Airlock Application Service proxies HTTP/HTTPS traffic to internal web applications: monitoring dashboards, CI/CD systems, wikis, Kubernetes Dashboard, and other services accessible only from a private network.
Users open applications through the Airlock web interface or at https://<app-name>.<proxy-domain>.
Prerequisites
- A running Airlock cluster (Auth + Proxy).
- A
*.airlock.example.comDNS record pointing to the Proxy Service (for application subdomains). - A TLS certificate for the Proxy Service and a wildcard certificate for application subdomains.
- A host, Docker container, or Kubernetes for the application and Application Service.
- Access to
airctl.
Step 1. Join token
airsh login --user=admin --proxy=airlock.example.com
airctl tokens add \
--type=app \
--app-name=grafana \
--app-uri=http://localhost:3000 \
--format=text > /tmp/tokenStep 2. Start the application
Example: Grafana in Docker:
docker run --detach --name grafana --publish 3000:3000 grafana/grafanaIn grafana.ini, set the Proxy Service domain:
[server]
domain = airlock.example.comExample: Grafana in Kubernetes:
helm repo add grafana https://grafana.github.io/helm-charts
helm install example-grafana grafana/grafana \
--create-namespace \
--namespace example-grafanaInternal cluster URI: http://example-grafana.example-grafana.svc.cluster.local.
Step 3. Application Service
Linux / Docker
sudo airlock configure \
--output=file \
--proxy=airlock.example.com:443 \
--token=/tmp/token \
--roles=app \
--app-name=grafana \
--app-uri=http://localhost:3000
sudo systemctl enable --now airlockConfiguration file
version: v3
airlock:
data_dir: /var/lib/airlock-app
auth_token: /tmp/token
proxy_server: airlock.example.com:443
app_service:
enabled: yes
apps:
- name: grafana
uri: http://localhost:3000
public_addr: grafana.airlock.example.com
labels:
env: prod
auth_service:
enabled: "no"
ssh_service:
enabled: "no"
proxy_service:
enabled: "no"sudo airlock start --config=/etc/airlock.yamlKubernetes
JOIN_TOKEN=$(cat /tmp/token)
helm install airlock-kube-agent airlock/airlock-kube-agent \
--create-namespace \
--namespace airlock-agent \
--set roles=app \
--set proxyAddr=airlock.example.com:443 \
--set authToken=${JOIN_TOKEN} \
--set "apps[0].name=grafana" \
--set "apps[0].uri=http://example-grafana.example-grafana.svc.cluster.local" \
--set "apps[0].labels.env=dev"Step 4. User and access
airctl users add --roles=access appuserAccess methods:
- Airlock web UI → Applications tab → Launch.
- Direct URL:
https://grafana.airlock.example.com.
Application name
The application name (--app-name) must be a valid subdomain: up to 63 characters, only a-z, 0-9, -.
After registration, the application is available at <app-name>.<proxy-host>, for example grafana.airlock.example.com. This can be overridden via public_addr in the configuration.
Additional options
Application under a subpath
- name: k8s-dashboard
uri: "http://10.0.1.60:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/"
public_addr: k8s.airlock.example.comRedirect rewriting
For applications with internal redirects:
- name: jenkins
uri: https://localhost:8001
public_addr: jenkins.airlock.example.com
rewrite:
redirect:
- localhost
- jenkins.internal.devSelf-signed application certificate
- name: app
uri: https://localhost:8443
public_addr: app.airlock.example.com
insecure_skip_verify: trueNot recommended for production.
Headers and JWT
Airlock can add headers to requests, including a JWT with user information:
- name: dashboard
uri: https://localhost:4321
public_addr: dashboard.airlock.example.com
rewrite:
headers:
- "Authorization: Bearer {{internal.jwt}}"Application logout
Force logout before the session expires:
https://grafana.airlock.example.com/airlock-logoutTCP applications
For non-HTTP applications (plain TCP), use TCP App Access — specify the TCP protocol in the Application Service configuration.
Access policies
Application access is controlled via RBAC (app_labels in roles). See Access policies.