Connect a service

Every service, and exactly how to give it a key that cannot do more than it should.

Each guide creates a credential whose own permissions already match the read-only policy Prodpeek enforces — so two independent things refuse a write, not one. Where a vendor's permissions are too coarse for that, the guide says so rather than rounding up.

Cloudflare Zones, DNS, WAF rules, zone settings, TLS, Tunnels, Workers, Pages and the account audit log — twenty-seven tools, one API token, nothing to install. Cloudflare is in front of production, so it is where a lot of outages are actually explained. Tier 2 A Cloudflare API Token, Read permissions only ~5 min Confluence Read pages and search spaces — runbooks, architecture notes, the context that explains why production looks the way it does. Tier 2 Atlassian API token ~3 min Coolify Inventory, status and logs from a Coolify instance. Coolify's own token abilities do the enforcing, which is what makes this the cleanest Tier 1. Tier 1 Coolify API token ~2 min DigitalOcean Droplets, App Platform, managed databases, Kubernetes, networking, DNS, volumes, monitoring and the account's action log — forty tools, one token, nothing to install. Tier 2 A DigitalOcean personal access token, Read scope ~2 min GitHub One connection that reads GitHub: repositories, code, commits, pull requests, issues, releases and Actions — including the job logs that say why the deploy failed. The narrowing that matters is the token's repository scope. Tier 2 A fine-grained personal access token ~5 min Grafana Four tools: find a dashboard, read its queries, see what is firing, check Grafana is up. The smallest honest Tier 2 — Grafana's own roles are coarse, so the gateway allowlist is doing more of the work here than elsewhere. Tier 2 A Grafana service account token (starts `glsa_`) ~3 min Grafana Dashboards, panel queries, alert rules, what is firing right now, and PromQL or LogQL through your datasources. One URL and one token — Prodpeek speaks Grafana's own API, so there is nothing to install. Tier 2 A Grafana service account token (starts `glsa_`) ~3 min OpenAPI (any internal API) Any internal API with an OpenAPI 3 spec. GET only. Reads that look like they return secrets are refused until you say otherwise. Tier 2 A read-only API key for your own API, or none ~5 min PostgreSQL Query a Postgres server directly — named diagnostics plus a free SELECT that is only enabled when the role is not a superuser. Tier 2 The role's password ~3 min Prometheus Query metrics, check scrape targets, read alert rules. Prometheus has no authentication of its own, so the network and the gateway do the work a credential normally does. Tier 2 None, usually — or a reverse-proxy basic-auth login ~10 min SSH host A fixed menu of diagnostic commands on a Linux host. Not a shell — the adapter has no free-form command tool and never will. Tier 2 Private key PEM (or a password) ~5 min

Missing one? A service needs a reviewed profile before it can have a guide — that is the order on purpose. Open an issue.