{"id":79538,"date":"2026-10-28T06:20:18","date_gmt":"2026-10-28T06:20:18","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79538"},"modified":"2026-10-28T06:20:20","modified_gmt":"2026-10-28T06:20:20","slug":"pomerium","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/pomerium\/","title":{"rendered":"Pomerium"},"content":{"rendered":"\n

PART I \u2014 UNDERSTAND THE WORLD BEFORE THE TOOL<\/h1>\n\n\n\n

Chapter 1. The Big Picture<\/h2>\n\n\n\n

Imagine a medieval castle. To keep the treasure inside safe, the king builds a massive stone wall and a moat. If you have the key to the front gate, you are allowed inside. Once you are inside, you can walk freely into the armory, the kitchen, and the throne room because the guards assume that anyone inside the walls is trustworthy.<\/p>\n\n\n\n

For decades, computer networks were built the exact same way. Companies built a “perimeter” using Firewalls and Virtual Private Networks (VPNs). If you connected to the VPN, you were “inside the network” and trusted.<\/p>\n\n\n\n

What changed?<\/strong> The modern world broke this model. Employees now work from coffee shops, not just the office. Applications live in the cloud, not just in the basement server room. Furthermore, if a hacker steals a single employee’s VPN password, they get past the “castle wall” and can freely attack every system inside (this is called lateral movement<\/em>).<\/p>\n\n\n\n

We needed a new approach: Zero Trust<\/strong>. Instead of trusting you because you are inside<\/em> the network, Zero Trust verifies your identity and device health every single time<\/em> you try to open an application, regardless of where you are sitting. Pomerium is a tool built to enforce this exact model.<\/p>\n\n\n\n

What You Should Understand Before Moving On:<\/strong> The old way of securing applications relied on trusting the network (VPNs). The new way relies on verifying identity and context for every single request (Zero Trust).<\/p>\n\n\n\n

Chapter 2. Prerequisite Concepts<\/h2>\n\n\n\n

To understand Pomerium, you must understand the building blocks it relies on.<\/p>\n\n\n\n

Concept<\/strong><\/td>Simple Definition<\/strong><\/td>Everyday Analogy<\/strong><\/td>Technical Explanation<\/strong><\/td>Why It Matters<\/strong><\/td><\/tr><\/thead>
Reverse Proxy<\/strong><\/td>A middleman that sits in front of your applications and intercepts incoming traffic.<\/td>A receptionist who intercepts all visitors, checks their reason for visiting, and then points them to the right office.<\/td>A server that retrieves resources on behalf of a client from one or more backend servers.<\/td>Pomerium is<\/em> a reverse proxy. It intercepts your web requests.<\/td><\/tr>
Identity Provider (IdP)<\/strong><\/td>A service that manages user accounts and proves who you are.<\/td>The DMV (Department of Motor Vehicles) that issues your ID card.<\/td>A system (like Google Workspace, Okta, or GitHub) that authenticates users and provides tokens via OIDC\/SAML.<\/td>Pomerium doesn’t store passwords. It asks your IdP to verify you.<\/td><\/tr>
OIDC \/ OAuth2<\/strong><\/td>Open protocols for authentication and authorization.<\/td>The standard barcode format used on your ID card so any scanner can read it.<\/td>OpenID Connect provides identity verification; OAuth2 provides delegated access.<\/td>Pomerium uses these to talk to your IdP securely.<\/td><\/tr>
JWT (JSON Web Token)<\/strong><\/td>A secure, digitally signed digital ID card.<\/td>A wristband at a concert. Once they check your ticket, you get a wristband to prove you are allowed in.<\/td>A compact, URL-safe string containing cryptographic claims about a user.<\/td>Pomerium reads and passes JWTs to your applications.<\/td><\/tr>
Zero Trust<\/strong><\/td>The security philosophy of “Never trust, always verify.”<\/td>A hotel where your keycard is checked at the front door, the elevator, AND your room door.<\/td>A framework requiring all users to be authenticated and authorized continuously before being granted access.<\/td>This is the architectural pattern Pomerium helps you achieve.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Chapter 3. Essential Terminology and Glossary<\/h2>\n\n\n\n
Term<\/strong><\/td>Full Form<\/strong><\/td>Simple Meaning<\/strong><\/td>Example<\/strong><\/td>Why It Matters<\/strong><\/td><\/tr><\/thead>
IAP<\/strong><\/td>Identity-Aware Proxy<\/td>A proxy that checks who you are before letting you through.<\/td>Pomerium, Google Cloud IAP.<\/td>This is the specific category of tool Pomerium falls into.<\/td><\/tr>
Route<\/strong><\/td>N\/A<\/td>A rule connecting a public URL to a private application.<\/td>Connecting admin.company.com<\/code> to internal IP 10.0.0.5<\/code>.<\/td>You will configure routes for every app you protect.<\/td><\/tr>
Policy<\/strong><\/td>N\/A<\/td>The rules deciding who<\/em> can use a Route.<\/td>“Only allow users with the email domain @mycompany.com”<\/td>This is how you enforce security.<\/td><\/tr>
Envoy<\/strong><\/td>Envoy Proxy<\/td>The high-performance engine running underneath Pomerium.<\/td>A car’s engine, while Pomerium is the steering wheel and dashboard.<\/td>Pomerium is technically a control plane that configures an underlying Envoy proxy.<\/td><\/tr>
Session<\/strong><\/td>N\/A<\/td>A temporary period of authorized access.<\/td>Being logged in for 12 hours before having to re-enter your password.<\/td>Pomerium manages session state so users don’t have to log in on every single click.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Chapter 4. How the Technology Domain Works Without This Tool<\/h2>\n\n\n\n

Before Identity-Aware Proxies like Pomerium, remote access looked like this:<\/p>\n\n\n\n

