Serve metrics optionally via HTTPS

Author: polarctos

internal/cmd/run.go

@@ -28,6 +28,7 @@ func newRunCommand() *runCommand {
 	runCommand.cmd.Flags().IntVar(&globalConfig.HttpPort, "http-port", getEnvInt("HTTP_PORT", server.DefaultHttpPort), "Port to serve HTTP traffic on")
 	runCommand.cmd.Flags().IntVar(&globalConfig.HttpsPort, "https-port", getEnvInt("HTTPS_PORT", server.DefaultHttpsPort), "Port to serve HTTPS traffic on")
 	runCommand.cmd.Flags().IntVar(&globalConfig.MetricsPort, "metrics-port", getEnvInt("METRICS_PORT", 0), "Publish metrics on the specified port (default zero to disable)")
+	runCommand.cmd.Flags().BoolVar(&globalConfig.MetricsHttps, "metrics-https", getEnvBool("METRICS_HTTPS", false), "Enable HTTPS for the metrics port (default false for HTTP)")
 
 	return runCommand
 }

internal/server/config.go

@@ -13,11 +13,11 @@ const (
 )
 
 type Config struct {
-	Bind        string
-	HttpPort    int
-	HttpsPort   int
-	MetricsPort int
-
+	Bind               string
+	HttpPort           int
+	HttpsPort          int
+	MetricsPort        int
+	MetricsHttps       bool
 	AlternateConfigDir string
 }
 

internal/server/server.go

@@ -173,10 +173,17 @@ func (s *Server) startMetricsServer() error {
 		Addr:    addr,
 		Handler: handler,
 	}
+	if s.config.MetricsHttps {
+		s.metricsServer.TLSConfig = &tls.Config{
+			MinVersion:     tls.VersionTLS13,
+			GetCertificate: s.router.GetCertificate,
+		}
+		go s.metricsServer.ServeTLS(s.metricsListener, "", "")
+	} else {
+		go s.metricsServer.Serve(s.metricsListener)
+	}
 
-	go s.metricsServer.Serve(s.metricsListener)
-
-	slog.Info("Metrics enabled", "address", addr)
+	slog.Info("Metrics enabled", "port", s.config.MetricsPort, "https", s.config.MetricsHttps)
 
 	return nil
 }