Harden an instance

Protect the listener

Pitot serves plaintext by default. Configure PITOT_TLS_CERT_FILE and PITOT_TLS_KEY_FILE together, or terminate TLS at a reverse proxy. Direct TLS uses TLS 1.3. Set PITOT_PUBLIC_URL to the stable external HTTPS origin. See TLS for HTTP/2 and proxy setup.

Native installs bind 127.0.0.1:7520; the image binds :7520. Restrict host port publishing and firewall rules. Browser, API, MCP and both OTLP transports share that listener. Follow the network surface notes to keep ingest private and route public SDKs through a gateway.

Trust forwarded client addresses only from your proxy networks with PITOT_TRUSTED_PROXY_CIDRS. Never use 0.0.0.0/0.

Restrict operations access

Keep /metrics private or set PITOT_METRICS_TOKEN for authenticated scrapes. An administrator browser session can also read it. Leave PITOT_METRICS_PUBLIC=false; enabling it permits unauthenticated scrapes.

Leave PITOT_PPROF_ENABLED=false unless profiling is needed. When enabled, /debug/pprof/* still requires operations:read, available only to admins. Profiles can contain memory contents. Health and readiness probes require no credential. See endpoints.

Choose an account policy

Keep local self-signup off unless any verified email address should receive a viewer account. PITOT_SELF_SIGNUP=true requires SMTP. Viewers can query all telemetry and run the built-in agent, which can incur provider charges.

Each instance is one trust domain. Namespaces filter queries and do not isolate access. Run separate instances for mutually untrusted teams. Dashboards and chat threads belong to their owners. See authentication for OIDC eligibility, suspension and access revocation.

Deliver secrets

Supply secret settings through runtime injection or managed mounts with their _FILE variables. Set only one nonempty form. Restrict mount access at the platform layer; Pitot does not check file modes. See secret settings.

Keep the setup URL, login links, session cookies and ingest token out of public logs and tickets. Restrict access to startup logs until setup is complete. Use the ingest rotation procedure if a token is lost or exposed: create a replacement, then revoke the exposed one.

Report vulnerabilities privately through SECURITY.md.