On-Prem Connections

When to Set Up On-Prem Connections

Your data sources are behind a firewall. NOFire cannot reach them directly, and you need metrics, logs, or traces to reason about your production systems.
Credentials must stay inside your network. The Edge Proxy reads tokens and passwords from Kubernetes Secrets at runtime. They never leave your cluster.
You want a single Helm release. Adding onPremConnections to your existing Edge values deploys the Edge Proxy alongside Edge. No separate chart or namespace needed.

If your data sources are already accessible from the internet (e.g., Grafana Cloud, Datadog), connect them directly through Integrations. This page is for data sources that NOFire cannot reach directly.

Quick Setup (Single Data Source)

1. Create the API Key Secret

If you already have a nofire-credentials secret from your Edge deployment, skip this step.

kubectl create secret generic nofire-credentials \
  --from-literal=api-key=YOUR_API_KEY \
  -n nofire-system

2. Create a Connector Secret

Create a Kubernetes Secret with the credentials for your data source. This example uses a Prometheus bearer token:

kubectl create secret generic prometheus-creds \
  --from-literal=token=YOUR_PROMETHEUS_TOKEN \
  -n nofire-system

The supported secret keys are token (for bearer auth), username and password (for basic auth). The proxy reads whichever keys are present.

3. Deploy

Create a values-quickstart.yaml:

config:
  kube:
    clusterName: "my-cluster"

edgeProxy:
  stream:
    serverAddress: "my.nofire.ai:443"

onPremConnections:
  prod-prometheus:
    type: prometheus
    name: "Production Prometheus"
    secretName: prometheus-creds
    url: "http://prometheus.monitoring:9090"

Deploy with Helm:

helm repo add nofire https://nofireai.github.io/edge-helm-chart
helm repo update

helm upgrade --install nofire-edge nofire/nofire-edge \
  -f values-quickstart.yaml \
  -n nofire-system --create-namespace

4. Verify

Check that the edge-proxy pod is running:

kubectl get pods -l app.kubernetes.io/component=edge-proxy -n nofire-system

Check the logs for a successful handshake with NOFire:

kubectl logs -l app.kubernetes.io/component=edge-proxy -n nofire-system | grep "StreamAck"

You should see StreamAck received: STATUS_OK with an edge_instance_id. Verify the health endpoint:

kubectl exec -it deploy/nofire-edge-edge-proxy -n nofire-system -- \
  wget -qO- http://localhost:8081/healthz

Production Setup (Multiple Data Sources)

Create Secrets for Each Data Source

The proxy reads credentials from Kubernetes Secrets mounted as files. Create a Secret for each data source that requires authentication.

Bearer Token Auth

For Prometheus, Loki, Tempo, Grafana, OpenSearch, and Alertmanager:

kubectl create secret generic prometheus-creds \
  --from-literal=token=YOUR_BEARER_TOKEN \
  -n nofire-system

Basic Auth

For backends that require username and password:

kubectl create secret generic loki-creds \
  --from-literal=username=admin \
  --from-literal=password=YOUR_PASSWORD \
  -n nofire-system

Elasticsearch ApiKey Auth

For Elasticsearch, store the ApiKey in the token field. The proxy sends it as Authorization: ApiKey <token>:

kubectl create secret generic elasticsearch-creds \
  --from-literal=token=YOUR_ELASTICSEARCH_API_KEY \
  -n nofire-system

OpenSearch uses the same connector but sends Authorization: Bearer <token> instead.

MongoDB Atlas Digest Auth

MongoDB Atlas uses HTTP digest authentication with a public/private key pair:

kubectl create secret generic mongodb-atlas-creds \
  --from-literal=username=YOUR_PUBLIC_KEY \
  --from-literal=password=YOUR_PRIVATE_KEY \
  -n nofire-system

MongoDB Atlas has a built-in rate limiter (95 requests/minute). The proxy enforces this automatically.

Honeycomb API Key

Honeycomb is reachable over the internet, but routing it through the Edge Proxy keeps the API key inside your cluster instead of storing it in NOFire. Store the key in the token field; the proxy sends it as the X-Honeycomb-Team header:

kubectl create secret generic honeycomb-creds \
  --from-literal=token=YOUR_HONEYCOMB_API_KEY \
  -n nofire-system

This is the in-cluster route. If your team is fine sending the API key to NOFire directly, use the Honeycomb integration instead — no Edge Proxy needed.

