GamendWeb.Plugs.MetricsAuth (gamend_web v1.0.1216)

Copy Markdown View Source

Authentication for the /metrics endpoint.

Access rules (checked in order):

  1. Loopback (127.x, ::1) — always allowed without auth.

  2. Bearer token — if GAMEND_OBSERVABILITY_METRICS_TOKEN is set, every non-loopback request must include Authorization: Bearer <token>, including private/Docker-internal IPs. (Trusting a private source IP is unsafe behind a proxy that can be made to leave remote_ip as its own private address.)

  3. No token configured — private/Docker-internal IPs are allowed without auth (dev/compose convenience); every other caller is denied. Set the token to scrape from outside the private network.

Configuration

Like push credentials, the setting accepts inline contents or a path to a file holding them (e.g. a docker secret):

# In production — set this to restrict external access
GAMEND_OBSERVABILITY_METRICS_TOKEN=my-secret-prometheus-token
# or, sharing a docker secret with Prometheus's credentials_file:
GAMEND_OBSERVABILITY_METRICS_TOKEN=/run/secrets/metrics_token

Prometheus scrape config with token:

scrape_configs:
  - job_name: "gamend"
    bearer_token: "my-secret-prometheus-token"
    static_configs:
      - targets: ["app:4000"]