Earlier command and setup reference · Engine 18.6.0rc590 / Reader 8.11.0rc649
Definition
Reader authentication and HTTPS settings: BASIC_AUTH (user:password), BEARER_TOKEN, PROXY_AUTH_HEADER with TRUSTED_PROXIES, REQUIRE_AUTH=1, and ALLOW_HEALTHZ=0 to put /healthz behind authentication.
Use the full environment-variable names
The names in the definition are suffixes. For example, the documented authentication requirement is OBSERVATORY_READER_REQUIRE_AUTH=1, and OBSERVATORY_READER_ALLOW_HEALTHZ=0 puts the health endpoint behind authentication.
The supported authentication choices include OBSERVATORY_READER_BASIC_AUTH with a user:password value, OBSERVATORY_READER_BEARER_TOKEN, or a proxy-authentication header paired with OBSERVATORY_READER_TRUSTED_PROXIES. Choose the option that matches how the Reader will actually receive requests.
Check the deployment boundary
A proxy header is meaningful only with the declared trusted-proxy setup. Do not treat the presence of an arbitrary incoming header as proof of identity. The Reader installation guide covers the public origin, HTTPS proxy and command options. Confirm access both to a normal page and to /healthz using the intended authentication.