coop-cloud/traefik
7
2
Fork 19
Code Issues 14 Pull Requests 6 Releases Wiki Activity

feat: anubis metrics #127

Open
fauno wants to merge 4 commits from anubis-metrics into master
pull from: anubis-metrics
merge into: coop-cloud:master
Conversation 6 Commits 4 Files Changed 6
+36
6 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.sample
+3
View File
@@ -223,5 +223,8 @@ WRITE_TIMEOUT=0s
#ANUBIS_SERVE_ROBOTS_TXT=true
#ANUBIS_SLOG_LEVEL=INFO
## Anubis metrics
p4u1 marked this conversation as resolved Outdated
p4u1 commented 2026-07-28 20:53:54 +00:00
Outdated
Review
Copy Link
Copy Source

I think we now have two basic with secrets in traefik now. Is there a reason you did not reuse the existing one?

I think we now have two basic with secrets in traefik now. Is there a reason you did not reuse the existing one?
fauno commented 2026-07-28 22:29:49 +00:00
Outdated
Review
Copy Link
Copy Source

if you're refering to basic auth, that secret contains the whole usersfile:

https://git.coopcloud.tech/coop-cloud/traefik/src/branch/master/compose.basicauth.yml

if you're refering to basic auth, that secret contains the whole usersfile: https://git.coopcloud.tech/coop-cloud/traefik/src/branch/master/compose.basicauth.yml
p4u1 commented 2026-07-29 14:06:32 +00:00
Outdated
Review
Copy Link
Copy Source

OK so they are specified in a differnt way. But I would still prefer if we habe only one way to set the basicnauth for metrics. Maybe we should deprecate the old usersfile? Or if we keep both secrets the new secret should be named more specific

OK so they are specified in a differnt way. But I would still prefer if we habe only one way to set the basicnauth for metrics. Maybe we should deprecate the old usersfile? Or if we keep both secrets the new secret should be named more specific
fauno commented 2026-07-29 14:13:13 +00:00
Outdated
Review
Copy Link
Copy Source

not sure, you can have more than one user on the usersfile. should i rename it to metrics_basic_auth?

not sure, you can have more than one user on the usersfile. should i rename it to metrics_basic_auth?
fauno commented 2026-07-29 14:23:26 +00:00
Outdated
Review
Copy Link
Copy Source

what was the resolution @decentral1se ?

what was the resolution @decentral1se ?
p4u1 commented 2026-07-29 15:00:59 +00:00
Outdated
Review
Copy Link
Copy Source

not sure, you can have more than one user on the usersfile. should i rename it to metrics_basic_auth?

I think you can. Is there a way to also use a users file with you method of basic auth?
metrics_basic_auth sounds good and then we can make a breaking change to also use that for the traefik metrics

> not sure, you can have more than one user on the usersfile. should i rename it to metrics_basic_auth? I think you can. Is there a way to also use a users file with you method of basic auth? metrics_basic_auth sounds good and then we can make a breaking change to also use that for the traefik metrics
p4u1 commented 2026-07-29 15:07:28 +00:00
Outdated
Review
Copy Link
Copy Source

Btw. the traefik Middleware supports both users and usersFile https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/

Btw. the traefik Middleware supports both users and usersFile https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/
fauno commented 2026-07-29 18:05:27 +00:00
Outdated
Review
Copy Link
Copy Source

they're different things, one is the basic auth database that traefik protects routes with, and this new secret is for protecting anubis itself.

https://anubis.techaro.lol/docs/admin/policies#http-basic-authentication

since the metrics endpoint is only available locally, not exposed by traefik (thus not protected by basicauth middleware) and authentication is optional, i could remove it altogether to simplify things.

they're different things, one is the basic auth database that traefik protects routes with, and this new secret is for protecting anubis itself. https://anubis.techaro.lol/docs/admin/policies#http-basic-authentication since the metrics endpoint is only available locally, not exposed by traefik (thus not protected by basicauth middleware) and authentication is optional, i could remove it altogether to simplify things.
p4u1 commented 2026-07-30 20:41:48 +00:00
Outdated
Review
Copy Link
Copy Source

