I agree that giving back through opensource software is important (and I have had several PR’s accepted, others in “review”). Overall I believe GL has made leaps and bounds with doing a better job at limiting API calls based on role. But the overall role structure is not ideal. Having a admin role is great. Having a reader role is great, but I believe the Reader role is a bit relaxed. Since everyone gets a reader role. There is no way to limit the default permissions that the reader has. Not all users need access to Input, Indexcluster, etc. Yes, I can go make a PR to apply these changes to GL and remove the Input role by default. But really when creating a role there should be a way to apply/remove permissions that are default.
@jryan use case is this… If someone who does not have development/code experience wants to limit API access, adding a proxy may be a more ideal/easier solution.
Overall you are saying that the end-users of your product need to be able to code to make the product more secure (by default). Where as not all of your end-users have the experience to do so. I would say however, that your average Graylog admin does have sysadmin/devops experience. So why not have a means to provide a solution that allows them to have a more strict grasp on the API? You can all have your recommend roles/permissions and if a user wants to limit routes (knowing it may break some of the frontend) then they can.
I’m happy to put this in a Github issue, but your community forum seemed more appropriate for a discussion.