# Generate Pomerium-Desktop config by reading pomerium core config

**URL:** <https://discuss.pomerium.com/t/generate-pomerium-desktop-config-by-reading-pomerium-core-config/369>\
**Category:** Community Showcase\
**Created:** [April 25, 2024, 9:44pm UTC](https://discuss.pomerium.com/t/generate-pomerium-desktop-config-by-reading-pomerium-core-config/369 "2024-04-25T21:44:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pomerian](https://avatars.discourse-cdn.com/v4/letter/p/71c47a/32.png) [@pomerian](https://discuss.pomerium.com/u/pomerian)\
**Post date:** [April 25, 2024, 9:44pm UTC](https://discuss.pomerium.com/t/generate-pomerium-desktop-config-by-reading-pomerium-core-config/369/1 "2024-04-25T21:44:41Z")

</div>

## Generate Pomerium-Desktop config by reading pomerium core config

Description:  
I have many many TCP routes configured in pomerium. And to be honest, I do not know any individual being happy to copy those by hand. I wrote a little helper in python to read the pomerium core config, extract all tcp routes and write a config file for pomerium desktop. Since pomerium core’s config does not have directives for every option in the desktop config (like the route’s name or the wanted local addr\_port) I added those values to the pomerium core config. Fortunately, pomerium ignores unknown directives instead of telling you it does not know.

It is raw and unready but working for me and I share it for everyone who likes to use it and adapt to his use case. I would LOVE to see this feature integrated into pomerium core binary

```auto
import yaml
import json
import uuid

# Construct Pomerium Desktop Config
pomerium_desktop_config = {
    "@type": "type.googleapis.com/pomerium.cli.Records",
    "records": [

    ]
}

# load pomerium config file
with open('config.yaml', 'r') as stream:
    pomeriumConfig = yaml.safe_load(stream)

# loop through all tcp routes
for route in pomeriumConfig['routes']:
    if route['from'].startswith('tcp+'):
        # Read route details here
        confItem = {
            'id': uuid.uuid4(). __str__ (),
            'conn': {
                # name is no officially supported yaml directive in pomeriums config.yaml.
                # but since pomerium ignores unknown directives it can be used as a hint for
                # the generated desktop config
                'name': route['name'],
                'remoteAddr': route['from'],
                # same applies to the local listen address.
                'listenAddr': route['local_listen_addr'],
                'disableTlsVerification': False,
                # must be extended to also support ascii encoded certs
                "clientCertFromStore": {
                    "subjectFilter": "CN=commonName"
                }
            }
        }
        pomerium_desktop_config['records'].append(confItem)

# Generating config file for pomerium desktop
json_object = json.dumps(pomerium_desktop_config, indent=2)
with open("config.json", "w") as outfile:
    outfile.write(json_object)

```

---

<div class="post-metadata">

**Author:** ![CMo](https://avatars.discourse-cdn.com/v4/letter/c/d78d45/32.png) [@CMo](https://discuss.pomerium.com/u/CMo)\
**Post date:** [April 26, 2024, 8:52pm UTC](https://discuss.pomerium.com/t/generate-pomerium-desktop-config-by-reading-pomerium-core-config/369/2 "2024-04-26T20:52:25Z")

</div>

Thanks for this! We’re definitely talking about how we can integrate it.

---

<div class="post-metadata">

**Author:** ![pomerian](https://avatars.discourse-cdn.com/v4/letter/p/71c47a/32.png) [@pomerian](https://discuss.pomerium.com/u/pomerian)\
**Post date:** [April 27, 2024, 1:51pm UTC](https://discuss.pomerium.com/t/generate-pomerium-desktop-config-by-reading-pomerium-core-config/369/3 "2024-04-27T13:51:28Z")

</div>

For reference, I also posted the feature request on GitHub

> <https://github.com/pomerium/pomerium/issues/5087>
>
> If you have many TCP routes configured, it can become a quite tedious task to tr…ansfer all the routes to the Pomerium Desktop app. It would be really helpful, if the pomerium core binary could create the json-Config for the desktop app, by parsing the config.yaml, extracting all tcp routes and make an importable config for Pomerium Desktop.
> 
> Since not all field you would like to fill in in Pomerium Desktop are also config options for pomerium core, you would have to enrich the core config with fields like \_name\_, \_tag\_ or \_local\_addr\_port\_, which then gets used to generate the desktop config. This tends to be no problem since pomerium core ignores all "unknown" configuration fields it does not know.
> 
> It's really straightforward to write such a tool for yourself since you can read yaml into object representations of nearly any language you like and then read what you want and emit a json at last. But it would come in very handy, if pomerium core could generate that config itself. Thought ahead, you might also include the option in the Desktop App to give pomeriums hostname to the app and let the app fetch the config itself directly from pomerium core.
> 
> Here a little - and by far not complete or comprehensive - python script I wrote for my personal use case.
> \`\`\`
> import yaml
> import json
> import uuid
> 
> \# Construct Pomerium Desktop Config
> pomerium\_desktop\_config = {
> "@type": "type.googleapis.com/pomerium.cli.Records",
> "records": \[
> 
> \]
> }
> 
> \# load pomerium config file
> with open('config.yaml', 'r') as stream:
> pomeriumConfig = yaml.safe\_load(stream)
> 
> \# loop through all tcp routes
> for route in pomeriumConfig\['routes'\]:
> if route\['from'\].startswith('tcp+'):
> # Read route details here
> confItem = {
> 'id': uuid.uuid4().\_\_str\_\_(),
> 'conn': {
> # name is no officially supported yaml directive in pomeriums config.yaml.
> # but since pomerium ignores unknown directives it can be used as a hint for
> # the generated desktop config
> 'name': route\['name'\],
> 'remoteAddr': route\['from'\],
> # same applies to the local listen address.
> 'listenAddr': route\['local\_listen\_addr'\],
> 'disableTlsVerification': False,
> # must be extended to also support ascii encoded certs
> "clientCertFromStore": {
> "subjectFilter": "CN=commonName"
> }
> }
> }
> pomerium\_desktop\_config\['records'\].append(confItem)
> 
> \# Generating config file for pomerium desktop
> json\_object = json.dumps(pomerium\_desktop\_config, indent=2)
> with open("config.json", "w") as outfile:
> outfile.write(json\_object)
> \`\`\`

---

<div class="post-metadata">

**Author:** ![CMo](https://avatars.discourse-cdn.com/v4/letter/c/d78d45/32.png) [@CMo](https://discuss.pomerium.com/u/CMo)\
**Post date:** [April 29, 2024, 5:20pm UTC](https://discuss.pomerium.com/t/generate-pomerium-desktop-config-by-reading-pomerium-core-config/369/4 "2024-04-29T17:20:42Z")

</div>

Thanks! We’re reviewing it internally!