[{"data":1,"prerenderedAt":691},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Faccess-gating":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":6,"body":141,"description":684,"extension":685,"meta":686,"navigation":687,"path":5,"seo":688,"stem":689,"__hash__":690},"docs\u002Fdocs\u002Faccess-gating.md",{"type":142,"value":143,"toc":677},"minimark",[144,153,166,171,237,244,248,255,305,312,315,358,365,369,391,440,443,447,527,530,571,587,591,594,667,670,673],[145,146,147,148,152],"p",{},"An access gate protects an mm-managed HTTP route. The ",[149,150,151],"code",{},"password-cap"," provider\nrequires both a valid password and a self-hosted Cap challenge. Gate users are\nseparate from developers who can deploy or administer the host.",[145,154,155,156,161,162,165],{},"Set up ",[157,158,160],"a",{"href":159},".\u002Flocal-services","shared local services"," first. This guide uses\nDocker Compose; use ",[149,163,164],{},"podman-compose"," throughout if it owns your installation.",[167,168,170],"h2",{"id":169},"prepare-the-challenge-service","Prepare the challenge service",[172,173,178],"pre",{"className":174,"code":175,"language":176,"meta":177,"style":177},"language-sh shiki shiki-themes mm","mm --runtime docker-compose dev services plan --gate\nmm --runtime docker-compose dev services apply --gate --plan SERVICE_PLAN_HASH --yes\n","sh","",[149,179,180,209],{"__ignoreMap":177},[181,182,185,189,193,197,200,203,206],"span",{"class":183,"line":184},"line",1,[181,186,188],{"class":187},"svrjQ","mm",[181,190,192],{"class":191},"sbRf1"," --runtime",[181,194,196],{"class":195},"sv8ni"," docker-compose",[181,198,199],{"class":195}," dev",[181,201,202],{"class":195}," services",[181,204,205],{"class":195}," plan",[181,207,208],{"class":191}," --gate\n",[181,210,212,214,216,218,220,222,225,228,231,234],{"class":183,"line":211},2,[181,213,188],{"class":187},[181,215,192],{"class":191},[181,217,196],{"class":195},[181,219,199],{"class":195},[181,221,202],{"class":195},[181,223,224],{"class":195}," apply",[181,226,227],{"class":191}," --gate",[181,229,230],{"class":191}," --plan",[181,232,233],{"class":195}," SERVICE_PLAN_HASH",[181,235,236],{"class":191}," --yes\n",[145,238,239,240,243],{},"Use the printed hash. ",[149,241,242],{},"--gate"," installs Cap and its Valkey data store. After\nthe first gate policy exists, ordinary service plans retain them automatically.\nThe public Cap route exposes challenge endpoints, not its administration UI.",[167,245,247],{"id":246},"create-a-gate-and-user","Create a gate and user",[145,249,250,251,254],{},"Age is the default store for gate secrets. Initialize it, then preview and\ncreate a policy named ",[149,252,253],{},"internal",":",[172,256,258],{"className":174,"code":257,"language":176,"meta":177,"style":177},"mm secret init age\nmm access add internal\nmm access add internal --plan GATE_PLAN_HASH --yes\n",[149,259,260,273,286],{"__ignoreMap":177},[181,261,262,264,267,270],{"class":183,"line":184},[181,263,188],{"class":187},[181,265,266],{"class":195}," secret",[181,268,269],{"class":195}," init",[181,271,272],{"class":195}," age\n",[181,274,275,277,280,283],{"class":183,"line":211},[181,276,188],{"class":187},[181,278,279],{"class":195}," access",[181,281,282],{"class":195}," add",[181,284,285],{"class":195}," internal\n",[181,287,289,291,293,295,298,300,303],{"class":183,"line":288},3,[181,290,188],{"class":187},[181,292,279],{"class":195},[181,294,282],{"class":195},[181,296,297],{"class":195}," internal",[181,299,230],{"class":191},[181,301,302],{"class":195}," GATE_PLAN_HASH",[181,304,236],{"class":191},[145,306,307,308,311],{},"Sessions last seven days by default. Use ",[149,309,310],{},"--session-days"," on both commands for\na different duration between 1 and 30 days.",[145,313,314],{},"Add a user and enter their password at the hidden prompt:",[172,316,318],{"className":174,"code":317,"language":176,"meta":177,"style":177},"mm