Kafdrop Documentation

You can run Kafdrop via Docker using two methods for secure connections:

Method 1: Base64 Encoded Environment Variables

Pass the contents of your properties and certificate files as base64-encoded strings via environment variables.

Method 2: Mounting Files

Mount your local kafka.properties, kafka.truststore.jks, and kafka.keystore.jks files into the container and use the _FILE environment variables to point to their internal paths.

# Method 1: Base64
docker run -d --rm -p 9000:9000 \
    -e KAFKA_BROKERCONNECT=<host:port,host:port> \
    -e KAFKA_PROPERTIES="$(cat kafka.properties | base64)" \
    -e KAFKA_TRUSTSTORE="$(cat kafka.truststore.jks | base64)" \
    -e KAFKA_KEYSTORE="$(cat kafka.keystore.jks | base64)" \
    obsidiandynamics/kafdrop

# Method 2: File Mounting
docker run -d --rm -p 9000:9000 \
    -v $(pwd)/kafka.properties:/tmp/kafka.properties:ro \
    -v $(pwd)/kafka.truststore.jks:/tmp/kafka.truststore.jks:ro \
    -v $(pwd)/kafka.keystore.jks:/tmp/kafka.keystore.jks:ro \
    -e KAFKA_BROKERCONNECT=<host:port,host:port> \
    -e KAFKA_PROPERTIES_FILE=/tmp/kafka.properties \
    -e KAFKA_TRUSTSTORE_FILE=/tmp/kafka.truststore.jks \
    -e KAFKA_KEYSTORE_FILE=/tmp/kafka.keystore.jks \
    obsidiandynamics/kafdrop

Kafdrop does not have native authentication. You can secure it by using NGINX as a reverse proxy with Basic Auth.

Setup Steps

1. Install Requirements: Ensure nginx and httpd (for htpasswd) are installed.
2. Create Password File: Run htpasswd -c /usr/local/etc/nginx/.htpasswd admin to set an admin password.
3. Configure NGINX: Use an upstream block to point to Kafdrop (default port 9000) and add auth_basic directives to your server block.
4. Add Logout Functionality: Create a logout page at /usr/local/opt/nginx/html/401.html and a /logout location in NGINX that returns a 401 status code.
5. Start NGINX: Run nginx or nginx -s reload.

http {
  upstream kafdrop {
    server 127.0.0.1:9000;
    keepalive 64;
  }

  server {
    listen *:8080;
    server_name _;
    auth_basic "Restricted Area";
    auth_basic_user_file /usr/local/etc/nginx/.htpasswd;

    location / {
      proxy_pass http://kafdrop;
    }

    location /logout {
      return 401;
    }

    error_page 401 /errors/401.html;

    location /errors {
      auth_basic off;
      ssi        on;
      alias /usr/local/opt/nginx/html;
    }
  }
}

To deploy Kafdrop as a systemd service on Ubuntu 22.04 LTS (or similar distributions), follow these steps.

Prerequisites:

• An assumed installation directory ($INSTALLDIR) of /opt/kafdrop. If you use a different path, you must update the # Paths section within the kafdrop.service file.

Installation Steps:

1. Create the $INSTALLDIR directory and download the latest Kafdrop release into it.
2. Create the kafdrop user and group using systemd-sysusers:

   systemd-sysusers --inline 'u  kafdrop  -  "KafDrop user"  $INSTALLDIR  /usr/sbin/nologin'

3. Copy start.sh to $INSTALLDIR, configure your specific startup parameters and options, and make it executable:

   chmod 755 $INSTALLDIR/start.sh

4. Copy kafdrop.service to $INSTALLDIR and create a symbolic link in /etc/systemd/system:

   (cd /etc/systemd/system && ln -s $INSTALLDIR/kafdrop.service)

5. Reload the systemd daemon:

   systemctl daemon-reload

6. Enable and start the service:

   systemctl enable kafdrop.service && systemctl start kafdrop.service