    \n
  1. The user installs a VPN client on their laptop.<\/li>\n\n\n\n
  2. The user connects to the company VPN gateway.<\/li>\n\n\n\n
  3. The VPN gateway verifies the user’s password and connects their computer to the internal corporate network.<\/li>\n\n\n\n
  4. The user types [http:\/\/internal-wiki.local](http:\/\/internal-wiki.local)<\/code> into their browser.<\/li>\n\n\n\n
  5. The request travels through the VPN tunnel to the internal server.<\/li>\n<\/ol>\n\n\n\n

    Code snippet<\/p>\n\n\n

    flowchart<\/span> LR<\/span>\n    User<\/span>[\"User (Coffee Shop)\"<\/span>]<\/span> --<\/span> 1. Connects<\/span> to<\/span> --<\/span>> VPN<\/span>[\"VPN Gateway\"<\/span>]<\/span>\n    VPN<\/span> --<\/span> 2. Grants<\/span> Network<\/span> Access<\/span> --<\/span>> Network<\/span>[\"Corporate Internal Network\"<\/span>]<\/span>\n    Network<\/span> --<\/span> 3. Access<\/span> App<\/span> --<\/span>> App1<\/span>[\"Internal Wiki\"<\/span>]<\/span>\n    Network<\/span> --<\/span> 3. Access<\/span> App<\/span> --<\/span>> App2<\/span>[\"Admin Dashboard\"<\/span>]<\/span>\n    Network<\/span> --<\/span> 3. Access<\/span> App<\/span> --<\/span>> App3<\/span>[\"HR System\"<\/span>]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    The problem with this approach:<\/strong> Once the user passes step 2, they have access to the entire Corporate Internal Network<\/code>. If they are a malicious actor, they can easily probe App2<\/code> or App3<\/code>, even if they only needed to access App1<\/code>.<\/p>\n\n\n\n
    PART II \u2014 UNDERSTAND THE TOOL<\/h1>\n\n\n\n
    Chapter 5. What Is Pomerium?<\/h2>\n\n\n\n
    Pomerium is an open-source Identity-Aware Proxy (IAP)<\/strong>.<\/p>\n\n\n\n
      \n
    • Primary Purpose:<\/strong> To securely connect users to internal applications without a VPN, by verifying their identity for every single request.<\/li>\n\n\n\n
    • Who uses it:<\/strong> System Administrators, DevOps engineers, and Security teams.<\/li>\n\n\n\n
    • Where it runs:<\/strong> Typically deployed at the edge of your network (in Docker, Kubernetes, or on a Linux server) facing the public internet.<\/li>\n\n\n\n
    • What it does NOT do:<\/strong> It is not an Identity Provider (it doesn’t store passwords\u2014it relies on Google, Okta, GitHub, etc.). It is also not a web application firewall (WAF), though it provides some overlapping protections.<\/li>\n\n\n\n
    • Definitions:<\/strong>\n
        \n
      • One-sentence:<\/em> Pomerium is an open-source tool that acts as a secure gateway, verifying a user’s identity before letting them access private web applications.<\/li>\n\n\n\n
      • Technical:<\/em> Pomerium is an identity-aware access proxy built on Envoy that integrates with OIDC Identity Providers to enforce Zero Trust access control policies at the application layer (Layer 7).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
        Chapter 6. Why Does This Tool Exist?<\/h2>\n\n\n\n
        Pomerium exists to solve the vulnerabilities of perimeter-based security (VPNs) and the complexity of managing application access.<\/p>\n\n\n\n
        Situations where it is useful:<\/strong><\/p>\n\n\n\n
          \n
        • You have a private dashboard (like Grafana or Jenkins) that you want your team to access from home, but you don’t want to expose it to the public internet or force them to use a clunky VPN.<\/li>\n\n\n\n
        • You want to enforce Two-Factor Authentication (2FA) on an older application that doesn’t support 2FA natively. (Pomerium enforces 2FA at the proxy level via your IdP).<\/li>\n<\/ul>\n\n\n\n
          Situations where it is unnecessary:<\/strong><\/p>\n\n\n\n
            \n
          • You are building a public-facing blog where anyone should have access.<\/li>\n\n\n\n
          • You only need machine-to-machine TCP routing without user identity (a standard reverse proxy like Nginx or HAProxy is fine).<\/li>\n<\/ul>\n\n\n\n
            The Benefit:<\/strong> Fast, seamless user experience. Users just type the URL into their browser, authenticate with their normal work email (via Google\/Okta), and are instantly in the app. No VPN clients required.<\/p>\n\n\n\n
            Chapter 7. How the Tool Works<\/h2>\n\n\n\n
            Pomerium sits between the public internet and your private applications.<\/p>\n\n\n\n
              \n
            1. Intercept:<\/strong> A user requests [https:\/\/wiki.company.com](https:\/\/wiki.company.com)<\/code>. Pomerium intercepts this request.<\/li>\n\n\n\n
            2. Authenticate:<\/strong> Pomerium checks if the user has a valid session cookie. If not, it redirects them to the Identity Provider (e.g., Google).<\/li>\n\n\n\n
            3. Authorize:<\/strong> Once Google says “This is Alice,” Pomerium checks its configuration file: Is Alice allowed to view the wiki?<\/em><\/li>\n\n\n\n
            4. Proxy:<\/strong> If Alice is authorized, Pomerium forwards the request to the internal wiki server and returns the result to Alice.<\/li>\n<\/ol>\n\n\n\n
              Code snippet<\/p>\n\n\n
              sequenceDiagram\n    participant U as<\/span> User Browser\n    participant P as<\/span> Pomerium\n    participant IdP as<\/span> Identity Provider (e.g. Google)\n    participant A as<\/span> Internal App\n\n    U->>P: 1.<\/span> GET https:\/\/app.company.com<\/span>\n    P->>U: 2.<\/span> Redirect to IdP for<\/span> login\n    U->>IdP: 3.<\/span> User logs in<\/span>\n    IdP->>P: 4.<\/span> Returns Identity Token (OIDC)\n    P->>P: 5.<\/span> Evaluates Policy (Is user allowed?)\n    P->>A: 6.<\/span> Proxies request to Internal App\n    A->>P: 7.<\/span> Returns Application Data\n    P->>U: 8.<\/span> Displays Application to User\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
