Skip to content

HTTPS and Network Exposure

Use HTTPS for every REST API call that crosses a network, and allow only the hosts that need the MetaMiner Server (MMS) port to reach it.

How it works

The REST API answers on the MMS port (default 49714), the same port the MetaMiner Client uses. When SSL is enabled on the MMS, that port speaks HTTPS; otherwise it speaks plain HTTP. The Flow Scheduler behind /fss/v1 listens on the MMS machine's loopback address only, so the MMS port is the only network surface of the API.

Why HTTPS matters

What travels Where Risk over plain HTTP
API client token Authorization: Bearer <token> header of every call A bearer token is static and replayable. Anyone who sees it can make every call the client can, until it is rotated or revoked.
Tableau password Body of POST /tab/credentials Sent in clear text next to the token
New token Answer to client creation and to a rotation Whoever reads the answer holds the new token

Hardening checklist

  1. Enable SSL on the MMS, or place the MMS behind a load balancer or reverse proxy that terminates TLS. In MMA the MMS certificate is set up in the Configure SSL for MetaMiner Server dialog (Use SSL).
  2. Use https:// URLs in every script. Keep plain http:// for a lab on an isolated network.
  3. Trust the certificate properly. Avoid curl -k / --insecure and disabled certificate checks outside a lab; install the issuing CA on the calling host instead.
  4. Choose API clients authorization for any caller on another host (see Authorization Modes). Never publish the API through a reverse proxy on the MMS machine under Local only.
  5. Firewall the MMS port. Allow it only from the hosts that need it: MetaMiner Client users, scripts, the load balancer. API clients are defence in depth, not a replacement for network controls.
  6. Give each caller its own client with the least access it needs, and an expiry where your rotation schedule allows (see Manage API Clients).
  7. Store tokens in a secrets vault, not in scripts or scheduled-task command lines.
  8. Keep the Flow Scheduler on loopback. Its bind address, flowscheduler.bind.address, stays on the local machine; scripts call the MMS, never the Flow Scheduler port. See the Configuration Reference.

Behind a load balancer

In a high-availability pair, scripts call the load balancer address. When the balancer terminates TLS, also encrypt the hop from the balancer to each MMS, or keep that hop on a network that only the balancer and the MMS nodes share.

The MMS sees the balancer as the caller. The source address in the API audit is therefore the balancer's address, not the script's host. Use the client name, one client per caller, to tell callers apart (see Audit Trail).

Key terms

Term Meaning
Bearer token The secret of an API client, sent in the Authorization header
Loopback Addresses of the machine itself: 127.0.0.0/8 and ::1
TLS termination Decrypting HTTPS at a load balancer or proxy before the request reaches the MMS