OK, my confusion is slowly clearing up 😀

I think I have a slight preference to remove the basic auth for now. We can always add it later and prevent confusion for now

OK, my confusion is slowly clearing up 😀 I think I have a slight preference to remove the basic auth for now. We can always add it later and prevent confusion for now
fauno commented 2026-07-30 22:47:33 +00:00
Outdated
Review
Copy Link
Copy Source

@p4u1 done, but i can't re-request review, the page reloads and the status doesn't change

@p4u1 done, but i can't re-request review, the page reloads and the status doesn't change
❤️ 1
#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
## Enable onion service support
#ONION_ENABLED=1
README.md
+5
View File
@@ -72,6 +72,11 @@ After deploying these changes, go to each recipe that supports Anubis
and follow the process there. **Enabling Anubis here is not enough for
protection your apps.**
If you want to collect Prometheus metrics for Anubis, for instance with
[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section
and insert the basic auth password as a secret. The username will be
p4u1 commented 2026-08-01 09:23:12 +00:00
Review
Copy Link
Copy Source

The reference to basic with should be removed here

The reference to basic with should be removed here
"admin".
## Enabling onion service
Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
abra.sh
+1
View File
@@ -1,3 +1,4 @@
export TRAEFIK_YML_VERSION=v32
export FILE_PROVIDER_YML_VERSION=v12
export ENTRYPOINT_VERSION=v5
export ANUBIS_YML_VERSION=v1
anubis.yml.tmpl
+7
View File
@@ -0,0 +1,7 @@
bots:
- import: (data)/meta/default-config.yaml
{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
metrics:
bind: ":9090"
network: "tcp"
{{ end }}
compose.anubis-metrics.yml
+11
View File
@@ -0,0 +1,11 @@
---
version: "3.8"
services:
anubis:
environment:
ANUBIS_METRICS_ENABLED: "true"
deploy:
labels:
- "prometheus.io/scrape=true"
decentral1se marked this conversation as resolved
decentral1se commented 2026-07-28 18:43:21 +00:00
Review
Copy Link
Copy Source

I think this might overwrite the other anubis lables?

traefik/compose.anubis.yml Lines 24 to 31 in 0ff4ef759b
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.anubis.rule=Host(`${ANUBIS_DOMAIN}`)"
- "traefik.http.routers.anubis.tls.certresolver=${LETS_ENCRYPT_ENV}"
- "traefik.http.routers.anubis.entrypoints=web-secure"
- "traefik.http.services.anubis.loadbalancer.server.port=8080"
- "traefik.http.routers.anubis.service=anubis"

I think this might overwrite the other `anubis` lables? https://git.coopcloud.tech/coop-cloud/traefik/src/commit/0ff4ef759bea353a2803edb0c4963d1de5f43811/compose.anubis.yml#L24-L31
fauno commented 2026-07-28 19:09:32 +00:00
Review
Copy Link
Copy Source

aren't they concatenated? that's my experience so far with labels!

aren't they concatenated? that's my experience so far with labels!
👍 1
- "prometheus.io/port=9090"
- "prometheus.io/path=/metrics"
compose.anubis.yml
+9
View File
@@ -19,6 +19,10 @@ services:
OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
POLICY_FNAME: "/data/cfg/botPolicy.yaml"
configs:
- source: anubis_yml
target: /data/cfg/botPolicy.yaml
networks:
- proxy
deploy:
@@ -29,3 +33,8 @@ services:
- "traefik.http.routers.anubis.entrypoints=web-secure"
- "traefik.http.services.anubis.loadbalancer.server.port=8080"
- "traefik.http.routers.anubis.service=anubis"
configs:
anubis_yml:
name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
file: anubis.yml.tmpl
template_driver: golang