Auth & TLS

Two toggles: API-key auth and TLS. Both live under [auth] and [tls] in the TOML.

API-key auth

Every request is required to carry Authorization: Bearer <key> when [auth] enabled = true. An admin key is auto-generated on first run if admin_api_key is blank, and written to a .api-key file next to the config.

$ cat /etc/xerj/.api-key
xk_7g8Hb3m2P4qRsT1vW9xY0zC5dE6fG7hJ

$ curl -H "Authorization: Bearer xk_7g8H..." \
    http://localhost:8080/v1/indices/logs/search -d @q.json

TLS

Terminate TLS at the server. PEM cert and key paths are required when enabled.

[tls]
enabled   = true
cert_path = "/etc/xerj/certs/xerj.crt"
key_path  = "/etc/xerj/certs/xerj.key"

Key rotation

Replace the file, reload:

$ sudo systemctl reload xerj

Network

bind_address defaults to 127.0.0.1: a node you have not configured is reachable from its own host and nowhere else. Set it (or pass --bind / XERJ_BIND_ADDRESS) to expose the node.

With tls.enabled = false, a non-loopback bind refuses to start — every listener would serve plain HTTP, putting the API key in every Authorization header on the wire. Either enable TLS, or declare the exposure with server.allow_insecure_network_bind = true when something in front of the node already terminates TLS. --insecure does not evade this: it clears tls.enabled, so it trips the same check.

Source · engine/crates/xerj-common/src/config.rs · engine/crates/xerj-api/src/auth.rs