Skip to content
Snippets Groups Projects

Change Prometheus related exporters to only listen on localhost

Description

Since Prometheus is packaged inside of Omnibus, and by default all of these services run on the same server we can make optimizations for network security given the volume of ports that Prometheus related services will need. (Exporters for Redis, Postgres, Omnibus, Node, etc.)

We should then provide options in gitlab.rb to listen more broadly if their deployment should require it.

Proposal

By default set Prometheus exporters to listen on localhost only.

Provide a new configuration setting in gitlab.rb allow the exporter to listen for external connections.

Links / references