spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-07-29 02:44:12 +10:00
Code Issues Packages Projects Releases Wiki Activity

Expose ntfy metrics like the metrics of other services

Browse Source 
The playbook exposes service metrics under a single endpoint
(`https://matrix.example.com/metrics/*`), controlled by
`matrix_metrics_exposure_enabled` and friends. ntfy was not wired into
this at all, so enabling metrics exposure did not expose ntfy's metrics
and enabling Basic Authentication did not protect them.

We have ntfy serve its metrics on a dedicated port, instead of on its
regular HTTP port. Serving them on the regular HTTP port also makes them
reachable at `https://ntfy.example.com/metrics`, where nothing protects
them, as ntfy does not apply its own access-control rules to the metrics
endpoint.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5468

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Slavi Pantaleev
2026-07-28 07:20:22 +03:00
parent ea1003fd18
commit d38573a9eb
2 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuring-playbook-prometheus-grafana.md
+2
View File
@@ -183,6 +183,8 @@ Name | Description
`prometheus_postgres_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [Postgres exporter](#enable-metrics-and-graphs-for-postgres-optional) metrics on `https://matrix.example.com/metrics/postgres-exporter`.
`prometheus_nginxlog_exporter_enabled`|Set this to `true` to enable the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) (locally, on the container network).
`prometheus_nginxlog_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) metrics on `https://matrix.example.com/metrics/nginxlog`.
`ntfy_metrics_listen_http_port`|Set this to a port number (e.g. `9090`) to make [ntfy](configuring-playbook-ntfy.md) serve its metrics (locally, on the container network) on that port.
`ntfy_container_labels_traefik_metrics_enabled`|Set this to `true` to expose the [ntfy](configuring-playbook-ntfy.md) metrics on `https://matrix.example.com/metrics/ntfy`.
### Expose metrics of other services/roles
group_vars/matrix_servers
+15
View File
@@ -4408,6 +4408,21 @@ ntfy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxya
ntfy_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
ntfy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
# We have ntfy serve its metrics endpoint on a dedicated port, instead of on the regular HTTP port.
# Were it served on the regular HTTP port, the endpoint would also become reachable at `https://ntfy.example.com/metrics`.
# Nothing protects it there, because ntfy does not apply its own access-control rules to the metrics endpoint.
ntfy_metrics_listen_http_port: "{{ 9090 if matrix_metrics_exposure_enabled else '' }}"
ntfy_container_labels_traefik_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"
# For consistency with other things hosted at the Matrix FQN, we adjust the metrics endpoint
# so that metrics would be served at something like `/metrics/SERVICE_NAME`, and not at the default path for the role (`/metrics`).
ntfy_container_labels_traefik_metrics_hostname: "{{ matrix_server_fqn_matrix }}"
ntfy_container_labels_traefik_metrics_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/ntfy"
ntfy_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
ntfy_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
ntfy_visitor_request_limit_exempt_hosts_hostnames_auto: |
{{
[matrix_server_fqn_matrix]