view plugins/mod_http_openmetrics.lua @ 12659:c0eea4f6c739

usermanager: Add back temporary is_admin to warn about deprecated API usage Goal: Introduce role-auth with minimal disruption is_admin() is unsafe in a system with per-session permissions, so it has been deprecated. Roll-out approach: 1) First, log a warning when is_admin() is used. It should continue to function normally, backed by the new role API. Nothing is really using per-session authz yet, so there is minimal security concern. The 'strict_deprecate_is_admin' global setting can be set to 'true' to force a hard failure of is_admin() attempts (it will log an error and always return false). 2) In some time (at least 1 week), but possibly longer depending on the number of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by default. It can still be disabled for systems that need it. 3) Further in the future, before the next release, the option will be removed and is_admin() will be permanently disabled.
author Matthew Wild <mwild1@gmail.com>
date Mon, 15 Aug 2022 15:25:07 +0100
parents b4f77a7bf8ab
children 74b9e05af71e
line wrap: on
line source

-- Export statistics in OpenMetrics format
--
-- Copyright (C) 2014 Daurnimator
-- Copyright (C) 2018 Emmanuel Gil Peyrot <linkmauve@linkmauve.fr>
-- Copyright (C) 2021 Jonas Schäfer <jonas@zombofant.net>
--
-- This module is MIT/X11 licensed.

module:set_global();

local statsman = require "core.statsmanager";
local ip = require "util.ip";

local get_metric_registry = statsman.get_metric_registry;
local collect = statsman.collect;

local get_metrics;

local permitted_ips = module:get_option_set("openmetrics_allow_ips", { "::1", "127.0.0.1" });
local permitted_cidr = module:get_option_string("openmetrics_allow_cidr");

local function is_permitted(request)
	local ip_raw = request.ip;
	if permitted_ips:contains(ip_raw) or
	   (permitted_cidr and ip.match(ip.new_ip(ip_raw), ip.parse_cidr(permitted_cidr))) then
		return true;
	end
	return false;
end

function get_metrics(event)
	if not is_permitted(event.request) then
		return 403; -- Forbidden
	end

	local response = event.response;
	response.headers.content_type = "application/openmetrics-text; version=0.0.4";

	if collect then
		-- Ensure to get up-to-date samples when running in manual mode
		collect()
	end

	local registry = get_metric_registry()
	if registry == nil then
		response.headers.content_type = "text/plain; charset=utf-8"
		response.status_code = 404
		return "No statistics provider configured\n"
	end

	return registry:render();
end

module:depends "http";
module:provides("http", {
	default_path = "metrics";
	route = {
		GET = get_metrics;
	};
});