phirumseng/knetrahub-pam-api repository overview

⁠phirumseng/knetrahub-pam-api

Privileged Access API — the request half of Privileged Access.

KNetraHub is a self-hosted IT operations portal: a Docker Swarm console, full-stack monitoring, work management, privileged access management, IP address management and a database workspace, behind one sign-in. It ships two ways — as a single monolith image, or as the split stack of one image per service that this image belongs to.

📖 Documentation: https://sengphirum.github.io/KNetraHub/documentation⁠

⁠What this image does

The Privileged Access module's HTTP API and realtime (SSE + WebSocket) endpoints, plus its schema migrations. No background jobs.

It bundles the server code of pam and nothing else, so the image carries only the module it is named after.

⁠How it works

Serves Privileged Access's HTTP endpoints and its realtime stream, and applies that module's own schema migrations at start-up. It opens two database pools: the portal pool it shares with every service, and Privileged Access's module pool, which it shares only with that module's worker.

⁠What it deliberately does not do

It runs no background job whatsoever. Nothing here polls, sweeps or drains, so restarting it interrupts requests only — never the work already in flight on the worker.

⁠Privileges

Runs unprivileged with cap_drop: [ALL] and nothing added back.

⁠Which image do I want

Scale this with request and dashboard load. Scale pam-worker separately when it is the jobs, not the traffic, that are growing.

⁠Settings

Read straight from the stack file that deploys this service, so the list is what the image actually takes. Optional entries ship commented out.

Anything ending in _FILE reads its value from that path instead, which is how the stack passes Docker secrets.

⁠Deploying it

This is one service of a stack, not a standalone container: it expects the portal database and its siblings on the same overlay network. Deploy it with the stack file that owns it rather than with docker run.

docker stack deploy -c docker/docker-compose.yml knetrahub

Pin a tag or a registry for this one service with KNETRAHUB_PAM_API_IMAGE, which the stack file reads:

export KNETRAHUB_PAM_API_IMAGE=phirumseng/knetrahub-pam-api:0.1.11

⁠Supported tags

• latest — the most recent release
• x.y.z (e.g. 0.1.11) — immutable release versions

Pin the version in production. A rollback needs a tag that does not move, and every image in the stack is released under the same version so the whole set can be pinned together.

⁠The rest of the stack

Each service is its own image, so one can be updated without restarting the others:

• phirumseng/knetrahub-app⁠ — Monolith (app)
• phirumseng/knetrahub-ui⁠ — UI
• phirumseng/knetrahub-core-api⁠ — Core API
• phirumseng/knetrahub-docker-api⁠ — Docker API
• phirumseng/knetrahub-docker-worker⁠ — Docker worker
• phirumseng/knetrahub-monitoring-api⁠ — Monitoring API
• phirumseng/knetrahub-monitoring-worker⁠ — Monitoring worker
• phirumseng/knetrahub-work-api⁠ — Work API
• phirumseng/knetrahub-work-worker⁠ — Work worker
• phirumseng/knetrahub-pam-api — Privileged Access API ← this image
• phirumseng/knetrahub-pam-worker⁠ — Privileged Access worker
• phirumseng/knetrahub-ipmgt-api⁠ — IP Management API
• phirumseng/knetrahub-ipmgt-worker⁠ — IP Management worker
• phirumseng/knetrahub-dbmanager-api⁠ — Database Manager API
• phirumseng/knetrahub-agent⁠ — node agent
• phirumseng/knetrahub-pam-ssh-gateway⁠ — PAM SSH gateway
• phirumseng/knetrahub-pam-connector-runner⁠ — PAM connector runner
• phirumseng/knetrahub-dbmanager-gateway⁠ — DB Manager gateway

⁠License

Proprietary — © Seng Phirum. All rights reserved.