              Chapter 8. Core Features Explained Simply<\/h2>\n\n\n\n
              Feature<\/strong><\/td>Simple Explanation<\/strong><\/td>Problem Solved<\/strong><\/td>Beginner or Advanced<\/strong><\/td><\/tr><\/thead>
              SSO Integration<\/strong><\/td>Uses your existing login system (Google, Okta, GitHub).<\/td>Prevents you from having to create new passwords for internal tools.<\/td>Essential<\/td><\/tr>
              Policy Enforcement<\/strong><\/td>Rules like “Only the Dev team can access this app.”<\/td>Granular security control per application.<\/td>Essential<\/td><\/tr>
              Identity Header Passing<\/strong><\/td>Sends the user’s email to the backend app securely via a JWT.<\/td>The backend app knows who you are without you having to log in twice.<\/td>Advanced<\/td><\/tr>
              Audit Logging<\/strong><\/td>Records exactly who accessed what, and when.<\/td>Compliance and security investigations.<\/td>Everyday<\/td><\/tr>
              TCP Support<\/strong><\/td>Secures SSH or database connections, not just websites.<\/td>Securing non-web traffic over Zero Trust.<\/td>Advanced<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              Chapter 9. Similar Tools and Alternatives<\/h2>\n\n\n\n
              Tool<\/strong><\/td>Primary Purpose<\/strong><\/td>Main Strength<\/strong><\/td>Main Limitation<\/strong><\/td>Best Use Case<\/strong><\/td>Relationship to Pomerium<\/strong><\/td><\/tr><\/thead>
              Cloudflare Access<\/strong><\/td>Managed ZTNA<\/td>Extremely easy to set up, globally distributed.<\/td>It is a proprietary SaaS; you don’t control the data plane.<\/td>Small teams wanting instant setup without managing servers.<\/td>Direct competitor (SaaS vs Self-hosted).<\/td><\/tr>
              Tailscale<\/strong><\/td>Mesh VPN<\/td>Connects devices via Wireguard easily.<\/td>Gives network-level access (VPN) rather than just application-level proxying.<\/td>Connecting servers and devices directly.<\/td>Complementary\/Alternative.<\/td><\/tr>
              Google Cloud IAP<\/strong><\/td>Cloud Identity Proxy<\/td>Native integration with GCP.<\/td>Only works well if your apps are hosted in Google Cloud.<\/td>Teams exclusively using Google Cloud infrastructure.<\/td>Direct competitor (Platform specific).<\/td><\/tr>
              Nginx \/ Traefik<\/strong><\/td>Standard Reverse Proxy<\/td>Extremely fast, flexible routing.<\/td>No native identity awareness; you have to build auth yourself.<\/td>Public websites, microservices routing.<\/td>Predecessor\/Alternative for non-auth needs.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              Which Tool Should You Choose and Why?<\/strong> Choose Pomerium<\/strong> if you want to self-host your security infrastructure, maintain complete control over your data, and require granular identity-aware routing for web applications. Choose Cloudflare Access if you want a managed SaaS. Choose Tailscale if you need machine-to-machine VPN networking.<\/p>\n\n\n\n
              PART III \u2014 ARCHITECTURE AND WORKFLOWS<\/h1>\n\n\n\n
              Chapter 10. Architecture Explained from Simple to Advanced<\/h2>\n\n\n\n
              Pomerium can be deployed in two ways: All-in-One (for beginners) or Distributed (for production).<\/p>\n\n\n\n
              The Simplest Setup (All-in-One):<\/strong> For smaller setups, Pomerium runs as a single binary or single Docker container. Inside this single process, four distinct services run together:<\/p>\n\n\n\n
                \n
              1. Proxy:<\/strong> The front door. It receives the user’s web request.<\/li>\n\n\n\n
              2. Authenticate:<\/strong> Handles the handshake with your Identity Provider (Google, Okta).<\/li>\n\n\n\n
              3. Authorize:<\/strong> The bouncer. It checks the policy to see if the authenticated user is allowed in.<\/li>\n\n\n\n
              4. Databroker:<\/strong> The memory. It stores session data and user information.<\/li>\n<\/ol>\n\n\n\n
                Distributed Setup (Production):<\/strong> In high-traffic environments, you split these four components into separate servers or Kubernetes pods so they can scale independently.<\/p>\n\n\n\n
                Code snippet<\/p>\n\n\n
                flowchart<\/span> TD<\/span>\n    User<\/span>[\"User Browser\"<\/span>]<\/span> --<\/span>> Proxy<\/span>[\"Proxy Service (Edge)\"<\/span>]<\/span>\n    Proxy<\/span> <--<\/span>> AuthZ<\/span>[\"Authorize Service\"<\/span>]<\/span>\n    Proxy<\/span> <--<\/span>> AuthN<\/span>[\"Authenticate Service\"<\/span>]<\/span>\n    AuthZ<\/span> <--<\/span>> DataBroker<\/span>[\"Databroker Service\"<\/span>]<\/span>\n    AuthN<\/span> <--<\/span>> DataBroker<\/span>\n    AuthN<\/span> <--<\/span>> IdP<\/span>[\"Identity Provider (External)\"<\/span>]<\/span>\n    Proxy<\/span> --<\/span>> App<\/span>[\"Internal Application\"<\/span>]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                In the diagram above, the Proxy receives the request, asks the Authenticate service to verify identity (which talks to the IdP), asks the Authorize service to verify permissions (which checks the Databroker for policy\/state), and finally proxies traffic to the App.<\/em><\/p>\n\n\n\n
                Chapter 11. The Complete Workflow<\/h2>\n\n\n\n
                  \n
                1. Trigger:<\/strong> A user navigates to [https:\/\/grafana.internal.com](https:\/\/grafana.internal.com)<\/code>.<\/li>\n\n\n\n
                2. Input:<\/strong> The browser sends an HTTP GET request.<\/li>\n\n\n\n
