vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: the published vhost refuses /metrics

Browse source 
Grafana runs with metrics.enabled and no basic_auth_*, so its Prometheus
exposition was served to any anonymous client of grafana.<swarm> through
the published vhost's `location "/"`. Add an exact-match `= /metrics`
location returning 403 there. The loopback `grafana-metrics` vhost and
the collector's scrape of it are unchanged.

Comments on the metricsPort option and the loopback vhost now state that
the published vhost refuses /metrics; the gateway doc says the same.
A module-eval case pins the refusing location and that `/` still proxies.
This commit is contained in:
atlas 2026-10-13 10:23:57 +02:00 • committed by mara
commit 6c9c2cef45
4 changed files with 28 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/module-eval/grafana.nix
View file

@ -121,6 +121,21 @@ let
grafanaOldPath.services.nginx.virtualHosts."grafana-metrics".locations."= /metrics".proxyPass
== "http://unix:/run/swarm-grafana/grafana.sock:/metrics";
}
{
# Grafana serves `/metrics` unauthenticated, so the published name must
# answer it itself; the scrape reads the loopback vhost above instead.
# `=` is what catches the normalised variants and still leaves the rest
# of Grafana proxied.
name = "grafana's published vhost refuses /metrics and still proxies everything else";
ok =
let
g = grafanaOldPath.services.hyperhive.swarm.grafana;
locs = grafanaOldPath.services.nginx.virtualHosts.${g.domain}.locations;
in
locs."= /metrics".return == "403"
&& locs."= /metrics".proxyPass == null
&& lib.hasPrefix "http://unix:" locs."/".proxyPass;
}
{
# This fixture enables grafana and NOT authelia, so the login-form toggle
# has to follow "grafana requires SSO" rather than "both services are on