Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →If Nomad ACL enforcement is not active, the agent HTTP API does not check who is calling it. Anyone who can reach the API’s address and port can send requests to it. Whether that means the whole Internet or only one host depends on how the API is bound, not on ACLs.
“Without ACLs” can describe two different states, and they behave differently. In one, ACL enforcement is disabled. In the other, ACLs are enabled but unauthenticated requests are handled by the anonymous token, which is denied by default. Start by confirming which one you have.
As an Amazon Associate I earn from qualifying purchases.
Two configurations that both get called “no ACLs”
The Nomad agent configuration reference lists ACL enforcement as optional and disabled by default. HashiCorp also states that all agents in a cluster should use the same acl.enabled value, so a single server with a different setting is not a safe way to test. When ACLs are enabled, a request without an X-Nomad-Token header is evaluated against the anonymous token instead of being rejected outright.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Setting | Does a request need a token? | What an anonymous request receives | What protects the API |
|---|---|---|---|
ACL enforcement disabled (acl.enabled false) |
No token check is performed | Not applicable; ACLs do not gate requests | Only the bind address and network controls |
| ACLs enabled, no anonymous policy | Yes, in effect | Denied by default | ACL policies, plus bind address and network controls |
| ACLs enabled, scoped anonymous policy | Only for requests that need more than the anonymous policy grants | The capabilities granted by that anonymous policy, and nothing more | ACL policies, the anonymous policy’s grants, plus network controls |
The third row is the one most often misread. An anonymous policy is an intentional grant of selected capabilities to unauthenticated callers. HashiCorp warns against giving anonymous callers overly permissive access, so treat it as a deliberate allowance, not a convenience.
#1 Best Overall
- 【Powerful Load-bearing】12U Network Rack Open Frame is constructed from durable cold rolled steel; Rack shelf supports enhance stability, wall-mounted capacity of 130lbs, the ground-mounted up to 260lbs
- 【Considerate Designs】Open-frame layout, including a top panel adding space, anti-slip shelf stops fixing devices and compatible racks for stack and expansion to meet requirements of home server rack
- 【Complete Accessories】A 12U open frame server rack, two ventilated shelves, four shelf stops, four velcro straps and a set of equipment mounting screws
- 【Versatile Application】Ideal for space-efficient multi-device setups in warehouses, retail, classrooms, offices and more; Excellent choices as AV Rack/IT Rack
- 【Effortless Setup】 Network Rack includes hardware, a comprehensive manual, mounting hole drilling template and an online assembly video to simplify setup
Who can reach the API depends on the bind address
The Nomad HTTP API is RESTful, is used to query and modify system state, and serves routes under the /v1/ prefix. Its default port is 4646. The configured address decides exposure: a loopback address limits access to the local host, while a public IP can expose the API to the public Internet. HashiCorp explicitly says that binding to a public address is not recommended.
This matters even when ACLs are fully enabled. An ACL denies anonymous requests, but it does not stop a request from reaching the listener, and it does not protect the agent from connection-level exposure. Confirm the bind address on every server and client, then confirm what your firewall or proxy allows to reach port 4646.
Rank #2
- Save valuable floor space: 6U wall mount server cabinet Dimensions: 13.78" H x21.65" W x17.72" D.Maximum mounting depth is 14.2"
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access. Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punch-out panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
What enabling ACLs changes
When ACL enforcement is on, requests are evaluated against tokens and the policies attached to them. Policies are defined in terms of capabilities. A caller presents a token either through the X-Nomad-Token header or through a Bearer authorization header:
Authorization: Bearer <token>HashiCorp recommends TLS whenever authentication is used, because tokens sent over plain HTTP can be read by anyone on the path. Enabling ACLs without TLS therefore protects against unauthenticated callers but not against traffic interception.
Rank #3
- Save valuable floor space: 12U wall mount server cabinet Dimensions: 24.25" H x21.65" W x17.72" D. MAXIMUM MOUNTING DEPTH is 14.2".