                3. Component:<\/strong> The Pomerium Proxy Service<\/strong> receives it.<\/li>\n\n\n\n
                4. Processing (No Session):<\/strong> Pomerium sees no session cookie. It redirects the user to the IdP.<\/li>\n\n\n\n
                5. Dependency:<\/strong> The external IdP (e.g., Auth0) prompts for a password and 2FA.<\/li>\n\n\n\n
                6. Processing (Authorization):<\/strong> The user returns with a token. The Authorize Service<\/strong> checks the configuration: Does user match policy?<\/em><\/li>\n\n\n\n
                7. Result:<\/strong> Access is granted. The Proxy forwards the GET request to the internal Grafana server.<\/li>\n\n\n\n
                8. Failure Path:<\/strong> If the user logs in but is not in the correct group, Pomerium intercepts the request and displays an HTTP 403 Access Denied page, preventing the traffic from ever touching the Grafana server.<\/li>\n<\/ol>\n\n\n\n
                  PART IV \u2014 INSTALLATION AND FIRST SUCCESS<\/h1>\n\n\n\n
                  Chapter 13. Prerequisites and Environment Preparation<\/h2>\n\n\n\n
                  Before installing Pomerium, you must have:<\/p>\n\n\n\n
                    \n
                  • A domain name:<\/strong> Pomerium relies heavily on HTTPS and cookies. You need a real domain (e.g., example.com<\/code>).<\/li>\n\n\n\n
                  • TLS Certificates:<\/strong> You can use wildcard certs, Let’s Encrypt, or self-signed certs (for local testing).<\/li>\n\n\n\n
                  • An Identity Provider:<\/strong> You need a free account with an IdP like Auth0, GitHub, or a Google Workspace account. You will need a Client ID<\/code> and Client Secret<\/code> from them.<\/li>\n\n\n\n
                  • Shared Secret:<\/strong> A base64-encoded random string used by Pomerium components to securely talk to each other.<\/li>\n\n\n\n
                  • Cookie Secret:<\/strong> A base64-encoded random string used to encrypt user browser cookies.<\/li>\n<\/ul>\n\n\n\n
                    Tip: Generate your secrets now in your terminal:<\/em><\/p>\n\n\n\n
                    Bash<\/p>\n\n\n
                    head -c32 \/dev\/urandom | base64\n<\/code><\/span><\/pre>\n\n\n
                    (Run this twice: once for SHARED_SECRET<\/code> and once for COOKIE_SECRET<\/code>)<\/em><\/p>\n\n\n\n
                    Chapter 14. Install on Supported Operating Systems<\/h2>\n\n\n\n
                    Pomerium is distributed as a single compiled binary, meaning it does not require complex runtime environments (like Java or Python).<\/p>\n\n\n\n
                    A. Docker (Recommended for all OS \/ Beginners)<\/h3>\n\n\n\n
                    Because Pomerium requires an app to protect and specific configurations, using Docker Compose is the most universal way to run it on Windows, macOS, or Linux.<\/p>\n\n\n\n
                    Bash<\/p>\n\n\n
                    # Pull the official Pomerium image<\/span>\ndocker pull pomerium\/pomerium:latest\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                    B. Ubuntu \/ Debian (Native)<\/h3>\n\n\n\n
                    Use the official package repository.<\/p>\n\n\n\n
                    Bash<\/p>\n\n\n
                    # Add the signing key and repository<\/span>\nsudo curl -1<\/span>sLf 'https:\/\/dl.cloudsmith.io\/public\/pomerium\/pomerium\/gpg.05193B615F3BA22A.key'<\/span> | sudo gpg --dearmor -o \/usr\/share\/keyrings\/pomerium-archive-keyring.gpg\necho<\/span> \"deb [signed-by=\/usr\/share\/keyrings\/pomerium-archive-keyring.gpg] https:\/\/dl.cloudsmith.io\/public\/pomerium\/pomerium\/deb\/debian any-version main\"<\/span> | sudo tee \/etc\/apt\/sources.list<\/span>.d\/pomerium.list<\/span>\n\n# Install<\/span>\nsudo apt update && sudo apt install pomerium\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                    Configuration will live in \/etc\/pomerium\/config.yaml<\/code>.<\/em><\/p>\n\n\n\n
                    C. macOS (Native via Homebrew)<\/h3>\n\n\n\n
                    Bash<\/p>\n\n\n
                    brew install pomerium\n<\/code><\/span><\/pre>\n\n\n
                    To start it: brew services start pomerium<\/code>.<\/em><\/p>\n\n\n\n
                    D. Windows<\/h3>\n\n\n\n
                    Pomerium does not have a native Windows installer. Windows users must use Docker Desktop<\/strong> or Windows Subsystem for Linux (WSL2)<\/strong> running Ubuntu.<\/p>\n\n\n\n
                    Chapter 15. Your First Working Example<\/h2>\n\n\n\n
                    Let’s build a working Identity-Aware Proxy on your local machine using Docker Compose. We will protect a simple Nginx web server using GitHub<\/strong> as our Identity Provider.<\/p>\n\n\n\n
                    Objective:<\/strong> Protect http:\/\/localhost:8080<\/code> so only YOU (via your GitHub account) can access it.<\/p>\n\n\n\n
                    Step 1: Get GitHub OAuth Credentials<\/strong><\/p>\n\n\n\n
                      \n
                    1. Go to your GitHub Settings -> Developer settings -> OAuth Apps.<\/li>\n\n\n\n
                    2. Click “New OAuth App”.<\/li>\n\n\n\n
                    3. Name: Pomerium Local<\/code><\/li>\n\n\n\n
                    4. Homepage URL: https:\/\/localhost<\/code><\/li>\n\n\n\n
                    5. Authorization callback URL: https:\/\/localhost\/.pomerium\/callback<\/code><\/li>\n\n\n\n
                    6. Save. Copy the Client ID<\/strong> and generate a Client Secret<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                      Step 2: Create the config.yaml<\/code> file<\/strong> Create a folder named pomerium-test<\/code>. Inside, create config.yaml<\/code>:<\/p>\n\n\n\n