access user add internal alice\nmm access user add internal alice --plan USER_PLAN_HASH --yes\n",[149,319,320,336],{"__ignoreMap":177},[181,321,322,324,326,329,331,333],{"class":183,"line":184},[181,323,188],{"class":187},[181,325,279],{"class":195},[181,327,328],{"class":195}," user",[181,330,282],{"class":195},[181,332,297],{"class":195},[181,334,335],{"class":195}," alice\n",[181,337,338,340,342,344,346,348,351,353,356],{"class":183,"line":211},[181,339,188],{"class":187},[181,341,279],{"class":195},[181,343,328],{"class":195},[181,345,282],{"class":195},[181,347,297],{"class":195},[181,349,350],{"class":195}," alice",[181,352,230],{"class":191},[181,354,355],{"class":195}," USER_PLAN_HASH",[181,357,236],{"class":191},[145,359,360,361,364],{},"For automation, add ",[149,362,363],{},"--stdin"," and provide one password line on standard input.\nPasswords are not accepted as command-line arguments.",[167,366,368],{"id":367},"attach-a-route","Attach a route",[145,370,371,372,375,376,379,380,383,384,387,388,254],{},"Get the target UUID from ",[149,373,374],{},"mm target list"," and the router name from the ",[149,377,378],{},"routes","\nsection of ",[149,381,382],{},"mm --output json deploy plan",". Replace ",[149,385,386],{},"ROUTER"," and ",[149,389,390],{},"TARGET_UUID",[172,392,394],{"className":174,"code":393,"language":176,"meta":177,"style":177},"mm access attach internal ROUTER --target-id TARGET_UUID\nmm access attach internal ROUTER --target-id TARGET_UUID --plan ATTACH_PLAN_HASH --yes\n",[149,395,396,416],{"__ignoreMap":177},[181,397,398,400,402,405,407,410,413],{"class":183,"line":184},[181,399,188],{"class":187},[181,401,279],{"class":195},[181,403,404],{"class":195}," attach",[181,406,297],{"class":195},[181,408,409],{"class":195}," ROUTER",[181,411,412],{"class":191}," --target-id",[181,414,415],{"class":195}," TARGET_UUID\n",[181,417,418,420,422,424,426,428,430,433,435,438],{"class":183,"line":211},[181,419,188],{"class":187},[181,421,279],{"class":195},[181,423,404],{"class":195},[181,425,297],{"class":195},[181,427,409],{"class":195},[181,429,412],{"class":191},[181,431,432],{"class":195}," TARGET_UUID",[181,434,230],{"class":191},[181,436,437],{"class":195}," ATTACH_PLAN_HASH",[181,439,236],{"class":191},[145,441,442],{},"Visit the route and verify that login is required before the application loads.\nLater deployments preserve the attachment. Detach the gate before removing\nthe router or changing its host, path, or TLS settings.",[167,444,446],{"id":445},"manage-access","Manage access",[172,448,450],{"className":174,"code":449,"language":176,"meta":177,"style":177},"mm access show internal\nmm access user list internal\nmm access session list internal\nmm access user disable internal alice\nmm access user disable internal alice --plan DISABLE_PLAN_HASH --yes\n",[149,451,452,463,476,489,505],{"__ignoreMap":177},[181,453,454,456,458,461],{"class":183,"line":184},[181,455,188],{"class":187},[181,457,279],{"class":195},[181,459,460],{"class":195}," show",[181,462,285],{"class":195},[181,464,465,467,469,471,474],{"class":183,"line":211},[181,466,188],{"class":187},[181,468,279],{"class":195},[181,470,328],{"class":195},[181,472,473],{"class":195}," list",[181,475,285],{"class":195},[181,477,478,480,482,485,487],{"class":183,"line":288},[181,479,188],{"class":187},[181,481,279],{"class":195},[181,483,484],{"class":195}," session",[181,486,473],{"class":195},[181,488,285],{"class":195},[181,490,492,494,496,498,501,503],{"class":183,"line":491},4,[181,493,188],{"class":187},[181,495,279],{"class":195},[181,497,328],{"class":195},[181,499,500],{"class":195}," disable",[181,502,297],{"class":195},[181,504,335],{"class":195},[181,506,508,510,512,514,516,518,520,522,525],{"class":183,"line":507},5,[181,509,188],{"class":187},[181,511,279],{"class":195},[181,513,328],{"class":195},[181,515,500],{"class":195},[181,517,297],{"class":195},[181,519,350],{"class":195},[181,521,230],{"class":191},[181,523,524],{"class":195}," DISABLE_PLAN_HASH",[181,526,236],{"class":191},[145,528,529],{},"Disabling, removing, or