Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Prefect Community

is there a way to run the OSS server and the UI in a secured way, that is not exposing the apollo endpoint publicly? or protecting it?

depends on your deployment environment.

We put everything behind firewalls

I think the real issue is that the UI is run client side and expect to be able to access apollo on a public endpoint….

when you say public what do you mean? Open to the world?

our current setup looks like this

`user -&gt; vpn -&gt; kubernetes`

So no one can access apollo from outside our network, but yes apollo is still accessible to everyone "inside" the network

how do you control access to that cluster?

We run protected endpoints under Google OAuth so I guess I could expose apollo this way too

if your running under google (i'm assuming GKE) you could also use firewall rules:

<https://cloud.google.com/kubernetes-engine/docs/how-to/exposing-apps>

But if you already use oauth endpoints you should use them

We have a custom implementation, but yeah generally speaking as long as the UI forwards all original browser headers, that could work

well it does not forward custom headers set in the browser :confused:

yeah I’ve seen, I only filter gets to answer 200 directly because unfortunately that’s what our auth layer needs :confused: Apollo answers 400

maybe it’s just an nginx configuration issue

I use it in front of apollo to return 200 on `/`

is the response to `OPTIONS` actually used?

nah ok it’s a CORS stuff blocking the requests

ok I can deal with that thanks <@U014490S4EB>

nothing too fancy really:
```log_format custom '[$time_local] $http_x_forwarded_for - $remote_user - $remote_addr '
                  '"$request" $status $body_bytes_sent '
                  '"$http_referer" "$http_user_agent"';

server {

  listen                8080;
  access_log /dev/stdout custom;
  server_name           _;

  location ^~ /graphql {
    
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass_request_headers on;
    proxy_http_version 1.1;
    proxy_pass <http://prefect-service-core.prefect-service:4200/>;

  }

  location / {

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass_request_headers      on;
    proxy_http_version 1.1;
    proxy_pass <http://prefect-service-ui.prefect-service:8080>;
  }


}```