Configure Connectors

Create a values.yaml with all your data sources:

config:
  kube:
    clusterName: "production-cluster"

edgeProxy:
  stream:
    serverAddress: "my.nofire.ai:443"

onPremConnections:
  prod-prometheus:
    type: prometheus
    name: "Production Prometheus"
    secretName: prometheus-creds
    url: "http://prometheus.monitoring:9090"

  prod-loki:
    type: loki
    name: "Production Loki"
    secretName: loki-creds
    url: "http://loki.monitoring:3100"
    orgId: "tenant1"

  prod-tempo:
    type: tempo
    name: "Production Tempo"
    secretName: tempo-creds
    url: "http://tempo.monitoring:3200"

  prod-grafana:
    type: grafana
    name: "Production Grafana"
    secretName: grafana-creds
    url: "http://grafana.monitoring:3000"

  prod-elasticsearch:
    type: elasticsearch
    name: "Production Elasticsearch"
    secretName: elasticsearch-creds
    url: "https://elasticsearch.logging:9200"
    index: "app-logs-*"

  prod-alertmanager:
    type: alertmanager
    name: "Production Alertmanager"
    secretName: alertmanager-creds
    url: "http://alertmanager.monitoring:9093"

  prod-mongodb-atlas:
    type: mongodb_atlas
    name: "Production MongoDB Atlas"
    secretName: mongodb-atlas-creds
    url: "https://cloud.mongodb.com/api/atlas/v2"

  prod-honeycomb:
    type: honeycomb
    name: "Production Honeycomb"
    secretName: honeycomb-creds
    url: "https://api.honeycomb.io"   # US default; use https://api.eu1.honeycomb.io for EU

Deploy

helm upgrade --install nofire-edge nofire/nofire-edge \
  -f values.yaml \
  -n nofire-system --create-namespace

Configure Connector TLS

If your data sources use TLS (self-signed or internal CA), configure TLS per connector:

onPremConnections:
  prod-elasticsearch:
    type: elasticsearch
    secretName: elasticsearch-creds
    url: "https://elasticsearch.logging:9200"
    tlsEnabled: true
    caCertPath: "/etc/ssl/certs/internal-ca.crt"

Setting tlsSkipVerify: true disables certificate verification. Use this only for testing. In production, provide a CA certificate with caCertPath.

Verify the Connection

Check Pod Status

kubectl get pods -l app.kubernetes.io/component=edge-proxy -n nofire-system

The pod should be in Running state with 1/1 ready.

Check Handshake Logs

kubectl logs -l app.kubernetes.io/component=edge-proxy -n nofire-system | grep "StreamAck"

A successful connection shows:

StreamAck received: STATUS_OK  edge_instance_id=<id>  protocol_version=1

Check Health Endpoint

kubectl exec -it deploy/nofire-edge-edge-proxy -n nofire-system -- \
  wget -qO- http://localhost:8081/healthz

Check Metrics

kubectl exec -it deploy/nofire-edge-edge-proxy -n nofire-system -- \
  wget -qO- http://localhost:8081/metrics | grep nofire_proxy

Get Started

Skills

Platform Features

Setup & Integrations

Security

On-Prem Connections

When to Set Up On-Prem Connections

Quick Setup (Single Data Source)

1. Create the API Key Secret

2. Create a Connector Secret

3. Deploy

4. Verify

Production Setup (Multiple Data Sources)

Create Secrets for Each Data Source

Bearer Token Auth

Basic Auth

Elasticsearch ApiKey Auth

MongoDB Atlas Digest Auth

Honeycomb API Key

Configure Connectors

Deploy

Configure Connector TLS

Verify the Connection

Check Pod Status

Check Handshake Logs

Check Health Endpoint

Check Metrics

​When to Set Up On-Prem Connections

​Quick Setup (Single Data Source)

​1. Create the API Key Secret

​2. Create a Connector Secret

​3. Deploy

​4. Verify

​Production Setup (Multiple Data Sources)

​Create Secrets for Each Data Source

​Bearer Token Auth

​Basic Auth

​Elasticsearch ApiKey Auth

​MongoDB Atlas Digest Auth

​Honeycomb API Key

​Configure Connectors

​Deploy

​Configure Connector TLS

​Verify the Connection

​Check Pod Status

​Check Handshake Logs

​Check Health Endpoint

​Check Metrics

When to Set Up On-Prem Connections

Quick Setup (Single Data Source)

1. Create the API Key Secret

2. Create a Connector Secret

3. Deploy

4. Verify

Production Setup (Multiple Data Sources)

Create Secrets for Each Data Source

Bearer Token Auth

Basic Auth

Elasticsearch ApiKey Auth

MongoDB Atlas Digest Auth

Honeycomb API Key

Configure Connectors

Deploy

Configure Connector TLS

Verify the Connection

Check Pod Status

Check Handshake Logs

Check Health Endpoint

Check Metrics