                      YAML<\/p>\n\n\n
                      # config.yaml<\/span>\nauthenticate_service_url: https:\/\/localhost<\/span>\n\n# Identity Provider Settings<\/span>\nidp_provider: github\nidp_client_id: \"YOUR_GITHUB_CLIENT_ID\"<\/span>\nidp_client_secret: \"YOUR_GITHUB_CLIENT_SECRET\"<\/span>\n\n# Security (Replace with strings generated earlier)<\/span>\ncookie_secret: \"OThkNzVkMmEtY2E2OS00ZGUzLTliNGEtYTEwNzE1Y2Vj\"<\/span> \nshared_secret: \"Zjk1YThkYzUtYmEyNi00MjMzLWI1ZjYtNjkyMmVlOTc\"<\/span>\n\n# Testing settings (bypasses requirement for valid public TLS certs)<\/span>\ninsecure_server: true<\/span>\n\n# The Routing Policy<\/span>\nroutes:\n  - from: https:\/\/localhost<\/span>\n    to: http:\/\/hello-app:80<\/span>\n    policy:\n      - allow:\n          or<\/span>:\n            - claim\/email: \"YOUR_GITHUB_EMAIL@example.com\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      (Replace the Client ID, Secret, and your GitHub email address).<\/em><\/p>\n\n\n\n
                      Step 3: Create the docker-compose.yml<\/code> file<\/strong> In the same folder, create this file:<\/p>\n\n\n\n
                      YAML<\/p>\n\n\n
                      # docker-compose.yml<\/span>\nversion: \"3\"<\/span>\nservices:\n  pomerium:\n    image: pomerium\/pomerium:latest\n    volumes:\n      - .\/config.yaml:\/pomerium\/config.yaml\n    ports:\n      - \"443:443\"<\/span> # HTTPS<\/span>\n      - \"80:80\"<\/span>   # HTTP<\/span>\n  \n  # The internal app we are protecting<\/span>\n  hello-app:\n    image: nginxdemos\/hello:plain-text\n    expose:\n      - \"80\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      Step 4: Run and Verify<\/strong><\/p>\n\n\n\n
                        \n
                      1. Open your terminal in the pomerium-test<\/code> folder.<\/li>\n\n\n\n
                      2. Run: docker-compose up<\/code><\/li>\n\n\n\n
                      3. Open your web browser and go to https:\/\/localhost<\/code><\/li>\n\n\n\n
                      4. Expected Output:<\/strong> You will be instantly redirected to GitHub to log in. After logging in, you will be redirected back to localhost, where you will see the Nginx hello screen!<\/li>\n\n\n\n
                      5. To undo:<\/strong> Press Ctrl+C<\/code> in your terminal, then type docker-compose down<\/code>.<\/li>\n<\/ol>\n\n\n\n
                        Common Mistake:<\/em> Using http:\/\/<\/code> instead of https:\/\/<\/code>. Pomerium routes strictly enforce HTTPS for the public-facing side.<\/p>\n\n\n\n
                        PART V \u2014 COMMANDS, CONFIGURATION AND DAILY USAGE<\/h1>\n\n\n\n
                        Chapter 16. Essential Commands and Operations<\/h2>\n\n\n\n
                        If you install Pomerium natively (not Docker), you use the pomerium<\/code> CLI.<\/p>\n\n\n\n
                        Command<\/strong><\/td>What It Does<\/strong><\/td>When to Use It<\/strong><\/td>Example<\/strong><\/td><\/tr><\/thead>
                        pomerium<\/code><\/td>Starts the Pomerium service using defaults.<\/td>Running the server manually.<\/td>pomerium -config=\/etc\/pomerium\/config.yaml<\/code><\/td><\/tr>
                        pomerium-cli tcp<\/code><\/td>Starts a local TCP tunnel authenticated via Pomerium.<\/td>When you want to SSH into a server secured by Pomerium.<\/td>pomerium-cli tcp ssh.internal.com:22<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                        Note: Pomerium is primarily controlled via its configuration file, not dynamic CLI commands.<\/em><\/p>\n\n\n\n
                        Chapter 17. Configuration Explained<\/h2>\n\n\n\n
                        The core of Pomerium is the config.yaml<\/code> file. It has two main sections: Global Settings<\/strong> and Routes<\/strong>.<\/p>\n\n\n\n
                        YAML<\/p>\n\n\n
                        # 1. Global Settings<\/span>\naddress: \":443\"<\/span>                    # Port Pomerium listens on<\/span>\nauthenticate_service_url: https:\/\/auth.company.com # Where users go to login<\/span>\n\nidp_provider: okta                 # Which IdP you are using<\/span>\nidp_client_id: \"xyz123\"<\/span>            # Provided by your IdP<\/span>\nidp_client_secret: \"secret987\"<\/span>     # Provided by your IdP<\/span>\nidp_provider_url: \"https:\/\/mycompany.okta.com\"<\/span> # Required for some IdPs<\/span>\n\ncookie_secret: \"base64-secret\"<\/span>     # Encrypts the session cookie<\/span>\n\n# 2. Routes (The Apps you are protecting)<\/span>\nroutes:\n  - from: https:\/\/wiki.company.com # What the user types in their browser<\/span>\n    to: http:\/\/10.0.1.55:8080      # Where the actual app lives internally<\/span>\n    policy:                        # The security rules<\/span>\n      - allow:\n          or<\/span>:\n            - domain: \"company.com\"<\/span> # Anyone with a company email can enter<\/span>\n  \n  - from: https:\/\/admin.company.com<\/span>\n    to: http:\/\/10.0.1.56:80<\/span>\n    policy:\n      - allow:\n          or<\/span>:\n            - claim\/email: \"admin@company.com\"<\/span> # Only this specific person can enter<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                        Configuration Precedence:<\/strong> Pomerium reads configuration in this order:<\/p>\n\n\n\n
                          \n
                        1. Environment Variables (e.g., POMERIUM_IDP_CLIENT_ID<\/code>)<\/li>\n\n\n\n
                        2. config.yaml<\/code><\/li>\n\n\n\n