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access; Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punchout panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
Endpoints that can be reached without a token
Do not assume every endpoint requires an ACL token. HashiCorp’s Nomad Security Model identifies /v1/metrics and /v1/status/peers as endpoints that may be accessed without an ACL token. Whether they are exposed to anyone who can reach the HTTP address depends on TLS client verification: the documentation describes that exposure when tls.verify_https_client=false.
HashiCorp’s guidance for these endpoints is to place a reverse proxy or another external restriction in front of them. Mutual TLS, which HashiCorp recommends alongside ACLs, is the setting to check first, because it changes whether these two endpoints are reachable by any client that can connect.
Rank #4
- ADJUSTABLE DEPTH: 4-Post 42U open frame server rack with 4 vertical rails and adjustable mounting depth 22" to 40" (56,0cm to 101,7cm); Compatible with various servers / switches / data / AV and other IT equipment; EIA/ECA-310-E Compliant
- EASY ASSEMBLY: Mobile network rack with easy-to-follow assembly instructions and online video; Compact flat-pack shipping to avoid damage and facilitate installation; Total product height of 80.3in (204 cm) with casters, 78in (198cm) without casters
- COLD ROLLED STEEL: Durable 4 Post 19in open frame rack designed for ventilation with 42U mounting height and 1320lb (600kg) weight capacity (stationary); 3 install options included: casters, levelling feet, or base-plate to secure rack to the floor
- HARDWARE INCLUDED: Rolling computer/data rack includes cage nuts and screws to mount equipment, easy to read Units (U) and depth adjustment markings, cable management hooks for organization, and required assembly tools
- THE IT PRO'S CHOICE: Designed and built for IT Professionals, this 42U rack is backed for 2-years, including free lifetime 24/5 multi-lingual technical assistance
The Task API is a separate case
The Task API is not the same as the agent HTTP API. It always requires authentication, even when ACL enforcement is disabled. Once ACLs are enabled, normal endpoint authorization applies after authentication. Do not carry this exception over to the agent HTTP API; the rules above still govern that surface.
How to check a cluster
- Confirm the Nomad release running on each server and client, and open the HashiCorp documentation for that exact version. Behavior and configuration keys can change between releases.
- Inspect the effective agent configuration on every server and client. Look for
acl.enabledand make sure all agents report the same value. - If ACLs are enabled, check whether an anonymous policy exists. If none is set, anonymous requests are denied by default. If one is set, list exactly which capabilities it grants and treat any broad grant as a finding.
- Verify the bind address. A loopback address keeps the API to the local host; a public address makes it reachable from wherever your network path allows.
- Test reachability of port 4646 from outside the intended network segment, and check any firewall rules or reverse proxy in the path.
- Check TLS settings. Confirm that TLS is in use for authenticated traffic, and review
tls.verify_https_client, since it determines whether/v1/metricsand/v1/status/peersare reachable without a token. - If either endpoint is reachable by clients that should not see it, restrict it with a reverse proxy or external control.
What the security model says about the whole system
HashiCorp’s Nomad Security Model states: “Nomad’s security model is applicable only if all parts of the system are running with a secure configuration; Nomad is not secure-by-default.” The point is that ACLs are one control among several. A correct ACL setting on one agent does not compensate for an unsafe bind address, a permissive anonymous policy, or a token-free endpoint left open to the network.
Best Value
- 【Powerful load-bearing】 Constructed from durable Cold Rolled Steel, Rack Shelf Back Support enhances stability, wall-mounted capacity of 130lbs, the ground-mounted up to 260lbs
- 【Considerate Designs】Open-frame layout, including a top panel adding space, Anti-Slip Shelf Stops fixing devices and compatible racks for stack and expansion to meet requirements of home server rack
- 【Complete Accessories】A 16U open frame server rack, two ventilated shelves, four shelf stops, four velcro straps and a set of equipment mounting screws
- 【Versatile Application】Ideal for space-efficient multi-device setups in warehouses, retail, classrooms, offices and more; Excellent choices as AV Rack/IT Rack
- 【Effortless Setup】 Network Rack includes hardware, a comprehensive manual, mounting hole drilling template and an online assembly video to simplify setup
The official security guidance does not give a per-release list of which endpoints are token-free, so check the version-matched documentation before relying on any specific endpoint behavior in production.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
