Skip to main content

Binaries

This document covers how to configure and run Pomerium using the official prebuilt binaries.

Prerequisites

Download

You can download the latest release from GitHub, or use the repositories we provide through Cloudsmith. In addition to the easy updates provided by the package manager, the deb and rpm packages include systemd service unit configurations.

Operating System Packages

Through Cloudsmith, we provide OS packages for Linux distributions using deb and rpm style package managers. Select your system's package format and architecture, then use the Setup tab to add the repository to your package manager.

Standalone Binary

Download the latest release of Pomerium for your machine's operating system and architecture.

Configure

Pomerium supports setting configuration variables using both environmental variables and using a configuration file.

Configuration file

When using our OS packages, we provide a default configuration at /etc/pomerium/config.yaml. Otherwise, create the config file (config.yaml) in your preferred location.

This file will be used to determine Pomerium's configuration settings, routes, and access-policies. Consider the following example:

# See detailed configuration settings : https://www.pomerium.com/docs/reference/

# this is the domain the identity provider will callback after a user authenticates
authenticate_service_url: https://authenticate.localhost.pomerium.io

# certificate settings: https://www.pomerium.com/docs/reference/certificates.html
autocert: true
# REMOVE FOR PRODUCTION
autocert_use_staging: true

# If you're using mkcert to test Pomerium locally, comment the autocert keys and uncomment
# the keys below, adjusting for your mkcert path:
# certificate_file: /home/user/.local/share/mkcert/rootCA.pem
# certificate_key_file: /user/alex/.local/share/mkcert/rootCA-key.pem

# identity provider settings : https://www.pomerium.com/docs/identity-providers.html
idp_provider: google
idp_client_id: REPLACE_ME
idp_client_secret: REPLACE_ME

# Generate 256 bit random keys e.g. `head -c32 /dev/urandom | base64`
cookie_secret: WwMtDXWaRDMBQCylle8OJ+w4kLIDIGd8W3cB4/zFFtg=

# https://pomerium.io/reference/#routes
routes:
- from: https://verify.localhost.pomerium.io
to: https://verify.pomerium.com
policy:
- allow:
or:
- email:
is: user@example.com
pass_identity_headers: true

You can also set some or all of your configuration keys as environment variables, in an env file for example. See the Reference page to identify the environment variable for each configuration option.

Run

OS Package

  1. The following command allows the Pomerium systemd service to bind to privileged port 443:

    echo -e "[Service]\nAmbientCapabilities=CAP_NET_BIND_SERVICE" | sudo SYSTEMD_EDITOR=tee systemctl edit pomerium
  2. Enable and start the service:

    sudo systemctl enable --now pomerium.service

Manual Installation

Source the configuration env file, if present, and run pomerium specifying the config.yaml .

./bin/pomerium -config config.yaml

Browse to external-verify.your.domain.example. Connections between you and verify will now be proxied and managed by Pomerium.