Merge pull request #525 from linuxserver/deny-metrics

block metrics access by default

Author: nemchik

authelia.subdomain.conf.sample

@@ -42,6 +42,10 @@ server {
         #auth_basic "Restricted";
         #auth_basic_user_file /config/nginx/.htpasswd;
 
+        # block metrics access by default because it is unprotected
+        # you can comment out the next line to enable remote metrics
+        deny all;
+
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app authelia;

authentik.subdomain.conf.sample

@@ -38,6 +38,10 @@ server {
         #auth_basic "Restricted";
         #auth_basic_user_file /config/nginx/.htpasswd;
 
+        # block metrics access by default because it is unprotected
+        # you can comment out the next line to enable remote metrics
+        deny all;
+
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app authentik-server;

grafana.subdomain.conf.sample

@@ -62,6 +62,10 @@ server {
         #auth_basic "Restricted";
         #auth_basic_user_file /config/nginx/.htpasswd;
 
+        # block metrics access by default because it is unprotected
+        # you can comment out the next line to enable remote metrics
+        deny all;
+
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app grafana;

grafana.subfolder.conf.sample

@@ -54,6 +54,10 @@ location ^~ /grafana/metrics {
     #auth_basic "Restricted";
     #auth_basic_user_file /config/nginx/.htpasswd;
 
+    # block metrics access by default because it is unprotected
+    # you can comment out the next line to enable remote metrics
+    deny all;
+
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;
     set $upstream_grafana grafana;

prometheus.subdomain.conf.sample

@@ -73,6 +73,10 @@ server {
         #auth_basic "Restricted";
         #auth_basic_user_file /config/nginx/.htpasswd;
 
+        # block metrics access by default because it is unprotected
+        # you can comment out the next line to enable remote metrics
+        deny all;
+
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app prometheus;