poc3

2026-08-16 11:46:35 +02:00
parent e8e5515e24
commit e5d344622e
22 changed files with 3511 additions and 11 deletions
@@ -823,6 +823,37 @@ RouterOS configuration templates

 ---

+## Prometheus `/metrics` ACL
+
+The Prometheus endpoint is restricted independently from the dashboard. The source
+IP/CIDR allowlist is always enforced and is parsed once at startup, so rejected
+scrapes do not render metrics or trigger any application-side calculations.
+
+```dotenv
+# Default: local scrapes only. Exact IPs and CIDRs can be mixed, comma-separated.
+METRICS_ALLOWED_IPS=127.0.0.1/32,::1/128
+
+# Leave both empty for IP-only ACL. Set both for IP + Basic Auth.
+METRICS_BASIC_AUTH_USERNAME=
+METRICS_BASIC_AUTH_PASSWORD=
+```
+
+For example, to allow Prometheus at `192.168.88.50` and require Basic Auth:
+
+```dotenv
+METRICS_ALLOWED_IPS=192.168.88.50/32
+METRICS_BASIC_AUTH_USERNAME=prometheus
+METRICS_BASIC_AUTH_PASSWORD=<long-unique-password>
+```
+
+A client outside the allowlist receives HTTP `403`. A permitted IP with missing or
+invalid Basic Auth receives HTTP `401`. Supplying only one Basic Auth variable is a
+configuration error. An empty `METRICS_ALLOWED_IPS` denies all access. The ACL uses
+the TCP peer address and deliberately ignores `X-Forwarded-For`; when using a reverse
+proxy, allow the proxy address itself.
+
+---
+
 ## Safety defaults

 The default configuration is observation-oriented: