Verified Commit caa81be7 authored by Jan Alexander Steffens (heftig)'s avatar Jan Alexander Steffens (heftig)
Browse files

matrix: Use Bearer authentication for metrics

!473
parent bdfc6c2c
Pipeline #10048 passed with stage
in 32 seconds
This diff is collapsed.
......@@ -42,7 +42,6 @@ matrix_nginx_config:
- "/_matrix"
- "/_synapse"
matrix_metrics_htpasswd: /etc/nginx/auth/matrix_metrics
matrix_metrics_endpoints:
- name: synapse.homeserver
port: 8019
......
......@@ -28,7 +28,6 @@
- pkgconf
- postgresql-libs
- python
- python-passlib
- redis
- tcl
- tk
......@@ -246,20 +245,11 @@
group: synapse
mode: 0640
- name: create htpasswd for matrix metrics endpoint
htpasswd:
path: "{{ matrix_metrics_htpasswd }}"
name: "{{ vault_matrix_secrets.metrics_user }}"
password: "{{ vault_matrix_secrets.metrics_password }}"
owner: root
group: http
mode: 0640
- name: make nginx log dir
file: path=/var/log/nginx/{{ matrix_domain }} state=directory owner=root group=root mode=0755
- name: set up nginx
template: src=nginx.d.conf.j2 dest=/etc/nginx/nginx.d/matrix.conf owner=root group=root mode=0644
template: src=nginx.d.conf.j2 dest=/etc/nginx/nginx.d/matrix.conf owner=root group=root mode=0640
notify:
- reload nginx
when: 'matrix_domain is defined'
......
......@@ -50,20 +50,21 @@ server {
{% endfor %}
{% endfor %}
location /metrics {
auth_basic "Matrix metrics";
auth_basic_user_file {{ matrix_metrics_htpasswd }};
{% for ep in matrix_metrics_endpoints %}
location = /metrics/{{ ep.name }} {
proxy_pass http://127.0.0.1:{{ ep.port }}/{{ ep.path | default('') }};
location = /metrics/{{ ep.name }} {
if ($http_authorization != "Bearer {{ vault_matrix_secrets.metrics_token }}") {
return 403;
}
proxy_pass http://127.0.0.1:{{ ep.port }}/{{ ep.path | default('') }};
}
{% endfor %}
location = /metrics {
default_type text/plain;
return 200 "Available endpoints:\n{% for ep in matrix_metrics_endpoints %} /metrics/{{ ep.name }}\n{% endfor %}";
location = /metrics {
if ($http_authorization != "Bearer {{ vault_matrix_secrets.metrics_token }}") {
return 403;
}
default_type text/plain;
return 200 "Available endpoints:\n{% for ep in matrix_metrics_endpoints %} /metrics/{{ ep.name }}\n{% endfor %}";
}
location = / {
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment