Prometheus doesn't come with server-side security features out of the box, but there's many options out there to provide them.
I'll presume that you've already a Prometheus running locally on port 9090. There's many pieces of software that implement all the TLS features you could want, here I'm going to use Caddy. To start off download Caddy and configure it with a self-signed cert:
wget https://github.com/caddyserver/caddy/releases/download/v1.0.3/caddy_v1.0.3_linux_amd64.tar.gz tar -xzf caddy_v*_linux_amd64.tar.gz cat > Caddyfile << EOF localhost:443 tls self_signed proxy / localhost:9090 EOF # Allow caddy to bind to 443. sudo setcap cap_net_bind_service=+ep caddy ./caddy
If you now visit (and bypass the security warning about the self-signed cert) you'll see Prometheus:
This is fine for local testing, but a real cert is needed for production. You can use Let's Encrypt for this, so change the configuration to use a real DNS working name:
cat > Caddyfile << EOF # Put in your own domain and email address here. demo.robustperception.io:443 tls your.email@example.com proxy / localhost:9090 EOF # -agree is to the CA's Terms and Conditions ./caddy -agree
And if you visit your website you'll see it's serving properly over HTTPS:
This isn't quite everything. Prometheus is probably still listening on all interfaces, allowing bypassing of Caddy. You can pass --web.listen-address=localhost:9090 to Prometheus to have it only listen locally. Another issue is that Prometheus doesn't know about the proper URL to use in alerts etc., which in this example can be handled with --web.external-url=https://demo.robustperception.io.
Need help securing Prometheus? Contact us.
No comments.