Add auth-protected prometheus ui

games/minecraft/docker-compose.yml

@@ -2,7 +2,7 @@ networks:
   minecraft:
     driver: bridge
     name: minecraft
-  grafana:
+  metrics:
     external: true
   traefik:
     external: true
@@ -47,7 +47,7 @@ services:
     container_name: minecraft_creative
     restart: unless-stopped
     networks:
-      - grafana
+      - metrics
       - minecraft
     ports:
       - "25566:25565"
@@ -80,7 +80,7 @@ services:
     container_name: minecraft_2023
     networks:
       - traefik
-      - grafana
+      - metrics
       - minecraft
     ports:
       - "25565:25565"

software-development/infrastructure/grafana/.env.example

@@ -0,0 +1,9 @@
+# Copy to .env and fill in. Docker Compose reads .env automatically.
+
+# Public hostname Traefik routes to the Prometheus UI
+PROMETHEUS_HOST=prometheus.whitney.rip
+
+# Basic auth for the Prometheus UI, in htpasswd format (user:bcrypt-hash).
+# Generate with: htpasswd -nbB admin 'your-password'
+# Keep the single quotes so Compose doesn't treat the $ in the hash as variables.
+PROMETHEUS_BASIC_AUTH='admin:$2y$05$replace_with_generated_hash'

software-development/infrastructure/grafana/.gitignore

@@ -0,0 +1 @@
+.env

software-development/infrastructure/grafana/README.md

@@ -6,6 +6,9 @@
 Create/Fill in the following files in a `grafana` directory under this one using the templates.
 - `grafana.ini`
 - `prometheus.yml`
+- `.env` (copy from `.env.example`; holds the Prometheus hostname and basic auth hash for Traefik)
+
+Generate the basic auth value with `htpasswd -nbB admin 'your-password'` and paste it into `.env`, keeping the single quotes.
 
 ### Volumes
 Make sure that in additionto mounting the 2 files above to their respective containers, grafana container has the following mount:

software-development/infrastructure/grafana/docker-compose.yml

@@ -1,7 +1,7 @@
 networks:
-  grafana:
+  metrics:
     driver: bridge
-    name: grafana
+    name: metrics
   traefik:
     external: true
   minecraft:
@@ -17,7 +17,7 @@ services:
     container_name: grafana
     restart: unless-stopped
     networks:
-      - grafana
+      - metrics
       - traefik
     volumes:
       - ./grafana.ini:/etc/grafana/grafana.ini
@@ -37,7 +37,7 @@ services:
     user: "1003:1005"
     restart: unless-stopped
     networks:
-      - grafana
+      - metrics
     pid: host
     command:
       - "--path.rootfs=/host"
@@ -53,8 +53,8 @@ services:
     container_name: prometheus
     restart: always
     networks:
-      - grafana
-      - minecraft
+      - metrics
+      - traefik
     volumes:
       - "./prometheus.yml:/etc/prometheus.yml"
       - prometheus_data:/prometheus
@@ -64,5 +64,12 @@ services:
       - "--web.console.libraries=/usr/share/prometheus/console_libraries"
       - "--web.console.templates=/usr/share/prometheus/consoles"
     labels:
-      - traefik.enable=false
+      - traefik.enable=true
+      - traefik.docker.network=traefik
+      - traefik.http.routers.prometheus.rule=Host(`${PROMETHEUS_HOST}`)
+      - traefik.http.routers.prometheus.tls=true
+      - traefik.http.routers.prometheus.tls.certresolver=lets-encrypt
+      - traefik.http.routers.prometheus.middlewares=prometheus-auth
+      - traefik.http.middlewares.prometheus-auth.basicauth.users=${PROMETHEUS_BASIC_AUTH}
+      - traefik.http.services.prometheus.loadbalancer.server.port=9090