# Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to You under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. ## -- sureness.yml account source -- ## # config the resource restful api that need auth protection, base rbac # rule: api===method===role # eg: /api/v1/source1===get===[admin] means /api/v2/host===post support role[admin] access. # eg: /api/v1/source2===get===[] means /api/v1/source2===get can not access by any role. resourceRole: - /api/account/auth/refresh===post===[admin,user,guest] - /api/apps/**===get===[admin,user,guest] # the define yml routes persist the global collection templates # post can only add a new type, put overwrites an existing one and immediately # redispatches its collect job to every monitor already using it - hence admin only - /api/apps/**===post===[admin,user] - /api/apps/**===put===[admin] - /api/apps/**===delete===[admin] - /api/monitor/**===get===[admin,user,guest] - /api/monitor/**===post===[admin,user] - /api/monitor/**===put===[admin,user] - /api/monitor/**===delete===[admin] - /api/monitors/**===get===[admin,user,guest] - /api/monitors/**===post===[admin,user] - /api/monitors/**===put===[admin,user] - /api/monitors/**===delete===[admin] - /api/alert/**===get===[admin,user,guest] - /api/alert/**===post===[admin,user] - /api/alert/**===put===[admin,user] - /api/alert/**===delete===[admin] - /api/alerts/**===get===[admin,user,guest] - /api/alerts/**===post===[admin,user] - /api/alerts/**===put===[admin,user] - /api/alerts/**===delete===[admin] - /api/notice/**===get===[admin,user,guest] - /api/notice/**===post===[admin,user] - /api/notice/**===put===[admin,user] - /api/notice/**===delete===[admin] - /api/tag/**===get===[admin,user,guest] - /api/tag/**===post===[admin,user] - /api/tag/**===put===[admin,user] - /api/tag/**===delete===[admin] - /api/summary/**===get===[admin,user,guest] - /api/summary/**===post===[admin,user] - /api/summary/**===put===[admin,user] - /api/summary/**===delete===[admin] - /api/collector/**===get===[admin,user,guest] - /api/collector/**===post===[admin,user] - /api/collector/**===put===[admin,user] - /api/collector/**===delete===[admin] # the secret config holds the jwt signing key and the aes key protecting stored # credentials, so it stays admin only and is additionally refused by the controller - /api/config/secret===get===[admin] - /api/config/secret===post===[admin] # the mute toggle sits in the notification widget every signed in user sees - /api/config/mute===post===[admin,user,guest] - /api/config/**===get===[admin,user,guest] - /api/config/**===post===[admin] - /api/config/**===put===[admin] - /api/config/**===delete===[admin] # queue depth of the hertzbeat process itself, operational data - /api/metrics===get===[admin] # per account metric favourites rendered on the monitor pages - /api/metrics/**===get===[admin,user,guest] - /api/metrics/**===post===[admin,user,guest] - /api/metrics/**===delete===[admin,user,guest] - /api/label/**===get===[admin,user,guest] - /api/label/**===post===[admin,user] - /api/label/**===put===[admin,user] - /api/label/**===delete===[admin] # the storage availability probe is read by every monitor page, while the query # route forwards a raw promql expression straight to the time series database - /api/warehouse/**===get===[admin,user,guest] - /api/warehouse/query===post===[admin] - /api/v2/alerts===post===[admin,user] - /api/status/page/**===get===[admin,user,guest] - /api/status/page/**===post===[admin,user] - /api/status/page/**===put===[admin,user] - /api/status/page/**===delete===[admin] - /api/grafana/**===get===[admin,user,guest] - /api/grafana/**===post===[admin,user] - /api/grafana/**===put===[admin,user] - /api/grafana/**===delete===[admin] - /api/bulletin/**===get===[admin,user,guest] - /api/bulletin/**===post===[admin,user] - /api/bulletin/**===put===[admin,user] - /api/bulletin/**===delete===[admin] - /api/mcp/**===get===[admin] - /api/mcp/**===post===[admin] - /api/chat/**===get===[admin,user] - /api/chat/**===post===[admin] - /api/ai/**===get===[admin] - /api/ai/**===post===[admin] - /api/ai/**===put===[admin] - /api/ai/**===delete===[admin] - /api/otlp/v1/**===post===[admin,user] # deprecated 1.8.x OTLP log aliases, forwarded to /api/otlp/v1/logs, removed in 2.0 - /api/logs/otlp/**===post===[admin,user] - /api/logs/ingest/**===post===[admin,user] - /api/observability/logs===delete===[admin] - /api/observability/**===get===[admin,user,guest] # The OpenAPI document is a map of every route, parameter and model, so it is # scoped like any other administrative resource instead of being anonymous - /v3/api-docs/**===get===[admin] - /v3/api-docs.yaml===get===[admin] - /v3/api-docs.yaml/**===get===[admin] - /v2/api-docs/**===get===[admin] - /swagger-resources/**===get===[admin] # spring boot actuator exposes jvm, http and datasource internals for scraping - /actuator/**===get===[admin] # the alert stream carries full alert payloads and the manager stream carries import # progress; both are scoped like the log stream above rather than left anonymous - /api/alert/sse/**===get===[admin,user,guest] - /api/manager/sse/**===get===[admin,user,guest] # config the resource restful api that need bypass auth protection # rule: api===method # eg: /api/v1/source3===get means /api/v1/source3===get can be access by anyone, no need auth. excludedResource: - /api/account/auth/**===* - /api/i18n/**===get - /api/apps/hierarchy===get - /api/push/**===* - /api/status/page/public/**===* # web ui resource - /===get - /assets/**===get - /dashboard/**===get - /monitors/**===get - /alert/**===get - /account/**===get - /setting/**===get - /passport/**===get - /status/**===get - /log/**===get - /**/*.html===get - /**/*.js===get - /**/*.css===get - /**/*.ico===get - /**/*.ttf===get - /**/*.png===get - /**/*.gif===get - /**/*.jpg===get - /**/*.svg===get - /**/*.json===get - /**/*.woff===get - /**/*.eot===get # h2 database - /h2-console/**===* # account info config refer the https://hertzbeat.apache.org/docs/start/account-modify # eg: admin has role [admin,user], password is hertzbeat # eg: tom has role [user], password is hertzbeat # eg: lili has role [guest], plain password is lili, salt is 123, salted password is 1A676730B0C7F54654B0E09184448289 account: - appId: admin credential: hertzbeat role: [admin]