Public Access

Let guests, signed-out visitors and new users access a Kubernetes deployment.

Guest access to shared projects, public pages and self-registration are switched on with environment variables that the web service reads; the real-time service then serves guests through their session. What each switch opens is described in Public Access.

Service	web (and real-time for guests in the editor), in every Ayakaleaf Pro pod; read when web starts
Pod → outside	the SMTP server, when registration sends activation emails
State	guest access tokens in the session, registration rate limits in Redis
Periodic jobs	none

Configuration

Add the switches you need to the ConfigMap overleaf-env:

30-config.yaml (additions)

  # Guests open link-shared projects without an account
  OVERLEAF_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: "true"
  # Signed-out visitors may open /learn, /templates, /devs and view links
  OVERLEAF_ALLOW_PUBLIC_ACCESS: "true"
  # Self-registration: "true", or only some domains
  OVERLEAF_ALLOW_PUBLIC_REGISTRATION: "@example.com, @*.uni.example"

kubectl apply -f 30-config.yaml
kubectl -n overleaf rollout restart deployment/overleaf     # or statefulset/overleaf

Quote every value. Values that start with @ must be quoted in YAML, otherwise kubectl apply rejects the file.

Registration limited to domains sends an activation email, so Email delivery must work from the pods: put the SMTP host into the ConfigMap and OVERLEAF_EMAIL_SMTP_PASS into the Secret.

Several replicas

Nothing extra. A guest’s access to a project is kept in the session in Redis, so the editor works on whichever replica the load balancer picks.

Tested on Kubernetes

On Kubernetes 1.37, our end-to-end tests for public access pass: on one replica, self-registration with OVERLEAF_ALLOW_PUBLIC_REGISTRATION set to true, to one domain, to several domains with a subdomain wildcard and to @*, with the activation email for the domain modes (43 cases); signed-out visitors on /devs and a posted snippet kept through the login with OVERLEAF_ALLOW_PUBLIC_ACCESS (2 cases); a signed-out guest in a link-shared project with both switches on (3 cases); and on three replicas behind HAProxy, OIDC together with public access (1 case).