Conversation
jfly
left a comment
There was a problem hiding this comment.
LGTM!
style nit, feel free to ignore: I personally like using nix to inject config.services... references to port numbers rather than hardcoding the port number everywhere.
|
The issue with that is that the |
| networking.firewall.allowedTCPPorts = [ | ||
| 80 | ||
| 443 | ||
| 9001 |
There was a problem hiding this comment.
Shouldn't we limit that to Prometheus and not make it public?
There was a problem hiding this comment.
Eventually, but up until now all exporters have been publically accessible.
There was a problem hiding this comment.
That is not that great.
Depending on the exporter this might be more or less of a problem. Some just expose internal counters but others execute commands on scrape and I am not sure if they have rate limit and if you could cause damage by spamming those endpoints.
Closes: #626