> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nofire.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# On-Prem Connections

> Connect on-premises data sources to NOFire through Edge

## When to Set Up On-Prem Connections

* **Your data sources are behind a firewall.** NOFire cannot reach them directly, and you need metrics, logs, or traces to reason about your production systems.
* **Credentials must stay inside your network.** The Edge Proxy reads tokens and passwords from Kubernetes Secrets at runtime. They never leave your cluster.
* **You want a single Helm release.** Adding `onPremConnections` to your existing Edge values deploys the Edge Proxy alongside Edge. No separate chart or namespace needed.

<Note>
  If your data sources are already accessible from the internet (e.g., Grafana Cloud, Datadog), connect them directly through [Integrations](/monitoring/grafana). This page is for data sources that NOFire cannot reach directly.
</Note>

## Quick Setup (Single Data Source)

### 1. Create the API Key Secret

If you already have a `nofire-credentials` secret from your Edge deployment, skip this step.

```bash theme={null}
kubectl create secret generic nofire-credentials \
  --from-literal=api-key=YOUR_API_KEY \
  -n nofire-system
```

### 2. Create a Connector Secret

Create a Kubernetes Secret with the credentials for your data source. This example uses a Prometheus bearer token:

```bash theme={null}
kubectl create secret generic prometheus-creds \
  --from-literal=token=YOUR_PROMETHEUS_TOKEN \
  -n nofire-system
```

<Tip>
  The supported secret keys are `token` (for bearer auth), `username` and `password` (for basic auth). The proxy reads whichever keys are present.
</Tip>

### 3. Deploy

Create a `values-quickstart.yaml`:

```yaml theme={null}
config:
  kube:
    clusterName: "my-cluster"

edgeProxy:
  stream:
    serverAddress: "my.nofire.ai:443"

onPremConnections:
  prod-prometheus:
    type: prometheus
    name: "Production Prometheus"
    secretName: prometheus-creds
    url: "http://prometheus.monitoring:9090"
```

Deploy with Helm:

```bash theme={null}
helm repo add nofire https://nofireai.github.io/edge-helm-chart
helm repo update

helm upgrade --install nofire-edge nofire/nofire-edge \
  -f values-quickstart.yaml \
  -n nofire-system --create-namespace
```

### 4. Verify

Check that the edge-proxy pod is running:

```bash theme={null}
kubectl get pods -l app.kubernetes.io/component=edge-proxy -n nofire-system
```

Check the logs for a successful handshake with NOFire:

```bash theme={null}
kubectl logs -l app.kubernetes.io/component=edge-proxy -n nofire-system | grep "StreamAck"
```

You should see `StreamAck received: STATUS_OK` with an `edge_instance_id`.

Verify the health endpoint:

```bash theme={null}
kubectl exec -it deploy/nofire-edge-edge-proxy -n nofire-system -- \
  wget -qO- http://localhost:8081/healthz
```

## Production Setup (Multiple Data Sources)

### Create Secrets for Each Data Source

The proxy reads credentials from Kubernetes Secrets mounted as files. Create a Secret for each data source that requires authentication.

#### Bearer Token Auth

For Prometheus, Loki, Tempo, Grafana, OpenSearch, and Alertmanager:

```bash theme={null}
kubectl create secret generic prometheus-creds \
  --from-literal=token=YOUR_BEARER_TOKEN \
  -n nofire-system
```

#### Basic Auth

For backends that require username and password:

```bash theme={null}
kubectl create secret generic loki-creds \
  --from-literal=username=admin \
  --from-literal=password=YOUR_PASSWORD \
  -n nofire-system
```

#### Elasticsearch ApiKey Auth

For Elasticsearch, store the ApiKey in the `token` field. The proxy sends it as `Authorization: ApiKey <token>`:

```bash theme={null}
kubectl create secret generic elasticsearch-creds \
  --from-literal=token=YOUR_ELASTICSEARCH_API_KEY \
  -n nofire-system
```

<Note>
  OpenSearch uses the same connector but sends `Authorization: Bearer <token>` instead.
</Note>

#### MongoDB Atlas Digest Auth

MongoDB Atlas uses HTTP digest authentication with a public/private key pair:

```bash theme={null}
kubectl create secret generic mongodb-atlas-creds \
  --from-literal=username=YOUR_PUBLIC_KEY \
  --from-literal=password=YOUR_PRIVATE_KEY \
  -n nofire-system
```

