Pomerium is an open-source identity-aware access proxy that provides secure access to internal applications and services no matter where an individual is located. It provides authorization policies that the owner can use to grant or deny access depending on a user’s identity.
This tutorial will cover how to install Pomerium on NixOS Latest, a unique operating system with a functional package manager called Nix.
Before you move further, ensure that you have the following prerequisites:
Use the following command to update your Nix system packages:
sudo nix-channel --update && sudo nixos-rebuild switch
To install Pomerium on NixOS, follow the below steps:
Add the Pomerium channel using the following command:
sudo nix-shell -p curl --run "curl -L https://nixos.org/channels/nixos-unstable/pkgs/development/go-modules/pomerium/channel.nix > pomerium-channel.nix"
After installing curl, import Pomerium channel with the below command:
sudo nix-env -iA nixos.pomerium -f ./pomerium-channel.nix
Follow the below steps to configure Pomerium on NixOS:
Access the system configuration file and add custom policies depending on the application access needs:
sudo vi /etc/nixos/configuration.nix
services.pomerium = {
enable = true;
extraConfig = ''
policies:
- from: https://dashboard.example.com
to: https://dashboard.example.com:80
allowed_users:
- email: admin@example.com
groups:
- admins
'';
};
Save and close the configuration file, then run the below command to reload the configuration:
sudo nixos-rebuild switch
The above command will generate a new Pomerium configuration based on your customized policy.
Navigate to your specified application URL, and Pomerium will redirect to the identity provider for authentication before granting access. If authentication succeeds, Pomerium allows access to the protected resource.
Open a web browser and enter localhost:3000 or IP:3000 on the address bar. If you are redirected to the authentication page, that means Pomerium is working correctly.
This guideline has explained how to install Pomerium and configure it on NixOS. You can start securing your applications and services by customizing the policies defined.
If you want to self-host in an easy, hands free way, need an external IP address, or simply want your data in your own hands, give IPv6.rs a try!
Alternatively, for the best virtual desktop, try Shells!