IP & CIDR Allowlist

Mon, 01 Jan 0001 00:00:00 +0000

IP & CIDR Allowlist

psLens supports network-level IP address and CIDR subnet restrictions. When enabled, incoming HTTP requests from IP addresses outside the allowlist are immediately blocked with an HTTP 403 Forbidden response before any session authentication or application routing takes place.

Configuration

Add the security.ipAllowlist block to your config.yaml:

security:
 ipAllowlist:
 enabled: true
 allowedCIDRs:
 - "203.0.113.50" # Single corporate static IP
 - "198.51.100.0/24" # Office subnet
 - "10.0.0.0/8" # Internal VPC / VPN network
 - "2001:db8::/32" # IPv6 block
 trustForwardHeaders: true # Enable when running behind reverse proxies / CDN (Fly.io, Cloudflare, AWS ALB)

Reverse Proxy & Cloud Ingress (`trustForwardHeaders`)

When psLens runs behind a reverse proxy, load balancer, or cloud provider (e.g. Fly.io, Cloudflare, AWS Application Load Balancer), client requests terminate at the proxy. Setting trustForwardHeaders: true enables client IP inspection in the following precedence:

SSO & OIDC Discovery

Mon, 01 Jan 0001 00:00:00 +0000

Single Sign-On (SSO) with OpenID Connect

psLens supports native Single Sign-On (SSO) via OpenID Connect (OIDC). Instead of manually entering authorization and token endpoints in YAML files, psLens provides an automated discovery tool at /settings/auth that queries /.well-known/openid-configuration directly from your Identity Provider.

Setting Up Single Sign-On in psLens

Navigate to Settings → Authentication & SSO (/settings/auth).
Set the login method to Native OIDC / Single Sign-On.
Choose your Identity Provider preset or enter the Issuer URL:

Administration on psLens

IP & CIDR Allowlist