feat: disable metrics endpoint by default

config.go

@@ -28,6 +28,7 @@ type Config struct {
 	WakeOnLanDevices     []WakeOnLanDevice  `json:"wake_on_lan_devices"`
 	EdidString           string             `json:"hdmi_edid_string"`
 	ActiveExtension      string             `json:"active_extension"`
+	MetricsEnabled       bool               `json:"enable_metrics"`
 	DisplayMaxBrightness int                `json:"display_max_brightness"`
 	DisplayDimAfterSec   int                `json:"display_dim_after_sec"`
 	DisplayOffAfterSec   int                `json:"display_off_after_sec"`

prometheus.go

@@ -3,8 +3,10 @@ package kvm
 import (
 	"net/http"
 
+	"github.com/gin-gonic/gin"
 	"github.com/prometheus/client_golang/prometheus"
 	versioncollector "github.com/prometheus/client_golang/prometheus/collectors/version"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/prometheus/common/version"
 )
 
@@ -14,4 +16,17 @@ func initPrometheus() {
 	// A Prometheus metrics endpoint.
 	version.Version = builtAppVersion
 	prometheus.MustRegister(versioncollector.NewCollector("jetkvm"))
+
+	promHandler = promhttp.Handler()
+}
+
+func prometheusCheckAuthMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !config.MetricsEnabled {
+			c.JSON(http.StatusNotFound, gin.H{"error": "Metrics endpoint is disabled"})
+			return
+		}
+
+		c.Next()
+	}
 }

web.go

@@ -12,11 +12,10 @@
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"golang.org/x/crypto/bcrypt"
 )
 
 //go:embed all:static
 var staticFiles embed.FS
 
 type WebRTCSessionRequest struct {
@@ -87,7 +86,7 @@
 	r.POST("/device/setup", handleSetup)
 
 	// A Prometheus metrics endpoint.
-	r.GET("/metrics", gin.WrapH(promhttp.Handler()))
+	r.GET("/metrics", prometheusCheckAuthMiddleware(), gin.WrapH(promHandler))
 
 	// Protected routes (allows both password and noPassword modes)
 	protected := r.Group("/")