Skip to main content

Share the local console on a team server

vulkro-sf serve normally runs the local console on your own machine, on loopback. You can also run one console on a shared server so a small team opens it in their browsers.

export VULKRO_SERVE_TOKEN="$(openssl rand -hex 24)"   # keep it in your secret store
export VULKRO_SF_BIND=127.0.0.1                       # the reverse proxy reaches it on loopback
export VULKRO_SF_PORT=8923
export VULKRO_SF_DATA_DIR=/var/lib/vulkro-sf
vulkro-sf serve --no-browser

It is the same vulkro-sf binary: it sends no source, metadata or findings anywhere. Set VULKRO_OFFLINE=1 to block every outbound call. Install it with the normal installer and run it from your service manager (for example systemd) as a non-root user that owns the data directory.

Settings​

VariableDefaultPurpose
VULKRO_SERVE_TOKENA new random token per startThe access token. Required for any non-loopback bind. Sign in with it on the console page, or open <console address>/?token=<token>.
VULKRO_SF_BIND127.0.0.1Bind address. 0.0.0.0 exposes it on the network, and is refused without a token.
VULKRO_SF_PORTA free portFixed port. --port overrides it.
VULKRO_SF_DATA_DIR~/.vulkro-sf/dataSQLite database and state. Put it on a backed-up disk.
VULKRO_SERVE_ALLOWED_HOSTSnoneExtra hosts (for example sf.internal:8443) whose Origin is accepted, for a proxy that rewrites Host.

A browser that presents the token gets an HttpOnly, SameSite=Strict session cookie; scripts send Authorization: Bearer <token>. No token gets HTTP 401, a request from another web page gets 403. Rotating the token signs everyone out.

Reverse proxy​

Keep the console on loopback or an internal network. Put a reverse proxy in front that listens on 443, terminates TLS, can add your own single sign-on, and forwards to the console. Publish only the proxy.

Limits​

  • One shared state. Everyone with the token sees the same projects, scans and triage. There are no per-user accounts.
  • Point in time. Scans run when someone runs them; live-org reads go through the sf CLI on the server.
  • You run it. Upgrade with vulkro-sf update and restart the service.

For per-user roles, single sign-on and scheduled scans of every org, see Vulkro Cloud or Vulkro Cloud on your own servers.

Exit codes​

0 served and shut down cleanly; 2 error (bad bind address, a network bind without a token, port in use, data directory not writable).

Last updated on