vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: the published vhost refuses /metrics

Browse source 
Grafana runs with metrics.enabled and no basic_auth_*, so its Prometheus
exposition was served to any anonymous client of grafana.<swarm> through
the published vhost's `location "/"`. Add an exact-match `= /metrics`
location returning 403 there. The loopback `grafana-metrics` vhost and
the collector's scrape of it are unchanged.

Comments on the metricsPort option and the loopback vhost now state that
the published vhost refuses /metrics; the gateway doc says the same.
A module-eval case pins the refusing location and that `/` still proxies.
This commit is contained in:
atlas 2026-10-13 10:23:57 +02:00 • committed by mara
commit 6c9c2cef45
4 changed files with 28 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/swarm-grafana-service.nix
View file

@ -72,7 +72,9 @@ in
{option}`services.hyperhive.swarm.otel.scrapeTargets` has: those
targets are trusted by *proximity* rather than by credential.
Deliberately **not** the published `grafana.<domain>` vhost, which
would put an authorization decision in front of a scrape.
would put an authorization decision in front of a scrape: that vhost
answers `/metrics` with 403, because Grafana serves it without
authentication.
The number itself is arbitrary and free today;
`state/eval-port-collisions.sh` is what keeps it that way, since a

10
nix/host-modules/swarm-grafana.nix
View file

@ -458,6 +458,13 @@ in
services.nginx.virtualHosts."${cfg.domain}" = (gatewayCfg.lib.tlsFor cfg.domain) // {
listen = gatewayCfg.lib.listen;
extraConfig = gatewayCfg.lib.securityHeaders;
# Grafana serves its Prometheus exposition to anyone, signed in or not
# (`metrics.enabled` below, no `basic_auth_*`), so the published name
# refuses it; the scrape goes through the loopback `grafana-metrics`
# vhost instead. `=` is enough: nginx matches the decoded, normalised
# path, so `//metrics`, `/./metrics`, `/%6detrics` and `/metrics?x` all
# land here, and Grafana itself answers `/metrics/` with a login redirect.
locations."= /metrics".return = "403";
locations."/" = {
proxyPass = "http://unix:${socketPath}:/";
proxyWebsockets = true;
@ -484,7 +491,8 @@ in
# ⚠️ `= /metrics` is an EXACT match, not a prefix: it is the difference
# between exposing one endpoint and re-serving the whole of Grafana on an
# unauthenticated port. Widening it would be a silent authorization bypass,
# since nothing else about this block would have to change.
# since nothing else about this block would have to change. The published
# vhost above refuses `/metrics`, so this listener is the only way to it.
services.nginx.virtualHosts."grafana-metrics" = {
listen = [
{