                        3. Default values.Best Practice:<\/em> Store secrets (like idp_client_secret<\/code>) as environment variables, and routing rules in the YAML file.<\/li>\n<\/ol>\n\n\n\n
                          Chapter 18. Logs, Status and Verification<\/h2>\n\n\n\n
                          Checking Logs:<\/strong> If Pomerium isn’t working, logs are your best friend. Pomerium outputs JSON-formatted logs by default.<\/p>\n\n\n\n
                            \n
                          • Docker:<\/strong> docker logs pomerium_container_name<\/code><\/li>\n\n\n\n
                          • Ubuntu (Systemd):<\/strong> journalctl -u pomerium -f<\/code><\/li>\n<\/ul>\n\n\n\n
                            Understanding the Logs:<\/strong> When a user accesses an app successfully, you will see a log entry with \"level\":\"info\"<\/code> and \"authorize_result\":\"allow\"<\/code>. If they are blocked, you will see \"authorize_result\":\"deny\"<\/code>.<\/p>\n\n\n\n
                            Troubleshooting Status:<\/strong> Pomerium has a built-in special endpoint. If you navigate to [https:\/\/app.company.com\/.pomerium\/](https:\/\/app.company.com\/.pomerium\/)<\/code> in your browser (notice the \/.pomerium\/<\/code> path), Pomerium will display a status page showing your current session, email, and the claims it received from the Identity Provider.<\/p>\n\n\n\n
                            PART VI \u2014 REAL-WORLD APPLICATIONS<\/h1>\n\n\n\n
                            Chapter 19. Practical Use Cases<\/h2>\n\n\n\n
                              \n
                            1. The Internal Wiki (Small Team):<\/strong>\n
                                \n
                              • Problem:<\/em> The team relies on an internal Confluence\/Wiki server, but VPNs are too slow.<\/li>\n\n\n\n
                              • Solution:<\/em> Pomerium routes wiki.company.com<\/code> to the internal server, allowing access to anyone with a @company.com<\/code> Google Workspace email.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                              • The Developer Admin Panel (Production):<\/strong>\n
                                  \n
                                • Problem:<\/em> Developers need access to a Jenkins CI\/CD dashboard, but it has weak built-in security.<\/li>\n\n\n\n
                                • Solution:<\/em> Pomerium wraps the Jenkins UI. Only users in the GitHub DevOps<\/code> team are allowed through. Jenkins is completely hidden from the internet.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                                • Legacy App Protection (Enterprise):<\/strong>\n
                                    \n
                                  • Problem:<\/em> A 15-year-old HR application doesn’t support Two-Factor Authentication.<\/li>\n\n\n\n
                                  • Solution:<\/em> Pomerium is placed in front of it. Pomerium forces the user to log in via Okta (which enforces 2FA). The legacy app is instantly secured without rewriting its code.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                                    Chapter 20. A Complete Hands-On Project<\/h2>\n\n\n\n
                                    Project:<\/strong> Secure a private Grafana dashboard.Prerequisites:<\/strong> Docker, Docker Compose, a free Auth0 account.<\/p>\n\n\n\n
                                    Step 1: Auth0 Setup<\/strong><\/p>\n\n\n\n
                                      \n
                                    1. Create a “Regular Web Application” in Auth0.<\/li>\n\n\n\n
                                    2. Set Allowed Callback URLs to: [https:\/\/grafana.local.test\/.pomerium\/callback](https:\/\/grafana.local.test\/.pomerium\/callback)<\/code><\/li>\n\n\n\n
                                    3. Save Client ID, Client Secret, and your Auth0 Domain.<\/li>\n<\/ol>\n\n\n\n
                                      Step 2: File Structure<\/strong> Create a directory with docker-compose.yaml<\/code> and config.yaml<\/code>. Update your computer’s hosts<\/code> file (e.g., \/etc\/hosts<\/code>) to map 127.0.0.1 grafana.local.test<\/code>.<\/p>\n\n\n\n
                                      Step 3: config.yaml<\/strong><\/p>\n\n\n\n
                                      YAML<\/p>\n\n\n
                                      authenticate_service_url: https:\/\/grafana.local.test<\/span>\nidp_provider: auth0\nidp_client_id<\/span>: \"YOUR_AUTH0_CLIENT_ID\"<\/span>\nidp_client_secret<\/span>: \"YOUR_AUTH0_SECRET\"<\/span>\nidp_provider_url<\/span>: \"https:\/\/YOUR_AUTH0_DOMAIN.auth0.com\"<\/span>\ncookie_secret<\/span>: \"YOUR_COOKIE_SECRET\"<\/span>\nshared_secret<\/span>: \"YOUR_SHARED_SECRET\"<\/span>\ninsecure_server<\/span>: true<\/span>\n\nroutes<\/span>:\n  - from<\/span>: https:\/\/grafana.local.test<\/span>\n    to: http:\/\/grafana:3000<\/span>\n    policy:\n      - allow:\n          and:\n            - authenticated_user: true<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                      Step 4: docker-compose.yaml<\/strong><\/p>\n\n\n\n
                                      YAML<\/p>\n\n\n
                                      version: \"3\"<\/span>\nservices:\n  pomerium:\n    image: pomerium\/pomerium:latest\n    volumes:\n      - .\/config.yaml:\/pomerium\/config.yaml\n    ports:\n      - \"443:443\"<\/span>\n  \n  grafana:\n    image: grafana\/grafana:latest\n    # Notice we DO NOT map ports here. Grafana is entirely isolated.<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                      Step 5: Testing<\/strong> Run docker-compose up<\/code>. Navigate to [https:\/\/grafana.local.test](https:\/\/grafana.local.test)<\/code>. You will be intercepted by Auth0. Log in, and you will securely access Grafana!<\/p>\n\n\n\n
