with-a-random-32-character-secret

CERBOS_BASE_URL=https://cerbos.example.com
CERBOS_ADMIN_USERNAME=cerbos
CERBOS_ADMIN_PASSWORD=change-me

Configure either Microsoft Entra ID:

AUTH_ENTRA_ID_CLIENT_ID=
AUTH_ENTRA_ID_CLIENT_SECRET=
AUTH_ENTRA_ID_TENANT_ID=

Or a generic OpenID Connect provider:

AUTH_OIDC_NAME=Corporate SSO
AUTH_OIDC_ISSUER=https://identity.example.com
AUTH_OIDC_CLIENT_ID=
AUTH_OIDC_CLIENT_SECRET=

Optional settings:

AUTH_ALLOWED_EMAIL_DOMAINS=example.com
AUTH_ALLOWED_GROUPS=
CERBOS_REQUEST_TIMEOUT_MS=15000
CERBOS_ALLOW_INSECURE_HTTP=false

Set CERBOS_ALLOW_INSECURE_HTTP=true only for trusted development environments using an HTTP Cerbos endpoint.

⁠Requirements

• Cerbos 0.53 or newer
• Cerbos Admin API enabled and reachable from the container
• Microsoft Entra ID or an OpenID Connect identity provider

The image exposes port 3000 and includes a health check against /signin.