From d38573a9ebab945a0de970553c7c1ecc27a7fb6d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 28 Jul 2026 07:20:22 +0300 Subject: [PATCH] Expose ntfy metrics like the metrics of other services The playbook exposes service metrics under a single endpoint (`https://matrix.example.com/metrics/*`), controlled by `matrix_metrics_exposure_enabled` and friends. ntfy was not wired into this at all, so enabling metrics exposure did not expose ntfy's metrics and enabling Basic Authentication did not protect them. We have ntfy serve its metrics on a dedicated port, instead of on its regular HTTP port. Serving them on the regular HTTP port also makes them reachable at `https://ntfy.example.com/metrics`, where nothing protects them, as ntfy does not apply its own access-control rules to the metrics endpoint. Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5468 Co-Authored-By: Claude Opus 5 (1M context) --- docs/configuring-playbook-prometheus-grafana.md | 2 ++ group_vars/matrix_servers | 15 +++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md index 41f14cb98..3b022a987 100644 --- a/docs/configuring-playbook-prometheus-grafana.md +++ b/docs/configuring-playbook-prometheus-grafana.md @@ -183,6 +183,8 @@ Name | Description `prometheus_postgres_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [Postgres exporter](#enable-metrics-and-graphs-for-postgres-optional) metrics on `https://matrix.example.com/metrics/postgres-exporter`. `prometheus_nginxlog_exporter_enabled`|Set this to `true` to enable the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) (locally, on the container network). `prometheus_nginxlog_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) metrics on `https://matrix.example.com/metrics/nginxlog`. +`ntfy_metrics_listen_http_port`|Set this to a port number (e.g. `9090`) to make [ntfy](configuring-playbook-ntfy.md) serve its metrics (locally, on the container network) on that port. +`ntfy_container_labels_traefik_metrics_enabled`|Set this to `true` to expose the [ntfy](configuring-playbook-ntfy.md) metrics on `https://matrix.example.com/metrics/ntfy`. ### Expose metrics of other services/roles diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 1664047b6..a866f9e71 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -4408,6 +4408,21 @@ ntfy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxya ntfy_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" ntfy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" +# We have ntfy serve its metrics endpoint on a dedicated port, instead of on the regular HTTP port. +# Were it served on the regular HTTP port, the endpoint would also become reachable at `https://ntfy.example.com/metrics`. +# Nothing protects it there, because ntfy does not apply its own access-control rules to the metrics endpoint. +ntfy_metrics_listen_http_port: "{{ 9090 if matrix_metrics_exposure_enabled else '' }}" + +ntfy_container_labels_traefik_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}" + +# For consistency with other things hosted at the Matrix FQN, we adjust the metrics endpoint +# so that metrics would be served at something like `/metrics/SERVICE_NAME`, and not at the default path for the role (`/metrics`). +ntfy_container_labels_traefik_metrics_hostname: "{{ matrix_server_fqn_matrix }}" +ntfy_container_labels_traefik_metrics_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/ntfy" + +ntfy_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}" +ntfy_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}" + ntfy_visitor_request_limit_exempt_hosts_hostnames_auto: | {{ [matrix_server_fqn_matrix]