openlbac/lbac-server
Management API for OpenLBAC — label-based access control for Prometheus, Loki & Thanos.
Image
Security
0
680
openlbac/lbac-server repository overview
lbac-server
Management API for OpenLBAC. Stores datasources and per-group label-based access policies in Postgres and exposes a REST API for management.
Quick start
DATABASE_URL=postgres://openlbac:openlbac@localhost/openlbac \
[email protected] \
LBAC_ADMIN_PASSWORD=changeme \
go run ./cmd
Configuration
| Variable | Default | Description |
|---|---|---|
DATABASE_URL | — | Required. Postgres DSN (postgres://user:pass@host/db) |
API_ADDR | :8090 | Listen address |
LBAC_JWT_SECRET | change-me-in-production | JWT signing key — override in production |
LBAC_ADMIN_EMAIL | — | Seeds an admin user on first start |
LBAC_ADMIN_PASSWORD | — | Seeds an admin user on first start |
LBAC_CORE_URL | http://lbac-core:9090 | lbac-core address (policy dry-run) |
LBAC_AUDIT_URL | — | lbac-audit gRPC address |
LBAC_FRONTEND_URL | — | Allowed CORS origin for the UI |
LBAC_OIDC_ISSUER_URL | — | OIDC issuer URL (public, matches token iss) |
LBAC_OIDC_DISCOVERY_URL | — | OIDC discovery URL (internal, for JWKS fetch) |
LBAC_OIDC_CLIENT_ID | — | OIDC client ID |
LBAC_OIDC_CLIENT_SECRET | — | OIDC client secret |
LBAC_OIDC_REDIRECT_URL | — | OIDC redirect URL |
LBAC_OIDC_ADMIN_GROUP | lbac-admin | IdP group that grants admin access |
LBAC_ENTERPRISE_KEY | — | Enterprise license key |
Docker
docker run -p 8090:8090 \
-e DATABASE_URL=postgres://openlbac:openlbac@postgres/openlbac \
-e LBAC_JWT_SECRET=your-secret \
openlbac/lbac-server:latest
Build
go build -o bin/lbac-server ./cmd
Documentation
Full configuration reference, API docs, and deployment guides at openlbac.com.
License
Community code is licensed under Apache 2.0. Enterprise feature files (SSO, audit log ingestion, RBAC, policy templates) are licensed under the Elastic License 2.0 (ELv2).
Tag summary
Content type
Image
Digest
sha256:0dcc0b589…
Size
15.7 MB
Last updated
6 months ago
docker pull openlbac/lbac-server