continuwuation/continuwuity

Fork 10

Prometheus metrics exporting #811

New issue

Open

opened 2025-04-30 17:49:01 +00:00 by Jade · 6 comments

Jade commented

2025-04-30 17:49:01 +00:00

Owner

note we can't leave /metrics on by default as many people expose all routes on their continuwuity deployment

❤️ 1

tcpipuk commented

2025-04-30 17:51:04 +00:00

Owner

I guess there's potentially an option to open a second listener for metrics, so it can run in a separate thread on a different port? That would add complexity, but would replicate one of the (unintentionally?) useful features of the multiple listeners in Synapse.

Jade commented

2025-04-30 17:53:31 +00:00

Author

Owner

Yeah, this and HTML web interface ones are the ones I'd like people to be able to put on separate interfaces, although at that point, it makes sense to separate federation endpoints, too. The challenge is giving that flexibility without introducing a bunch of complexity in configuration.

tcpipuk commented

2025-04-30 17:59:00 +00:00

Owner

That said, it wouldn't be terribly difficult to provide example config for all the major reverse proxies to show how to handle the metrics endpoint securely, so maybe it would be easier overall to just keep everything on one port? 🤔

I think separating client and federation mainly risks complicating reverse proxy setup, which at the moment is one of our strengths - people coming from Synapse are often amazed at the simplicity of just forwarding everything to one port. That said, it wouldn't be terribly difficult to provide example config for all the major reverse proxies to show how to handle the metrics endpoint securely, so maybe it would be easier overall to just keep everything on one port? 🤔

Jade commented

2025-04-30 18:02:32 +00:00

Author

Owner

Yeah the simplest default situation is to have everything on one port under matrix.sub and have sub/.well_know/matrix forwarded to matrix.sub, and then have the reverse proxy block /metrics. The challenge is when people want to start putting the HTML auth pages under a different domain. I guess that probably counts as an extra feature that's not needed for the initial implementation though.

nex added the

Enhancement

label 2025-05-01 13:34:11 +00:00

magmaus3 commented

2025-05-04 11:25:26 +00:00

what about making the metrics endpoint restrict requests to local connections only?

Jade commented

2025-05-04 19:24:32 +00:00

Author

Owner

what about making the metrics endpoint restrict requests to local connections only?

I guess that would be possible, but it opens the doors to issues with misconfiguration or spoofing if we allow reading the IP from a header for reverse proxies.

We could also allow configuring basic authentication, as most Prometheus implementations support that

> what about making the metrics endpoint restrict requests to local connections only? I guess that would be possible, but it opens the doors to issues with misconfiguration or spoofing if we allow reading the IP from a header for reverse proxies. We could also allow configuring basic authentication, as most Prometheus implementations support that

No milestone

No project

No assignees

3 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: continuwuation/continuwuity#811

No description provided.

Rows
Columns