自身暴露的/metrics指标没有鉴权

[caijinhu123]

当前 /metrics 接口没有任何鉴权。任何人都能匿名访问 http://:8080/metrics 拉取指标。能否增加鉴权功能呢

[yhgroup]

发个我自己用的增加basicauth
app.conf增加
basicauth = 1
basicauth-username = prometheus
basicauth-password = $2a$14$XXXXXXXXXXXXXXXXXXXX

main.go文件：
`package main

import (
"PrometheusAlert/models"
_ "PrometheusAlert/routers"
"os"
"path"

"github.com/prometheus/client_golang/prometheus/promhttp"
"github.com/robfig/cron/v3"

"github.com/astaxie/beego"
beecontext "github.com/astaxie/beego/context"
"github.com/astaxie/beego/logs"
"github.com/astaxie/beego/orm"
"github.com/astaxie/beego/plugins/auth"
_ "github.com/go-sql-driver/mysql"
_ "github.com/lib/pq"
_ "github.com/mattn/go-sqlite3"
"golang.org/x/crypto/bcrypt"

)

func IsExist(path string) bool {
_, err := os.Stat(path)
return err == nil || os.IsExist(err)
}

func init() {
dbDriver := beego.AppConfig.String("db_driver")
switch dbDriver {
case "sqlite3":
// 检查数据库文件
DbName := "./db/PrometheusAlertDB.db"
if !IsExist(DbName) {
err := os.MkdirAll(path.Dir(DbName), os.ModePerm)
if err != nil {
logs.Error(err)
return
}
_, err = os.Create(DbName)
if err != nil {
logs.Error(err)
return
}
}
// 注册驱动（“sqlite3” 属于默认注册，此处代码可省略）
err := orm.RegisterDriver("db_driver", orm.DRSqlite)
if err != nil {
logs.Error(err)
return
}
// 注册默认数据库
err = orm.RegisterDataBase("default", "sqlite3", DbName, 10)
if err != nil {
logs.Error(err)
return
}
case "mysql":
err := orm.RegisterDriver("mysql", orm.DRMySQL)
if err != nil {
logs.Error(err)
return
}
dataSource := beego.AppConfig.String("db_user") + ":" + beego.AppConfig.String("db_password") + "@tcp(" + beego.AppConfig.String("db_host") + ":" + beego.AppConfig.String("db_port") + ")/" + beego.AppConfig.String("db_name") + "?charset=utf8mb4"
err = orm.RegisterDataBase("default", "mysql", dataSource)
if err != nil {
logs.Error(err)
return
}
orm.SetMaxIdleConns("default", 10)
orm.SetMaxOpenConns("default", 10)
case "postgres":
err := orm.RegisterDriver("postgres", orm.DRPostgres)
if err != nil {
logs.Error(err)
return
}
dataSource := "user=" + beego.AppConfig.String("db_user") + " password=" + beego.AppConfig.String("db_password") + " dbname=" + beego.AppConfig.String("db_name") + " host=" + beego.AppConfig.String("db_host") + " port=" + beego.AppConfig.String("db_port") + " sslmode=disable"
err = orm.RegisterDataBase("default", "postgres", dataSource)
if err != nil {
logs.Error(err)
return
}
orm.SetMaxIdleConns("default", 10)
orm.SetMaxOpenConns("default", 10)
default:
// 检查数据库文件
Db_name := "./db/PrometheusAlertDB.db"
if !IsExist(Db_name) {
err := os.MkdirAll(path.Dir(Db_name), os.ModePerm)
if err != nil {
logs.Error(err)
return
}
_, err = os.Create(Db_name)
if err != nil {
logs.Error(err)
return
}
}
// 注册驱动（“sqlite3” 属于默认注册，此处代码可省略）
err := orm.RegisterDriver("db_driver", orm.DRSqlite)
if err != nil {
logs.Error(err)
return
}
// 注册默认数据库
err = orm.RegisterDataBase("default", "sqlite3", Db_name, 10)
if err != nil {
logs.Error(err)
return
}
}
// 注册模型
orm.RegisterModel(new(models.PrometheusAlertDB), new(models.AlertRecord), new(models.AlertRouter), new(models.SysConfig))
err := orm.RunSyncdb("default", false, true)
if err != nil {
logs.Error(err)
return
}
models.AlertRouterDBInit()
models.AlertTplDBInit()
models.InitConfigCache()
models.HookBeegoAppConfig()
}

type CustomAccessLogFilter struct{}

func (f *CustomAccessLogFilter) Filter(ctx *beecontext.Context) bool {
return ctx.Request.URL.Path == "/health"
}

func SecretAuth(username, password string) bool {
if username == beego.AppConfig.String("basicauth-username") {
// 比较密码
existingHash := beego.AppConfig.String("basicauth-password") // 示例散列值
err := bcrypt.CompareHashAndPassword([]byte(existingHash), []byte(password))
if err != nil {
logs.Error("Password does not match")
return false
} else {
logs.Info("Password matches")
return true
}
} else {
return false
}

//return username == beego.AppConfig.String("basicauth-username") && password == beego.AppConfig.String("basicauth-password")

}

func main() {
orm.Debug = true
logtype := beego.AppConfig.String("logtype")
if logtype == "console" {
logs.SetLogger(logtype)
} else if logtype == "file" {
logpath := beego.AppConfig.String("logpath")
logs.SetLogger(logtype, {"filename":"+logpath+"})
}

// 定时删除日志
RecordLive, _ := beego.AppConfig.Int("RecordLive")
if RecordLive == 1 {
	RecordLiveDay, _ := beego.AppConfig.Int("RecordLiveDay")
	logs.Info("[main] 告警记录生存周期: %dd", RecordLiveDay)
	c := cron.New(cron.WithSeconds())
	_, err := c.AddFunc("0 0 1 * * *", func() { models.RecordCleanByTime(RecordLiveDay) })
	if err != nil {
		logs.Error(err)
		return
	}
	c.Start()
}
models.MetricsInit()
/*
	// 生成bcrypt散列
	password := "password"
	bytes, _ := bcrypt.GenerateFromPassword([]byte(password), 14) // 成本因子为14，可以根据需要调整
	hashedPassword := string(bytes)
	logs.Info("Hashed Password:", hashedPassword)
*/

if beego.AppConfig.String("basicauth") == "1" {
	//
	//beego.InsertFilter("/prometheus/alert", beego.BeforeRouter,auth.Basic("username","secretpassword"))
	authPlugin := auth.NewBasicAuthenticator(SecretAuth, "Authorization Required")
	beego.InsertFilter("/prometheus/*", beego.BeforeRouter, authPlugin)
	beego.InsertFilter("/tengxun/*", beego.BeforeRouter, authPlugin)
	beego.InsertFilter("/zabbix/*", beego.BeforeRouter, authPlugin)
	beego.InsertFilter("/prometheusalert/*", beego.BeforeRouter, authPlugin)
	beego.InsertFilter("/gitlab/*", beego.BeforeRouter, authPlugin)
	beego.InsertFilter("/-/reload", beego.BeforeRouter, authPlugin)
	beego.InsertFilter("/metrics", beego.BeforeRouter, authPlugin)
}

beego.Handler("/metrics", promhttp.Handler())
beego.BConfig.Log.AccessLogs = true
beego.DefaultAccessLogFilter = &CustomAccessLogFilter{}
beego.Run()

}
`