Hide infrastructure
Make internal tools invisible
Keep Grafana, Jenkins, and admin panels off the public internet. Give each app a cryptographic identity and open access only when a person or agent has a valid grant.
Take internal tools off the public internet
A public admin login can reveal which software you run and give scanners a place to probe before anyone signs in. Internal tools need a way to serve authorized work without leaving their origin open to public discovery.
| The usual fix | What to consider |
|---|---|
| Public application login | The app accepts public connections before it checks who is signing in. |
| Private tunnel with access policies | A tunnel can keep the origin private. Evaluate how your code identifies resources and issues access for individual tasks. |
| IP allowlisting | An address identifies a network location; it does not by itself identify the intended resource or task. |
Authorize access before the app connection opens
Keep the origin private. LayerV verifies access before the protected origin connection opens; your app serves the authorized task.
# Install the latest CLI and run qurl login first. qurl publish http://127.0.0.1:3000 # Copy the CRID printed by publish. qurl share <CRID> --ttl 1h
Send the returned access link to the recipient. The CRID identifies the resource and does not grant access on its own.
Publish the app
Start the HTTP app on loopback on this host. Publish it with the qURL CLI and save its CRID. Close any separate public route.
Issue an access link
Use the CRID to issue a fresh signed access link for this task through the CLI, SDK, or API. Keep your app login for verified user identity.
Set the access window
Set link expiry and supported use limits. An open session has its own lifetime; revoke the link or delete the resource when access must end early.
What to install, and how someone gets in
Publish with
The qURL CLI, on the machine running the app ↗Give access with
An access link issued with the CLI, SDKs, or API ↗- 01Install the qURL CLI and enroll this machine with qurl login
- 02Keep the app running on loopback and publish it with qurl publish http://127.0.0.1:3000
- 03Restrict any old public route and verify it no longer reaches the app directly
- 04Issue an access link with qurl share <CRID>, or use the API for additional policy controls
- 05Use qurl stop <CRID> to pause local serving, or qurl delete <CRID> to retire the resource
So how does anyone open Grafana now?
Choose how to issue and open the access link.
A browser recipient
Open the link sent by the resource owner, then complete the application’s own sign-in if it requires one.
Your application
After your own authorization check, use an SDK or API call to issue a link with the required limits.
A machine or agent
Open the received link with the Go SDK EnterPortal flow, then use the returned handle to call the resource. A plain HTTP request to the share link does not perform this opening flow.
Run internal tools without exposing them
Hidden until access is authorized
Keep the origin off the public internet. LayerV checks access before opening its connection to the app.
A stable name for every task
Reuse the CRID to issue new grants. The resource identity stays separate from its address and each access link.
Browser access
Recipients need no qURL CLI or LayerV account; retain the app’s sign-in when needed.
Controlled lifetimes
Set link expiry and use limits, with separate session-duration controls.
Built for
- Teams with internet-facing admin panels or dashboards
- Organizations with staging environments accessible from the internet
- DevOps teams managing CI/CD pipelines
- Companies with compliance requirements for internal tool access
Questions
Which internal tools can LayerV hide?
HTTP applications such as Grafana, Jenkins, Kibana, internal dashboards, and admin panels. Publish from the host and keep the origin private.
What do scanners and unauthorized users see?
A scanner without an access grant cannot reach the private app through LayerV to see its login, fingerprint its software, or probe its routes. Keep the origin private: publishing does not close an existing public route. LayerV’s shared website and access services remain reachable.
How long does deployment take?
Start with the CLI quickstart. Production setup also depends on outbound connectivity, persistent device state, and your existing application authentication.
Does LayerV replace our SSO?
No. Keep the application’s SSO when you need verified user identity. A shared link alone does not establish who opens it.