Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.
Sign upAdd FastCGI interface to secure prometheus (with unix domain socket) #5160
Comments
This comment has been minimized.
This comment has been minimized.
|
Dupe of #4068. This is not something we plan on adding. |
brian-brazil
closed this
Jan 30, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
michael-doubez commentedJan 30, 2019
•
edited
Proposal
Use case. Why is this important?
Currently, when trying to secure Prometheus/AlertManager on a non-containerized architecture, the only way to secure it is binding on localhost and using a reverse-proxy (like nginx).
But, the interface is still exposed on localhost interface and there is no way to restrict the access with basic-auth or tls client auth.
FastCGI
A good middle-ground solution would be to serve the requests using fastcgi. The module "net/http/fcgi" is readily available and fast-cgi seamlessly integrates with major http servers.
On unix, the security would be provided by using unix domain sockets whose access rights can be controlled. On windows, there would be named pipes; although I am not sure it is as common as unix flavor.