contrib/nginx should lock down prometheus server and alertmanager

[johnmccabe]

Expected Behaviour

Currently the nginx auth conf in contrib/nginx/gateway.conf only locks down the OpenFaaS gateway, it should also lock down the Prometheus Server and Alertmanager, both UIs and APIs.

Current Behaviour

Currently the both the Prometheus Server and Alertmanager are exposed.

A bad actor could delete series data from prometheus

curl -XDELETE -g 'http://localhost:9090/api/v1/series?match[]=gateway_service_count'

Or create a new silence to suppress alerts.

Possible Solution

Add new server entries for 9090 and 9093 to the gateway.conf.

Steps to Reproduce (for bugs)

1. Run OpenFaaS
2. Follow the current NGINX Basic Auth guide
3. Confirm that 9090 and 9093 are exposed without auth.

Context

Observed when testing the cli updates.

Your Environment

• Docker version docker version (e.g. Docker 17.0.05 ):
  17.09.0-ce
• Are you using Docker Swarm or Kubernetes (FaaS-netes)?
  Swarm
• Operating System and version (e.g. Linux, Windows, MacOS):
  Ubuntu
• Link to your project or a code example to reproduce issue:
  n/a

[johnmccabe]

@alexellis I can raise a PR to address this if you haven't already.

[alexellis]

I wonder if we could mitigate partially by taking the port off AlertManager by default.

[alexellis]

Can you add a footnote to the Nginx guide for the Prometheus proxy support? Good thinking about this.

[johnmccabe]

Derek assign: johnmccabe

[alexellis]

Derek assign: me

[alexellis]

Derek add label: priority/middle

[alexellis]

Derek close