In addition to securely exposing Services publicly via the BeyondCorp access mode (read more here), Octelium also enables you to completely publicly expose HTTP-based Services (namely HTTP, GRPC and WEB Service modes) to anonymous access, eliminating access control for such Services. This allows you to effectively use Octelium as a hosting platform where you can publicly expose Services to the public internet whose upstreams might be served from anywhere (e.g anywhere behind NAT such as your laptop, private clouds, etc...), as well as a self-hosted PaaS for containerized applications that are deployed and managed by Octelium itself (read more about managed containers here).

To enable the anonymous public mode, you only need to enable the isPublic and isAnonymous fields as follows:

1
kind: Service
2
metadata:
3
  name: svc1
4
spec:
5
  mode: HTTP
6
  config:
7
    upstream:
8
      url: http://nginx.local
9
  isPublic: true
10
  isAnonymous: true

Anonymous Authorization

Starting from v0.28.0, Octelium can now provide anonymous authorization via the enableAnonymous boolean flag. This effectively enables anonymous Services to operate as web application firewalls (WAF) and control access based on the request's path, method, headers (e.g. user agent), query parameters, and body content, including serialized JSON body content. Here is an example:

1
kind: Service
2
metadata:
3
  name: svc1
4
spec:
5
  mode: HTTP
6
  isPublic: true
7
  isAnonymous: true
8
  config:
9
    upstream:
10
      url: https://example.com
11
  authorization:
12
    enableAnonymous: true
13
    inlinePolicies:
14
      - spec:
15
          rules:
16
          - effect: ALLOW
17
            condition:
18
              all:
19
                of:
20
                - match: ctx.request.http.method in ["GET", "POST", "PUT", "DELETE"]
21
                - match: ctx.request.http.path.startsWith("/apis")
22
                - match: ctx.request.http.uri == "/apis/users?name=john"
23
                - match: ctx.request.http.queryParams.name == "john"
24
                - match: ctx.request.http.headers["x-custom-header"] == "this-value"
25
                - match: ctx.request.http.scheme == "http"
26
                - match: string(ctx.request.http.body).toLower().contains("value1")
27
                - match: ctx.request.http.bodyMap.key1 == "value1"

As is the case with the default authenticated authorization, anonymous authorization, when enabled, denies all requests by default (i.e. a status code of 403 is returned). That means the request is denied if no rule matches.

Public DNS and TLS Certificate

Since public Services are exposed to the internet, you need to set the public DNS and TLS certificate of the Service. You can read more about managing public DNS here and TLS certificates here.