Skip to content

feat: add PROMETHEUS_ALLOWLIST for specific firewall IP rules #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nfrozi wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat: add PROMETHEUS_ALLOWLIST for specific firewall IP rules #102

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
03e56bb
feat: add PROMETHEUS_ALLOWLIST for specific firewall IP rules
nfrozi Jul 15, 2026
0341737
fix: Refine the code and consistency
nfrozi Jul 16, 2026
4edf3eb
fix: re-test
nfrozi Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,18 +42,19 @@ curl ... | INSTALL_NODE_EXPORTER_VERSION="v1.5.0" INSTALL_NODE_EXPORTER_SKIP_STA

## Environment variables

| **Name** | **Description** | **Default** |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------ |
| `INSTALL_NODE_EXPORTER_SKIP_DOWNLOAD` | Skip downloading Node exporter. There must already be an executable binary at `<BIN_DIR>/node_exporter` | `false` |
| `INSTALL_NODE_EXPORTER_FORCE_RESTART` | Force restarting Node exporter service | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_ENABLE` | Skip enabling Node exporter service at startup | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_START` | Skip starting Node exporter service | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_FIREWALL` | Skip firewall rules. Supported firewalls are `firewall-cmd`, `ufw` and `iptables` | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_SELINUX` | Skip changing `SELinux` context for Node exporter binary | `false` |
| `INSTALL_NODE_EXPORTER_VERSION` | Version of Node exporter to download | `latest` |
| `INSTALL_NODE_EXPORTER_BIN_DIR` | Directory to install Node exporter binary and uninstall script | `/usr/local/bin` or `/opt/bin` |
| `INSTALL_NODE_EXPORTER_SYSTEMD_DIR` | Directory to install systemd service files | `/etc/systemd/system` |
| `INSTALL_NODE_EXPORTER_EXEC` | Node exporter arguments |
| **Name** | **Description** | **Default** |
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
| `INSTALL_NODE_EXPORTER_SKIP_DOWNLOAD` | Skip downloading Node exporter. There must already be an executable binary at `<BIN_DIR>/node_exporter` | `false` |
| `INSTALL_NODE_EXPORTER_FORCE_RESTART` | Force restarting Node exporter service | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_ENABLE` | Skip enabling Node exporter service at startup | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_START` | Skip starting Node exporter service | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_FIREWALL` | Skip firewall rules. Supported firewalls are `firewall-cmd`, `ufw` and `iptables` | `false` |
| `INSTALL_NODE_EXPORTER_SKIP_SELINUX` | Skip changing `SELinux` context for Node exporter binary | `false` |
| `INSTALL_NODE_EXPORTER_VERSION` | Version of Node exporter to download | `latest` |
| `INSTALL_NODE_EXPORTER_BIN_DIR` | Directory to install Node exporter binary and uninstall script | `/usr/local/bin` or `/opt/bin` |
| `INSTALL_NODE_EXPORTER_SYSTEMD_DIR` | Directory to install systemd service files | `/etc/systemd/system` |
| `INSTALL_NODE_EXPORTER_FIREWALL_ALLOWLIST` | Comma-separated list of Prometheus server IPs or CIDRs allowed to scrape metrics (e.g., `10.10.10.5,10.20.0.0/24`) | |
| `INSTALL_NODE_EXPORTER_EXEC` | Node exporter arguments |

## Contributing

Expand Down
1 change: 1 addition & 0 deletions cspell.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
"openrc",
"pidfile",
"policycoreutils",
"proto",
"respawn",
"restorecon",
"runlevels",
Expand Down
25 changes: 18 additions & 7 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -597,19 +597,30 @@ systemd_disable() {
firewall_rule() {
_firewall_path=$(command -v "$FIREWALL" 2>&1 || :)

_ips=""
if [ -n "$INSTALL_NODE_EXPORTER_FIREWALL_ALLOWLIST" ]; then
_ips=$(echo "$INSTALL_NODE_EXPORTER_FIREWALL_ALLOWLIST" | tr ',' ' ')

@carlocorradini carlocorradini Aug 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use printf instead of echo

@carlocorradini carlocorradini Aug 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe there's a better way to split the different IPs instead of relying on tr? Perhaps we can reuse something that's already used elsewhere and avoid introducing a new dependency on tr?

fi

# shellcheck disable=SC2086
set -- $_ips

@carlocorradini carlocorradini Aug 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you use set -- $_ips instead of working with $_ips directly?


case $FIREWALL in

@carlocorradini carlocorradini Aug 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the IP list is empty, no firewall rules are added.
This is a regression compared to the previous behavior.

firewall-cmd)
printf "%s\n%s\n" \
"$_firewall_path --add-port=$NODE_EXPORTER_PORT/tcp --permanent" \
"$_firewall_path --reload"
for _ip in "$@"; do

@carlocorradini carlocorradini Aug 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not very familiar with configuring the various firewalls, so I need your help 🆘.
What happens if the IP address is an IPv6 rather than an IPv4?
Do we need to detect the IP version and pass different arguments accordingly, or does firewall-cmd handle that automatically?

More generally, does the same apply to the other firewall implementations?
Are they IP-version agnostic, or do we need to explicitly specify whether an address is IPv4 or IPv6? Thanks 🙌

printf "%s\n" "$_firewall_path --add-rich-rule=\"rule family='ipv4' source address='$_ip' port port='$NODE_EXPORTER_PORT' protocol='tcp' accept\" --permanent"
done
[ $# -gt 0 ] && printf "%s\n" "$_firewall_path --reload"
;;
ufw)
printf "%s\n" \
"$_firewall_path allow $NODE_EXPORTER_PORT/tcp"
for _ip in "$@"; do
printf "%s\n" "$_firewall_path allow from $_ip to any port $NODE_EXPORTER_PORT proto tcp"
done
;;
iptables)
printf "%s\n" \
"$_firewall_path -A INPUT -p tcp --dport $NODE_EXPORTER_PORT -m state --state NEW -j ACCEPT"
for _ip in "$@"; do
printf "%s\n" "$_firewall_path -A INPUT -s $_ip -p tcp --dport $NODE_EXPORTER_PORT -m state --state NEW -j ACCEPT"
done
;;
*) fatal "Unknown firewall '$FIREWALL'" ;;
esac
Expand Down