krzysztof/landing_page
1
0
Fork 0
mirror of https://github.com/qdrant/landing_page.git synced 2026-10-04 02:18:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improved Nested Docs and Link Grouping Support (#147)

Browse Source 
* added a table of content

* wide layout for docs, styles for the table of content

* fixes for docs layout

* wide footer at the docs section

* added support for nested docs, added toggling groups of links, delimiters, external links

* external link icon

* added active state for nested links, styles for the external link icon

* styles fix

* remove doc sync

* update directory structure and doc titles

* fix outstanding links

* fix more links for merge

* Revert "fix more links for merge"

This reverts commit 46c9ccaf1b7765f2cda8dc85d625fa6b4e3f5436.

* Revert "fix outstanding links"

This reverts commit 28e6380b74f1ab74690c8184551f186656d6d4e9.

* fix remaining broken links

* move how-to tutorials in the different page

* split tutorials

* fix link

* upd github edit link

* skip empty index pages

---------

Co-authored-by: Andrey Vasnetsov <andrey@vasnetsov.com>
Co-authored-by: David Sertic <62056091+davidmyriel@users.noreply.github.com>
This commit is contained in:
trean
2023-05-29 15:11:40 +02:00
committed by GitHub
co-authored by Andrey Vasnetsov David Sertic
parent b9874e5c56
commit 3215985d1d
60 changed files with 734 additions and 421 deletions
Download Patch File Download Diff File Expand all files Collapse all files
qdrant-landing/content/documentation/security.md
-142
View File
@@ -1,142 +0,0 @@
---
title: Security
weight: 165
---
There are various ways to secure your own Qdrant instance.
## Authentication
*Available as of v1.2.0*
Qdrant supports a simple form of client authentication using a static API key.
This can be used to secure your instance.
To enable API key based authentication in your own Qdrant instance you must
specify a key in the configuration:
```yaml
service:
# Set an api-key.
# If set, all requests must include a header with the api-key.
# example header: `api-key: <API-KEY>`
#
# If you enable this you should also enable TLS.
# (Either above or via an external service like nginx.)
# Sending an api-key over an unencrypted channel is insecure.
api_key: your_secret_api_key_here
```
<aside role="alert"><a href="#tls">TLS</a> must be used to prevent leaking the API key over an unencrypted connection.</aside>
For using API key based authentication in Qdrant cloud see the cloud
[Authentication](https://qdrant.tech/documentation/cloud/cloud-quick-start/#authentication)
section.
The API key then needs to be present in all REST or gRPC requests to your instance.
All official Qdrant clients for Python, Go, and Rust support the API key parameter.
<!---
Examples with clients
-->
```bash
curl \
-X GET https://localhost:6333 \
--header 'api-key: your_secret_api_key_here'
```
```python
from qdrant_client import QdrantClient
qdrant_client = QdrantClient(
url="https://localhost",
port=6333,
api_key="your_secret_api_key_here",
)
```
## TLS
*Available as of v1.2.0*
TLS for encrypted connections can be enabled on your Qdrant instance to secure
connections.
<aside role="alert">Connections are unencrypted by default. This allows sniffing and <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">MitM</a> attacks.</aside>
First make sure you have a certificate and private key for TLS, usually in
`.pem` format. On your local machine you may use
[mkcert](https://github.com/FiloSottile/mkcert#readme) to generate a self signed
certificate.
To enable TLS, set the following properties in the Qdrant configuration with the
correct paths and restart:
```yaml
service:
# Enable HTTPS for the REST and gRPC API
enable_tls: true
# TLS configuration.
# Required if either service.enable_tls or cluster.p2p.enable_tls is true.
tls:
# Server certificate chain file
cert: ./tls/cert.pem
# Server private key file
key: ./tls/key.pem
```
For internal communication when running cluster mode, TLS can be enabled with:
```yaml
cluster:
# Configuration of the inter-cluster communication
p2p:
# Use TLS for communication between peers
enable_tls: true
```
With TLS enabled, you must start using HTTPS connections. For example:
```bash
curl -X GET https://localhost:6333
```
```python
from qdrant_client import QdrantClient
qdrant_client = QdrantClient(
url="https://localhost",
port=6333,
)
```
Certificate rotation is enabled with a default refresh time of one hour. This
reloads certificate files every hour while Qdrant is running. This way changed
certificates are picked up when they get updated externally. The refresh time
can be tuned by changing the `tls.cert_ttl` setting. You can leave this on, even
if you don't plan to update your certificates.
Optionally, you can enable client certificate validation on the server against a
local certificate authority. Set the following properties and restart:
```yaml
service:
# Check user HTTPS client certificate against CA file specified in tls config
verify_https_client_certificate: false
# TLS configuration.
# Required if either service.enable_tls or cluster.p2p.enable_tls is true.
tls:
# Certificate authority certificate file.
# This certificate will be used to validate the certificates
# presented by other nodes during inter-cluster communication.
#
# If verify_https_client_certificate is true, it will verify
# HTTPS client certificate
#
# Required if cluster.p2p.enable_tls is true.
ca_cert: ./tls/cacert.pem
```