poc3

tests/test_config.py

@@ -18,6 +18,25 @@ class ConfigTests(unittest.TestCase):
         with patch.dict(os.environ, {"RULE_UPDATE_INTERVAL_HOURS": "-5"}, clear=True):
             self.assertEqual(Config.from_env().rule_update_interval_hours, 0)
 
+    def test_metrics_acl_defaults_to_loopback_ip_only(self):
+        with patch.dict(os.environ, {}, clear=True):
+            cfg = Config.from_env()
+        self.assertEqual(cfg.metrics_allowed_ips, "127.0.0.1/32,::1/128")
+        self.assertEqual(cfg.metrics_basic_auth_username, "")
+        self.assertEqual(cfg.metrics_basic_auth_password, "")
+
+    def test_metrics_acl_reads_ip_and_basic_auth_from_env(self):
+        env = {
+            "METRICS_ALLOWED_IPS": "10.0.0.5/32,10.0.1.0/24",
+            "METRICS_BASIC_AUTH_USERNAME": "prometheus",
+            "METRICS_BASIC_AUTH_PASSWORD": "secret",
+        }
+        with patch.dict(os.environ, env, clear=True):
+            cfg = Config.from_env()
+        self.assertEqual(cfg.metrics_allowed_ips, env["METRICS_ALLOWED_IPS"])
+        self.assertEqual(cfg.metrics_basic_auth_username, "prometheus")
+        self.assertEqual(cfg.metrics_basic_auth_password, "secret")
+
 
 if __name__ == "__main__":
     unittest.main()