<Info>
  MongoDB Atlas has a built-in rate limiter (95 requests/minute). The proxy enforces this automatically.
</Info>

#### Honeycomb API Key

Honeycomb is reachable over the internet, but routing it through the Edge Proxy keeps the API key inside your cluster instead of storing it in NOFire. Store the key in the `token` field; the proxy sends it as the `X-Honeycomb-Team` header:

```bash theme={null}
kubectl create secret generic honeycomb-creds \
  --from-literal=token=YOUR_HONEYCOMB_API_KEY \
  -n nofire-system
```

<Note>
  This is the in-cluster route. If your team is fine sending the API key to NOFire directly, use the [Honeycomb integration](/monitoring/honeycomb) instead — no Edge Proxy needed.
</Note>

### Configure Connectors

Create a `values.yaml` with all your data sources:

```yaml theme={null}
config:
  kube:
    clusterName: "production-cluster"

edgeProxy:
  stream:
    serverAddress: "my.nofire.ai:443"

onPremConnections:
  prod-prometheus:
    type: prometheus
    name: "Production Prometheus"
    secretName: prometheus-creds
    url: "http://prometheus.monitoring:9090"

  prod-loki:
    type: loki
    name: "Production Loki"
    secretName: loki-creds
    url: "http://loki.monitoring:3100"
    orgId: "tenant1"

  prod-tempo:
    type: tempo
    name: "Production Tempo"
    secretName: tempo-creds
    url: "http://tempo.monitoring:3200"

  prod-grafana:
    type: grafana
    name: "Production Grafana"
    secretName: grafana-creds
    url: "http://grafana.monitoring:3000"

  prod-elasticsearch:
    type: elasticsearch
    name: "Production Elasticsearch"
    secretName: elasticsearch-creds
    url: "https://elasticsearch.logging:9200"
    index: "app-logs-*"

  prod-alertmanager:
    type: alertmanager
    name: "Production Alertmanager"
    secretName: alertmanager-creds
    url: "http://alertmanager.monitoring:9093"

  prod-mongodb-atlas:
    type: mongodb_atlas
    name: "Production MongoDB Atlas"
    secretName: mongodb-atlas-creds
    url: "https://cloud.mongodb.com/api/atlas/v2"

  prod-honeycomb:
    type: honeycomb
    name: "Production Honeycomb"
    secretName: honeycomb-creds
    url: "https://api.honeycomb.io"   # US default; use https://api.eu1.honeycomb.io for EU
```

### Deploy

```bash theme={null}
helm upgrade --install nofire-edge nofire/nofire-edge \
  -f values.yaml \
  -n nofire-system --create-namespace
```

### Configure Connector TLS

If your data sources use TLS (self-signed or internal CA), configure TLS per connector:

```yaml theme={null}
onPremConnections:
  prod-elasticsearch:
    type: elasticsearch
    secretName: elasticsearch-creds
    url: "https://elasticsearch.logging:9200"
    tlsEnabled: true
    caCertPath: "/etc/ssl/certs/internal-ca.crt"
```

<Warning>
  Setting `tlsSkipVerify: true` disables certificate verification. Use this only for testing. In production, provide a CA certificate with `caCertPath`.
</Warning>

## Verify the Connection

### Check Pod Status

```bash theme={null}
kubectl get pods -l app.kubernetes.io/component=edge-proxy -n nofire-system
```

The pod should be in `Running` state with `1/1` ready.

### Check Handshake Logs

```bash theme={null}
kubectl logs -l app.kubernetes.io/component=edge-proxy -n nofire-system | grep "StreamAck"
```

A successful connection shows:

```
StreamAck received: STATUS_OK  edge_instance_id=<id>  protocol_version=1
```

### Check Health Endpoint

```bash theme={null}
kubectl exec -it deploy/nofire-edge-edge-proxy -n nofire-system -- \
  wget -qO- http://localhost:8081/healthz
```

### Check Metrics

```bash theme={null}
kubectl exec -it deploy/nofire-edge-edge-proxy -n nofire-system -- \
  wget -qO- http://localhost:8081/metrics | grep nofire_proxy
```