---
title: "Harden an instance"
summary: "TLS, operations access, account policy and secret delivery."
description: "Restrict network access and protect credentials on a Pitot instance."
status: preview
read_when:
  - "You are preparing an instance for shared or remote access."
---
## Protect the listener

Pitot serves plaintext by default. Configure `PITOT_TLS_CERT_FILE` and
`PITOT_TLS_KEY_FILE` together, or terminate TLS at a reverse proxy. Direct TLS
uses TLS 1.3. Set `PITOT_PUBLIC_URL` to the stable external HTTPS origin.
See [TLS](/docs/guides/tls) for HTTP/2 and proxy setup.

Native installs bind `127.0.0.1:7520`; the image binds `:7520`. Restrict host
port publishing and firewall rules. Browser, API, MCP and both OTLP transports
share that listener. Follow the [network surface](/docs/reference/endpoints#restrict-the-network-surface)
notes to keep ingest private and route public SDKs through a gateway.

Trust forwarded client addresses only from your proxy networks with
`PITOT_TRUSTED_PROXY_CIDRS`. Never use `0.0.0.0/0`.

## Restrict operations access

Keep `/metrics` private or set `PITOT_METRICS_TOKEN` for authenticated scrapes.
An administrator browser session can also read it. Leave
`PITOT_METRICS_PUBLIC=false`; enabling it permits unauthenticated scrapes.

Leave `PITOT_PPROF_ENABLED=false` unless profiling is needed. When enabled,
`/debug/pprof/*` still requires `operations:read`, available only to admins.
Profiles can contain memory contents. Health and readiness probes require no
credential. See [endpoints](/docs/reference/endpoints).

## Choose an account policy

Keep local self-signup off unless any verified email address should receive a
viewer account. `PITOT_SELF_SIGNUP=true` requires SMTP. Viewers can query all
telemetry and run the built-in agent, which can incur provider charges.

Each instance is one trust domain. Namespaces filter queries and do not isolate
access. Run separate instances for mutually untrusted teams. Dashboards and
chat threads belong to their owners. See [authentication](/docs/concepts/authentication)
for OIDC eligibility, suspension and access revocation.

## Deliver secrets

Supply secret settings through runtime injection or managed mounts with their
`_FILE` variables. Set only one nonempty form. Restrict mount access at the
platform layer; Pitot does not check file modes. See
[secret settings](/docs/reference/configuration#secrets).

Keep the setup URL, login links, session cookies and ingest token out of public
logs and tickets. Restrict access to startup logs until setup is complete.
Use the [ingest rotation procedure](/docs/get-started/send-telemetry#the-ingest-token)
if a token is lost or exposed: create a replacement, then revoke the exposed one.

Report vulnerabilities privately through
[SECURITY.md](https://github.com/labstack/pitot/blob/main/SECURITY.md).