How to disable API key check for ingestion port

[geirih]

Hi. We need to be able to ingest logs on port 5341 without requiring an API key, while still having normal security on the UI (port 80). Is this supported, and if so, how should I configure SEQ to achieve this ?

[KodrAus]

Hi @geirih. Unfortunately it's not possible to configure the ingestion port with different API key requirements to the regular API port. Something you may be able to do is set up a reverse proxy like NGINX that adds the X-Seq-ApiKey header using an API key that's effectively your unauthenticated ingestion traffic.

[geirih]

Thank you for your response.
I'm trying to set up a scriptet setup of SEQ, fluent bit and our pods, and need to install SEQ, install fluent bit and make sure logs are received by SEQ without human intervention in the setup process.

If I must have the same security on both ports, then I have to disable all security and handle gui security by a nginx instance before SEQ apparently.

I have checked if there is a way to automatically generate an api key from SEQ in my scripts, but I do not have access to the password from my k8s scripts, and I do not want to hardcode it there. If I was able to fetch the password from the install process somehow, I could probably use curl to generate an API key.

Do you have any examples of achieving this, or how I turn off all security for my first alternative ?

[liammclennan]

Hi @geirih

I think the getting started example does what you want. It starts Seq with authentication enabled for the UI on port 80 and open ingestion on port 5341.

[geirih]

Yes, this is what I'm trying to do, but as far as I can tell the documentation you point to does not show this. I've done a text search for "authentication" on that page, and the 4 hits I get talks about enabling authentication. Basically all it says on this issue is:
Enabling authentication
If you specified an initial password for the admin account on the docker run command-line, authentication will already be enabled.

If not, your next step should be visiting Settings > Users and enabling authentication.

Are we looking at the same document (https://docs.datalust.co/docs/getting-started-with-docker) ? Or am I partly blind ? :-)

[liammclennan]

Hi @geirih

Your initial request was "We need to be able to ingest logs on port 5341 without requiring an API key, while still having normal security on the UI (port 80)."

If you follow the instructions on that page:

PH=$(echo '<password>' | docker run --rm -i datalust/seq config hash)

mkdir -p <local path to store data>

docker run \
  --name seq \
  -d \
  --restart unless-stopped \
  -e ACCEPT_EULA=Y \
  -e SEQ_FIRSTRUN_ADMINPASSWORDHASH="$PH" \
  -v <local path to store data>:/data \
  -p 5341:80 \
  datalust/seq

then you should be able to ingest logs on port 5341 without requiring an API key, while still having normal security on the UI (port 80). Have you tried it and seen something different?

[geirih]

I am setting up this in K8S, so I cant use docker like this. We already have a SEQ instance running, with plenty of logs in it but I'm trying to introduce fluentbit into this setup. I can try this first run method locally, but from what I read in the documentation, once you add security on the UI port, it will be applied to the ingest port as well.

[geirih]

I just tried, and as you said, doing this docker setup allowes the UI to have a password, and the ingestion to be open. but in this docker setup, both the UI and the ingestion are both on port 5341, and it is not a separate UI port. I will try to modify the docker example with a dedicated UI port. But the question still remains on how I can configure my running SEQ with UI on port 80 and ingestion on port 5341 to not require API key on port 5341.

[liammclennan]

There is no UI port. There is the set of URIs, and their ports, that Seq listens to and there is the set of ports (possibly empty) that are restricted to ingestion.

You don't even really need an ingestion only port. You just need to set the RequireApikeyForWritingEvents setting to false, which you can do via the API.

[geirih]

So, I found out that there is a setting in seq found here http://localhost/#/settings/api-keys called "Require authentication for HTTP/S ingestion". Disabling this setting solved my issue.

[liammclennan]

That's great. Thanks for letting us know.

[geirih]

please update your documentation on how to enable/disable API key requierment.
Also, is there an install parameter to disable this. You should have an install time parameter to enable/disable this setting.

[liammclennan]

Ingestion authentication is disabled by default. It is enabled via the settings API.

[geirih]

Yes, but the documentation about this important point is lacking, and there should be a config value to enable it during installation for those who want, and make sure it is not enabled for thos who dows not want it. Then it is explisit, not a default value we dont know about.

[liammclennan]

Thanks. We will review the documentation and see if it can be made clearer.