Connect a service

Every service, and exactly how to give it a key that cannot do more than it should.

Each guide creates a credential whose own permissions already match the read-only policy Prodpeek enforces — so two independent things refuse a write, not one. Where a vendor's permissions are too coarse for that, the guide says so rather than rounding up.

Azure Subscriptions, the activity log, Resource Health, alerts, VMs, App Service, Container Apps, AKS, databases, networking, Key Vault metadata, metrics and budgets — forty-one tools, one Reader service principal, nothing to install. Prodpeek asks Azure every hour whether the principal is still read-only. Tier 2 A service principal with the Reader role ~5 min Azure DevOps Projects, repositories, pull requests, pipelines, builds and their logs, environments and deployments, classic releases, work items and agent pools — thirty-two tools, one Personal Access Token, nothing to install. Azure DevOps is where "what was deployed, and which step failed" is answered. Tier 2 A Personal Access Token with Read scopes only ~5 min Cloudflare Zones, DNS, WAF rules, zone settings, TLS, Tunnels, Workers, Pages and the account audit log — twenty-seven tools, one API token, nothing to install. Cloudflare is in front of production, so it is where a lot of outages are actually explained. Tier 2 A Cloudflare API Token, Read permissions only ~5 min Confluence Read pages and search spaces — runbooks, architecture notes, the context that explains why production looks the way it does. Tier 2 Atlassian API token ~3 min Coolify Inventory, status and logs from a Coolify instance. Coolify's own token abilities do the enforcing, which is what makes this the cleanest Tier 1. Tier 1 Coolify API token ~2 min DigitalOcean Droplets, App Platform, managed databases, Kubernetes, networking, DNS, volumes, monitoring and the account's action log — forty tools, one token, nothing to install. Tier 2 A DigitalOcean personal access token, Read scope ~2 min GitHub One connection that reads GitHub: repositories, code, commits, pull requests, issues, releases and Actions — including the job logs that say why the deploy failed. The narrowing that matters is the token's repository scope. Tier 2 A fine-grained personal access token ~5 min Grafana Four tools: find a dashboard, read its queries, see what is firing, check Grafana is up. The smallest honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere. Tier 2 A Grafana service account token (starts `glsa_`) ~3 min Grafana Dashboards, panel queries, alert rules, what is firing right now, and PromQL or LogQL through your datasources. One URL and one token — Prodpeek speaks Grafana's own API, so there is nothing to install. Tier 2 A Grafana service account token (starts `glsa_`) ~3 min OpenAPI (any internal API) Any internal API with an OpenAPI 3 spec. GET only. Reads that look like they return secrets are refused until you say otherwise. Tier 2 A read-only API key for your own API, or none ~5 min PostgreSQL Query a Postgres server directly — named diagnostics plus a free SELECT that is only enabled when the role is not a superuser. Tier 2 The role's password ~3 min Prometheus Query metrics, check scrape targets, read alert rules. Prometheus has no authentication of its own, so the network and the gateway do the work a credential normally does. Tier 2 None, usually — or a reverse-proxy basic-auth login ~10 min SSH host A fixed menu of diagnostic commands on a Linux host. Not a shell — the adapter has no free-form command tool and never will. Tier 2 Private key PEM (or a password) ~5 min

Missing one? A service needs a reviewed profile before it can have a guide — that is the order on purpose. Open an issue.