resetting a user revokes their active sessions. Password\nreset follows the same preview\u002Fapply pattern:",[172,531,533],{"className":174,"code":532,"language":176,"meta":177,"style":177},"mm access user password-reset internal alice\nmm access user password-reset internal alice --plan RESET_PLAN_HASH --yes\n",[149,534,535,550],{"__ignoreMap":177},[181,536,537,539,541,543,546,548],{"class":183,"line":184},[181,538,188],{"class":187},[181,540,279],{"class":195},[181,542,328],{"class":195},[181,544,545],{"class":195}," password-reset",[181,547,297],{"class":195},[181,549,335],{"class":195},[181,551,552,554,556,558,560,562,564,566,569],{"class":183,"line":211},[181,553,188],{"class":187},[181,555,279],{"class":195},[181,557,328],{"class":195},[181,559,545],{"class":195},[181,561,297],{"class":195},[181,563,350],{"class":195},[181,565,230],{"class":191},[181,567,568],{"class":195}," RESET_PLAN_HASH",[181,570,236],{"class":191},[145,572,573,574,577,578,581,582,586],{},"Use ",[149,575,576],{},"mm access session revoke"," to revoke a specific session and\n",[149,579,580],{},"mm access session rotate-key"," to rotate session encryption keys. Each command\nrequires its own reviewed plan to apply. See the ",[157,583,585],{"href":584},".\u002Freference\u002Fcli","CLI reference",".",[167,588,590],{"id":589},"remove-a-gate","Remove a gate",[145,592,593],{},"Detach all routes first, then remove the policy:",[172,595,597],{"className":174,"code":596,"language":176,"meta":177,"style":177},"mm access detach internal ROUTER --target-id TARGET_UUID\nmm access detach internal ROUTER --target-id TARGET_UUID --plan DETACH_PLAN_HASH --yes\nmm access remove internal\nmm access remove internal --plan REMOVE_PLAN_HASH --yes\n",[149,598,599,616,639,650],{"__ignoreMap":177},[181,600,601,603,605,608,610,612,614],{"class":183,"line":184},[181,602,188],{"class":187},[181,604,279],{"class":195},[181,606,607],{"class":195}," detach",[181,609,297],{"class":195},[181,611,409],{"class":195},[181,613,412],{"class":191},[181,615,415],{"class":195},[181,617,618,620,622,624,626,628,630,632,634,637],{"class":183,"line":211},[181,619,188],{"class":187},[181,621,279],{"class":195},[181,623,607],{"class":195},[181,625,297],{"class":195},[181,627,409],{"class":195},[181,629,412],{"class":191},[181,631,432],{"class":195},[181,633,230],{"class":191},[181,635,636],{"class":195}," DETACH_PLAN_HASH",[181,638,236],{"class":191},[181,640,641,643,645,648],{"class":183,"line":288},[181,642,188],{"class":187},[181,644,279],{"class":195},[181,646,647],{"class":195}," remove",[181,649,285],{"class":195},[181,651,652,654,656,658,660,662,665],{"class":183,"line":491},[181,653,188],{"class":187},[181,655,279],{"class":195},[181,657,647],{"class":195},[181,659,297],{"class":195},[181,661,230],{"class":191},[181,663,664],{"class":195}," REMOVE_PLAN_HASH",[181,666,236],{"class":191},[145,668,669],{},"This removes the policy's users, sessions, and stored gate secrets. Review and\napply a normal shared-service plan afterward. If no policies remain, that plan\nremoves the unneeded Cap containers while retaining data unless purged.",[145,671,672],{},"If Cap, its secret store, or the policy store is unavailable, authentication is\ndenied rather than allowing visitors through.",[674,675,676],"style",{},"html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":177,"searchDepth":211,"depth":211,"links":678},[679,680,681,682,683],{"id":169,"depth":211,"text":170},{"id":246,"depth":211,"text":247},{"id":367,"depth":211,"text":368},{"id":445,"depth":211,"text":446},{"id":589,"depth":211,"text":590},"Require a password and a Cap challenge before visitors reach a local service.","md",{},true,{"title":6,"description":684},"docs\u002Faccess-gating","5IXHYPr-Xt1nejceXM8qXQUNRobA4OCjmcKob7cI70M",1794512546199]