                                      PART VII \u2014 ADVANCED CAPABILITIES<\/h1>\n\n\n\n
                                      Chapter 21. Advanced Features<\/h2>\n\n\n\n
                                        \n
                                      • JWT Identity Headers:<\/strong> When Pomerium proxies traffic to the backend app (like Grafana), it injects a HTTP header called X-Pomerium-Jwt-Assertion<\/code>. The backend app can read this JWT to automatically log the user in, achieving true Single Sign-On (SSO). The backend never needs to ask for a password again.<\/li>\n\n\n\n
                                      • Redis \/ Postgres Databroker Storage:<\/strong> By default, Pomerium stores session data in memory. If Pomerium restarts, everyone gets logged out. In production, you configure Pomerium to use Redis or PostgreSQL to store sessions so it becomes Highly Available (HA).<\/li>\n\n\n\n
                                      • TCP Proxying:<\/strong> Pomerium isn’t just for web apps. By using the pomerium-cli<\/code> on a client machine, you can secure SSH or database (e.g., MySQL) traffic through Pomerium’s Zero Trust policies.<\/li>\n<\/ul>\n\n\n\n
                                        Chapter 22. Security Best Practices<\/h2>\n\n\n\n
                                        Insecure Practice<\/strong><\/td>Safer Alternative<\/strong><\/td><\/tr><\/thead>
                                        Hardcoding idp_client_secret<\/code> in config.yaml<\/code>.<\/td>Passing secrets via Environment Variables or a Secret Manager (Kubernetes Secrets).<\/td><\/tr>
                                        Leaving backend apps exposed to the network.<\/td>Blocking all incoming traffic to the backend app except<\/em> traffic coming from Pomerium’s IP.<\/td><\/tr>
                                        Using basic claim\/email<\/code> policies for large teams.<\/td>Using IdP group memberships (e.g., groups: admin<\/code>) so offboarding is centralized in the IdP.<\/td><\/tr>
                                        insecure_server: true<\/code><\/td>Only use this for local testing. In production, use valid TLS certificates (like Let’s Encrypt).<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                        Chapter 23. Production-Ready Architecture<\/h2>\n\n\n\n
                                        When moving to production, you graduate from the “All-in-One” Docker container to a Distributed Architecture<\/strong>.<\/p>\n\n\n\n
                                          \n
                                        1. Load Balancer:<\/strong> Place a cloud Load Balancer in front of Pomerium.<\/li>\n\n\n\n
                                        2. Separate Services:<\/strong> Run the Proxy<\/code>, Authenticate<\/code>, Authorize<\/code>, and Databroker<\/code> as separate pods in Kubernetes.<\/li>\n\n\n\n
                                        3. Database:<\/strong> Connect the Databroker<\/code> to a managed PostgreSQL database.<\/li>\n\n\n\n
                                        4. Scale:<\/strong> If traffic increases, you can scale just the Proxy<\/code> service horizontally to 5, 10, or 20 instances.<\/li>\n<\/ol>\n\n\n\n
                                          Code snippet<\/p>\n\n\n
                                          flowchart<\/span> TD<\/span>\n    Internet<\/span>[\"Public Internet\"<\/span>]<\/span> --<\/span>> LB<\/span>[\"Cloud Load Balancer\"<\/span>]<\/span>\n    LB<\/span> --<\/span>> Proxy1<\/span>[\"Pomerium Proxy 1\"<\/span>]<\/span>\n    LB<\/span> --<\/span>> Proxy2<\/span>[\"Pomerium Proxy 2\"<\/span>]<\/span>\n    Proxy1<\/span> <--<\/span>> AuthZ<\/span>[\"Pomerium Authorize\"<\/span>]<\/span>\n    Proxy2<\/span> <--<\/span>> AuthZ<\/span>\n    AuthZ<\/span> <--<\/span>> DB<\/span>[\"PostgreSQL (State)\"<\/span>]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                          PART VIII \u2014 TROUBLESHOOTING AND MASTERY<\/h1>\n\n\n\n
                                          Chapter 24. Common Problems and Solutions<\/h2>\n\n\n\n
                                          Problem or Error<\/strong><\/td>Likely Cause<\/strong><\/td>How to Diagnose<\/strong><\/td>Solution<\/strong><\/td><\/tr><\/thead>
                                          Infinite Redirect Loop<\/strong><\/td>The authenticate_service_url<\/code> doesn’t match the URL you configured in the IdP.<\/td>Check browser network tab. Does it bounce between the IdP and Pomerium?<\/td>Ensure the callback URL in your IdP exactly matches the authenticate_service_url<\/code> + \/.pomerium\/callback<\/code>.<\/td><\/tr>
                                          HTTP 403 Access Denied<\/strong><\/td>User authenticated successfully, but policy rejected them.<\/td>Go to \/.pomerium\/<\/code> on the app URL and check your “Claims”.<\/td>Update config.yaml<\/code> policy to match the user’s actual email or group claim.<\/td><\/tr>
                                          HTTP 503 Service Unavailable<\/strong><\/td>Pomerium cannot reach the internal backend app.<\/td>Run curl -I http:\/\/backend-ip<\/code> from the machine running Pomerium.<\/td>Fix network routing, firewall rules, or Docker networks so Pomerium can reach the to:<\/code> address.<\/td><\/tr>
                                          Invalid Certificate Error<\/strong><\/td>Browser warns connection is not private.<\/td>Look at the certificate details in the browser.<\/td>Provide valid TLS certificates to Pomerium, or set insecure_server: true<\/code> if testing locally.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                          Chapter 25. Best Practices and Common Mistakes<\/h2>\n\n\n\n
