# How to get started

**URL:** <https://discuss.pomerium.com/t/how-to-get-started/469>\
**Category:** Pomerium Zero\
**Created:** [April 11, 2025, 11:50am UTC](https://discuss.pomerium.com/t/how-to-get-started/469 "2025-04-11T11:50:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mha](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@mha](https://discuss.pomerium.com/u/mha)\
**Post date:** [April 11, 2025, 11:50am UTC](https://discuss.pomerium.com/t/how-to-get-started/469/1 "2025-04-11T11:50:26Z")

</div>

I tried to run pomerium integrated with grafana in docker.  
Unfortunately it doesn’t work and the documentation is not clear. Please help.

## What’s your environment like?

- Pomerium version (retrieve with `pomerium --version`): latest (docker)
- Server Operating System/Architecture/Cloud: Windows 11
- I do not have a public IP address.

## What’s your config.yaml?

```auto
authenticate_service_url: https://authenticate.pomerium.app

routes:
  - from: https://verify.localhost.pomerium.io
    to: http://verify:8000
    policy:
      - allow:
          or:
            - email:
                is: mha@rublon.com
    pass_identity_headers: true

  - from: https://grafana.localhost.pomerium.io
    to: http://grafana:3000
    allow_any_authenticated_user: true

```

docker-compose.yaml

```auto
services:
  pomerium:
    image: pomerium/pomerium:latest
    volumes:
      - ./config.yaml:/pomerium/config.yaml:ro
    ports:
      - 443:443
    networks:
      main:
        aliases:
          - authenticate.localhost.pomerium.app
  verify:
    image: pomerium/verify:latest
    environment:
      - JWKS_ENDPOINT=https://pomerium/.well-known/pomerium/jwks.json
    expose:
      - 8000
  grafana:
    image: grafana/grafana:latest
    ports:
      - 3000:3000
    networks:
      main: {}
    environment:
      - GF_AUTH_SIGNOUT_REDIRECT_URL=https://grafana.localhost.pomerium.app/.pomerium/sign_out
      - GF_AUTH_JWT_ENABLED=true
      - GF_AUTH_JWT_HEADER_NAME=X-Pomerium-Jwt-Assertion
      - GF_AUTH_JWT_EMAIL_CLAIM=sub
      - GF_AUTH_JWT_USERNAME_CLAIM=sub
      - GF_AUTH_JWT_JWK_SET_URL=https://authenticate.localhost.pomerium.app/.well-known/pomerium/jwks.json
      - GF_AUTH_JWT_CACHE_TTL=60m
      - GF_AUTH_JWT_AUTO_SIGN_UP=true
    volumes:
      - ./grafana-storage:/var/lib/grafana
  
networks:
  main:

```

 ![grafana](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/96a273553336f6cedfdf661d99b76a91939a5b3e.png)

---

<div class="post-metadata">

**Author:** ![anon97210385](https://avatars.discourse-cdn.com/v4/letter/a/ce7236/32.png) [@anon97210385](https://discuss.pomerium.com/u/anon97210385)\
**Post date:** [April 16, 2025, 8:02pm UTC](https://discuss.pomerium.com/t/how-to-get-started/469/2 "2025-04-16T20:02:51Z")

</div>

Welcome, and thanks for using Pomerium!

There’s a few things of interest here.

1. Make sure to specify `pass_identity_headers: true` in your route definition for Grafana.

2. What happens when you navigate to [https://verify.localhost.pomerium.io](https://verify.localhost.pomerium.io) ? Do you have a [Signing Key | Pomerium](https://www.pomerium.com/docs/reference/signing-key) specified? It makes sense not to post your key on a public forum, but in the absence of a key, JWT validation will fail and access will be limited.

I understand you’re using Pomerium Core (as opposed to Pomerium Zero), but our guide to [Securing Grafana with Pomerium | Pomerium](https://www.pomerium.com/docs/guides/grafana) should still provide the relevant settings to get you past this by configuring JWT-based auth for Grafana.

Let me know how it goes!

---

<div class="post-metadata">

**Author:** ![mha](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@mha](https://discuss.pomerium.com/u/mha)\
**Post date:** [May 23, 2025, 1:34pm UTC](https://discuss.pomerium.com/t/how-to-get-started/469/3 "2025-05-23T13:34:50Z")

</div>

Thank you for your reply. I probably mixed up the configurations of Pomerium Zero and Core.  
I successfully launched Pomerium connected to the admin panel in your cloud (Zero). 😉