> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Public Access

> Let guests, signed-out visitors and new users access a Kubernetes deployment.

Guest access to shared projects, public pages and self-registration are switched on with environment variables that the **web** service reads; the real-time service then serves guests through their session. What each switch opens is described in [Public Access](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/overleaf-toolkit/authentication/public-access.md).

| | |
| - | - |
| Service | web (and real-time for guests in the editor), in every Ayakaleaf Pro pod; read when web starts |
| Pod → outside | the SMTP server, when registration sends activation emails |
| State | guest access tokens in the session, registration rate limits in Redis |
| Periodic jobs | none |

### Configuration

Add the switches you need to the ConfigMap `overleaf-env`:

```yaml title="30-config.yaml (additions)" theme={null}
  # Guests open link-shared projects without an account
  OVERLEAF_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: "true"
  # Signed-out visitors may open /learn, /templates, /devs and view links
  OVERLEAF_ALLOW_PUBLIC_ACCESS: "true"
  # Self-registration: "true", or only some domains
  OVERLEAF_ALLOW_PUBLIC_REGISTRATION: "@example.com, @*.uni.example"
```

```bash theme={null}
kubectl apply -f 30-config.yaml
kubectl -n overleaf rollout restart deployment/overleaf     # or statefulset/overleaf
```

Quote every value. Values that start with `@` must be quoted in YAML, otherwise `kubectl apply` rejects the file.

Registration limited to domains sends an activation email, so [Email delivery](https://ayakaleaf-pro.mintlify.site/on-premises/configuration/kubernetes/email-delivery.md) must work from the pods: put the SMTP host into the ConfigMap and `OVERLEAF_EMAIL_SMTP_PASS` into the Secret.

### Several replicas

Nothing extra. A guest's access to a project is kept in the session in Redis, so the editor works on whichever replica the load balancer picks.

### Tested on Kubernetes

On Kubernetes 1.37, our end-to-end tests for public access pass: on one replica, self-registration with `OVERLEAF_ALLOW_PUBLIC_REGISTRATION` set to `true`, to one domain, to several domains with a subdomain wildcard and to `@*`, with the activation email for the domain modes (43 cases); signed-out visitors on `/devs` and a posted snippet kept through the login with `OVERLEAF_ALLOW_PUBLIC_ACCESS` (2 cases); a signed-out guest in a link-shared project with both switches on (3 cases); and on three replicas behind HAProxy, OIDC together with public access (1 case).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.