                                            \n
                                          • Habit:<\/strong> Always check the \/.pomerium\/<\/code> endpoint when writing policies. It shows you exactly what data the IdP is sending to Pomerium, making it easy to write correct claim<\/code> rules.<\/li>\n\n\n\n
                                          • Mistake:<\/strong> Forgetting that Pomerium secures the front door<\/em>, but not the back window<\/em>. If Pomerium protects an internal server at 10.0.0.5<\/code>, you MUST configure the firewall on 10.0.0.5<\/code> to drop all traffic that doesn’t come from Pomerium. Otherwise, someone on the internal network can just bypass Pomerium entirely.<\/li>\n<\/ul>\n\n\n\n
                                            Chapter 26. Learning Roadmap<\/h2>\n\n\n\n
                                            Stage<\/strong><\/td>Topics<\/strong><\/td>Practical Activity<\/strong><\/td>Expected Skill<\/strong><\/td><\/tr><\/thead>
                                            1. Fundamentals<\/td>Zero Trust, IdPs, Reverse Proxies<\/td>Explain why VPNs are vulnerable to lateral movement.<\/td>Conceptual understanding<\/td><\/tr>
                                            2. First use<\/td>Docker Compose, Basic config<\/td>Run Pomerium locally with GitHub SSO.<\/td>Independent basic use<\/td><\/tr>
                                            3. Practical use<\/td>Policies, Routes, Headers<\/td>Protect multiple apps with different user policies.<\/td>Working proficiency<\/td><\/tr>
                                            4. Advanced use<\/td>PostgreSQL Databroker, TCP<\/td>Deploy Pomerium in Kubernetes; SSH via Pomerium.<\/td>Applied competence<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                            Chapter 27. Exercises and Knowledge Assessment<\/h2>\n\n\n\n
                                            Q1 (Beginner):<\/strong> Why does Pomerium not require a database to store user passwords?Answer:<\/em> Because Pomerium relies on an external Identity Provider (IdP) like Google or Okta to handle authentication and passwords.<\/p>\n\n\n\n
                                            Q2 (Intermediate):<\/strong> Your policy allows domain: company.com<\/code>, but the CEO gets a 403 Forbidden error. How do you troubleshoot?Answer:<\/em> Ask the CEO to navigate to [https:\/\/app.company.com\/.pomerium\/](https:\/\/app.company.com\/.pomerium\/)<\/code> and read the JSON output. Verify that their identity token actually includes the expected domain claim.<\/p>\n\n\n\n
                                            Q3 (Advanced):<\/strong> How does Pomerium prevent users from having to log into Google on every single webpage click?Answer:<\/em> Pomerium utilizes the Databroker and a signed session cookie. Upon the first successful login, Pomerium issues a cookie encrypted with the cookie_secret<\/code>. Subsequent requests are verified locally by Pomerium without pinging the IdP until the session expires.<\/p>\n\n\n\n
                                            Chapter 28. Final Revision and Quick Reference<\/h2>\n\n\n\n
                                              \n
                                            1. What it is:<\/strong> An open-source Identity-Aware Proxy (IAP) that enforces Zero Trust access to internal applications.<\/li>\n\n\n\n
                                            2. Core mechanism:<\/strong> It intercepts traffic, redirects unauthenticated users to an IdP, evaluates access policies, and proxies authorized traffic to the backend.<\/li>\n\n\n\n
                                            3. Essential Terminology:<\/strong> IdP (Identity Provider), Route (public to private map), Policy (access rules), JWT (secure identity token).<\/li>\n\n\n\n
                                            4. Configuration:<\/strong> Driven by config.yaml<\/code> containing authenticate_service_url<\/code>, IdP secrets, and a list of routes<\/code>.<\/li>\n\n\n\n
                                            5. Best Use Case:<\/strong> Replacing clunky client VPNs for employees accessing internal web dashboards, wikis, and administrative tools.<\/li>\n\n\n\n
                                            6. Alternatives:<\/strong> Cloudflare Access (SaaS ZTNA), Tailscale (Mesh VPN).<\/li>\n<\/ol>\n\n\n\n
                                              Quick Cheat Sheet (config.yaml Route Syntax):<\/strong><\/p>\n\n\n\n
                                              YAML<\/p>\n\n\n
                                              routes:\n  - from: https:\/\/public-facing-url.com<\/span>\n    to: http:\/\/internal-server-ip:port<\/span>\n    policy:\n      - allow:\n          and<\/span>:    # Can be 'and', 'or', 'not'<\/span>\n            - domain: \"mycompany.com\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>","protected":false},"excerpt":{"rendered":"
                                              PART I \u2014 UNDERSTAND THE WORLD BEFORE THE TOOL Chapter 1. The Big Picture Imagine a medieval castle. To keep the treasure inside safe, the king builds… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-79538","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=79538"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79538\/revisions"}],"predecessor-version":[{"id":79539,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79538\/revisions\/79539"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=79538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=79538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=79538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}