Skip to content
Observy Observy

Secure Server Deployment

Observy alpha builds can be run on a server for evaluation. Dashboard authentication is mandatory. Dashboard HTTPS, OTLP/gRPC TLS, and ingestion authentication are optional runtime controls, but they are recommended when the instance is reachable beyond your local machine.

Use this page as the secure baseline for alpha testing on your own server.

For a server deployment:

  • Bootstrap the first administrator with OBSERVY_AUTH_BOOTSTRAP_USERNAME and OBSERVY_AUTH_BOOTSTRAP_PASSWORD.
  • Serve the dashboard over HTTPS, either directly from Observy or behind a TLS-terminating reverse proxy.
  • Set OBSERVY_DASHBOARD_COOKIE_SECURE=true when HTTPS terminates before traffic reaches Observy.
  • Enable OTLP/gRPC TLS with both certificate and private key paths.
  • Enable ingestion authentication with OBSERVY_INGESTION_AUTHENTICATION_ENABLED=true.
  • Create an ingestion key from /settings/authentication.
  • Configure collectors or SDKs to send Authorization: Bearer <secret> metadata.

First Administrator

A fresh data root needs first-run administrator credentials from environment variables:

Terminal window
export OBSERVY_AUTH_BOOTSTRAP_USERNAME='<administrator-name>'
export OBSERVY_AUTH_BOOTSTRAP_PASSWORD='<administrator-password>'
./observy

These values are used only when the first administrator is created. They are not YAML config keys or CLI flags. After the administrator exists, later bootstrap values are ignored; use the dashboard authentication settings page to change credentials.

Example Server Config

data_storage_root_dir: /var/lib/observy/data
otlp_grpc_port: 4317
web_port: 8080
storage_provider: sqlite


dashboard_cookie_secure: true
ingestion_authentication_enabled: true


web_tls_certificate_path: /etc/observy/tls/dashboard-chain.pem
web_tls_private_key_path: /etc/observy/tls/dashboard-key.pem
otlp_grpc_tls_certificate_path: /etc/observy/tls/otlp-chain.pem
otlp_grpc_tls_private_key_path: /etc/observy/tls/otlp-key.pem

Use paths and certificate material from your own deployment. If a reverse proxy terminates dashboard HTTPS, leave web_tls_certificate_path and web_tls_private_key_path empty, protect the upstream listener, and keep dashboard_cookie_secure: true.

Dashboard HTTPS

For direct HTTPS from Observy, provide both PEM paths:

Terminal window
OBSERVY_WEB_TLS_CERTIFICATE_PATH=/etc/observy/tls/dashboard-chain.pem \
OBSERVY_WEB_TLS_PRIVATE_KEY_PATH=/etc/observy/tls/dashboard-key.pem \
./observy

For a TLS-terminating reverse proxy:

Terminal window
OBSERVY_DASHBOARD_COOKIE_SECURE=true ./observy

Direct dashboard HTTPS automatically uses Secure cookies. The explicit cookie setting is for proxy deployments where the browser uses HTTPS but Observy receives upstream HTTP.

OTLP/gRPC TLS

OTLP/gRPC TLS is independent from dashboard HTTPS:

Terminal window
OBSERVY_OTLP_GRPC_TLS_CERTIFICATE_PATH=/etc/observy/tls/otlp-chain.pem \
OBSERVY_OTLP_GRPC_TLS_PRIVATE_KEY_PATH=/etc/observy/tls/otlp-key.pem \
./observy

Clients must trust the server certificate chain and use a TLS OTLP/gRPC endpoint. Do not configure an insecure OTLP client for a TLS-enabled Observy listener.

Ingestion Authentication

Enable ingestion authentication:

Terminal window
OBSERVY_INGESTION_AUTHENTICATION_ENABLED=true ./observy

Then sign in to the dashboard, open /settings/authentication, create an ingestion key, and store the one-time secret in your secret manager. Observy stores only verifier state and does not show the raw secret again.

Configure collectors or SDKs with Bearer metadata:

Terminal window
export OTEL_EXPORTER_OTLP_ENDPOINT=https://observy.example.com:4317
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_HEADERS='authorization=Bearer <ingestion-secret>'

Rotate keys by creating a replacement key, deploying the new secret to clients, confirming exports still arrive, and then revoking the old key from /settings/authentication.

Auth State And Backups

Authentication state is stored at:

{data_storage_root_dir}/auth/auth.db

This database contains administrator state, dashboard sessions, and ingestion-key verifiers. Protect it as credential state and include it in backups and restores alongside telemetry storage.

Current Exclusions

Current alpha builds do not include:

  • OIDC or external identity providers.
  • Multiple users or roles.
  • OTLP/HTTP ingestion.
  • mTLS for ingestion.
  • Automatic HTTPS certificate provisioning.

For alpha server testing, combine dashboard authentication, HTTPS, OTLP/gRPC TLS, and ingestion keys when the instance is reachable from other machines.