Operate

Security boundaries

Use OMLB’s security gate as one layer. Keep control-plane listeners local, protect secrets as files, and enforce network policy outside the proxy.

Per-client abuse gate

security:
  enabled: true
  allowlist:
    - 127.0.0.1
    - 10.42.0.0/16
  rate_limit_rps: 50
  rate_limit_burst: 100
  ban_paths: ["/.env", "/.git/", "/wp-login.php"]
  ban_duration: 1h
  max_strikes: 20
  strike_window: 5m
  strike_statuses: [404, 429]

The built-in gate runs before route selection, including for unknown hosts and paths. It can exempt trusted source CIDRs or addresses, apply per-IP token-bucket rate limiting, immediately ban requests containing a configured trap path (ASCII case-insensitive substring match), and ban after repeated configured response statuses inside a sliding window.

Set rate_limit_rps: 0 to disable rate limiting; set max_strikes: 0 to disable strike bans. Trap-path bans remain active if ban_paths is non-empty. Defaults include conservative scanner probes and treat 404/429 as strike statuses, not ordinary application 401/403 responses. Add paths only when they are never valid for your application.

Keep management local

The built-in admin API defaults to 127.0.0.1:9090; its metrics endpoint defaults to 127.0.0.1:9091. Both services refuse non-loopback bind addresses at runtime. The admin API has no authentication layer, so do not publish it. Use a local collector, SSH tunnel, or separately protected management network endpoint.

ssh -L 9090:127.0.0.1:9090 -L 9091:127.0.0.1:9091 operator@edge-host
curl http://127.0.0.1:9090/healthz
curl http://127.0.0.1:9091/metrics

Web UI token and overlay

webui:
  enabled: true
  address: "127.0.0.1:9095"
  token_file: /run/secrets/omlb-webui-token
  capture_logs: false
  overlay_path: /var/lib/omlb/omlb.webui.yaml

A loopback Web UI may run without a token, but a token file is recommended wherever the UI can be reached by other principals. A non-loopback Web UI requires an absolute token_file; missing, unreadable, or empty tokens fail closed. Its UI-managed changes are written to an overlay file, not the hand-maintained base YAML, and still pass the same validation and reload boundary.

TLS and operating-system controls

Use the TLS guide for TLS 1.2+ policy and optional downstream client-certificate authentication. Run the process under a dedicated account, give secret files narrow permissions, limit inbound ports with host firewall rules, and avoid placing tokens or private keys in YAML, command lines, or image layers.