Context Awareness about dashing-icinga2

[aledr]

Just thought a little bit about it in the weekend and restricted access to hosts and services in API side.
Goal achived, but that lead me to a new situation: Restrict access to dashing-icinga2 itself.
Have you already considered it? Is there any efforts in this direction? Maybe using icinga2-web users.

Thanks.

[dnsmichi]

Dashing itself doesn't provide those capabilities, and adding such via the application layer and patches is tremendously hard. Better use your own proxy (i.e. apache with proxy pass or nginx) and firewalls to prevent access.

The dashboards just receive data, either by polling (the icinga2 job) or pushed from remote with curl (not in this dashboard, but could be added). If you secure the data transport and user view layers, you're good to go without any local modifications.

Since you've found out about API permissions already, there's not much more to add. Restrict the application you're fetching data from, and build custom dashboards for different user groups and users defined in the Icinga 2 API.

If you are planning to use a different data backend, e.g. Icinga Web 2, you could look into possibilities to expose the roles and permissions from over there. This is a whole new dashboard job, and not the scope of this project. There might be community projects out there already doing so.