Configure prometheus exporters to be externally accessible (with authentication)

Author: aequitas

docker/compose.development.yaml

@@ -28,7 +28,7 @@ services:
           action: rebuild
     volumes:
       # mount monitoring credentials for testing/development
-      - ./webserver/dev.htpasswd:/etc/nginx/htpasswd/monitoring.htpasswd:ro
+      - ./webserver/dev.htpasswd:/etc/nginx/htpasswd/monitoring.htpasswd
 
   app:
     develop:

docker/compose.integration-tests.yaml

@@ -194,7 +194,7 @@ services:
         ipv4_address: $IPV4_WEBSERVER_IP_PUBLIC
     volumes:
       # mount monitoring credentials for testing/development
-      - ./webserver/dev.htpasswd:/etc/nginx/htpasswd/monitoring.htpasswd:ro
+      - ./webserver/dev.htpasswd:/etc/nginx/htpasswd/monitoring.htpasswd
 
   unbound:
     networks:

docker/compose.yaml

@@ -801,6 +801,7 @@ services:
 
     profiles:
       - monitoring
+      - monitoring-exporters
 
   redis-exporter:
     image: ${DOCKER_IMAGE_REDIS_EXPORTER}
@@ -821,6 +822,7 @@ services:
 
     profiles:
       - monitoring
+      - monitoring-exporters
 
   statsd-exporter:
     image: ${DOCKER_IMAGE_STATSD_EXPORTER}
@@ -844,6 +846,7 @@ services:
 
     profiles:
       - monitoring
+      - monitoring-exporters
 
     healthcheck:
       # container image includes the test command, setting interval and start_interval here
@@ -909,6 +912,7 @@ services:
 
     profiles:
       - monitoring
+      - monitoring-exporters
 
   docker_stats_exporter:
     # https://github.com/jan4843/docker_stats_exporter
@@ -932,6 +936,7 @@ services:
 
     profiles:
       - monitoring
+      - monitoring-exporters
 
   nginx_logs_exporter:
     platform: linux/amd64
@@ -956,6 +961,7 @@ services:
 
     profiles:
       - monitoring
+      - monitoring-exporters
 
   query-exporter:
     image: ${DOCKER_IMAGE_QUERY_EXPORTER}

docker/webserver/nginx_templates/default.conf.template

@@ -321,6 +321,80 @@ server {
         proxy_pass $alertmanager;
     }
 
+    # expose all metrics exporters for external monitoring
+    location /node-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $node_exporter http://node-exporter:9100;
+        proxy_pass $node_exporter;
+    }
+    location /postgresql-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $postgresql_exporter http://postgresql-exporter:9187/metrics;
+        proxy_pass $postgresql_exporter;
+    }
+    location /redis-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $redis_exporter http://redis-exporter:9121/metrics;
+        proxy_pass $redis_exporter;
+    }
+    location /rabbitmq-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $rabbitmq_exporter http://rabbitmq:15692/metrics;
+        proxy_pass $rabbitmq_exporter;
+    }
+    location /statsd-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $statsd_exporter http://statsd-exporter:9102/metrics;
+        proxy_pass $statsd_exporter;
+    }
+    location /celery-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $celery_exporter http://celery-exporter:9808/metrics;
+        proxy_pass $celery_exporter;
+    }
+    location /docker-stats-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $docker_stats_exporter http://docker_stats_exporter:9338/metrics;
+        proxy_pass $docker_stats_exporter;
+    }
+    location /nginx-logs-exporter {
+        include http.headers;
+        include hsts_h3.headers;
+        auth_basic "Please enter your monitoring username and password";
+        auth_basic_user_file /etc/nginx/htpasswd/monitoring.htpasswd;
+        # set proxy_pass argument as variable, this makes sure nginx will still start even if this hostname is unresolvable due to monitoring profile being disabled
+        set $nginx_logs_exporter http://nginx_logs_exporter:4040/metrics;
+        proxy_pass $nginx_logs_exporter;
+    }
+
     # routinator proxy for internal use on multi instance setups
     location /routinator/ {
         include http.headers;