Skip to content

Conversation

mariovitale1979
Copy link

Proposed changes

In my setup using Bunkerweb, the 'internal' HTTP calls to the stub_status endpoint where blocked by the different security features of Bunkerweb. Only by specifying the Host in the header, nginx_exporter was able to reach the stub_status endpoint

@mariovitale1979 mariovitale1979 requested a review from a team as a code owner October 9, 2025 12:16
Copy link

nginx-bot bot commented Oct 9, 2025

Hi @mariovitale1979! Welcome to the project! 🎉

Thanks for opening this pull request!
Be sure to check out our Contributing Guidelines while you wait for someone on the team to review this.

@nginx-bot nginx-bot bot added the community Issues or PRs opened by an external contributor label Oct 9, 2025
Copy link

github-actions bot commented Oct 9, 2025

✅ All required contributors have signed the F5 CLA for this PR. Thank you!
Posted by the CLA Assistant Lite bot.

@mariovitale1979
Copy link
Author

I have hereby read the F5 CLA and agree to its terms

@vepatel
Copy link

vepatel commented Oct 9, 2025

hi @mariovitale1979, this PR is introducing breaking changes to NewNginxClient so anyone importing that function might be affected.

can you please create a gh issue clearly stating

  • What is the exact requirement
  • How this PR is addressing the issue

@mariovitale1979
Copy link
Author

Well, let me try to explain what issue I had to solve for my setup.
My web-applications are managed by a docker-compose file and as webserver I don't use native nginx but bunkerweb (see https://github.com/bunkerity/bunkerweb) which is basically an nginx wrapper with a bunch of extra security features (ModSecurity, bad behaviour detection, etc etc)
When installing and configuring nginx-prometheus-exporter as documented, I noticed that the call made by nginx-prometheus-exporter to the stub_status endpoint always returned an HTTP 403 error. Problem was not because I didn't allow certain network/ip range. Only solution for me was to add the 'Host' parameter in the Header sent out by nginx-prometheus-exporter.
I'm not a nginx expert but for Bunkerweb that is normal, you you can only reach the stub_status endpoint by doing HTTP calls to a servername that is declared in the bunkerweb config

I hope my explanation helps a bit and I completely admit that maybe this solution is only needed for my particular setup and/or maybe there is a solution that didn't require me to fork this project but after almost 1 full day investigating, i settled with this solution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

community Issues or PRs opened by an external contributor

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants