<![CDATA[/status, /metrics is public]]>As a heads up, in HedgeDoc, the /status and /metrics route are public in https://github.com/hedgedoc/hedgedoc/pull/1857 . Just wondering if people here consider it "private" ? I can fix the package accordingly.

]]>https://forum.cloudron.io/topic/6454/status-metrics-is-publicRSS for NodeTue, 19 May 2026 09:07:55 GMTTue, 08 Feb 2022 22:05:17 GMT60<![CDATA[Reply to /status, /metrics is public on Wed, 09 Feb 2022 19:06:23 GMT]]>@nebulon upstream has "heard us" 🙂
https://github.com/hedgedoc/hedgedoc/issues/2082

]]>https://forum.cloudron.io/post/43114https://forum.cloudron.io/post/43114Wed, 09 Feb 2022 19:06:23 GMT<![CDATA[Reply to /status, /metrics is public on Wed, 09 Feb 2022 12:35:24 GMT]]>I am both ways here, as mentioned in the upstream issue, we can filter out those urls, if we would use an additional reverse proxy specifically for the app. However this adds another nginx instance and since it is not maintained upstream, we might miss future routes which also need protection the same way.

Ideally I still think this is really part of the upstream project to maybe even have settings for that.

]]>https://forum.cloudron.io/post/43034https://forum.cloudron.io/post/43034Wed, 09 Feb 2022 12:35:24 GMT<![CDATA[Reply to /status, /metrics is public on Wed, 09 Feb 2022 09:50:39 GMT]]>@girish please change it so that it is private. If it is possible (maybe sometime in the future, I am interested in the Prometheus endpoint), implement it as a "switch" in the .env file.

A little context: this kind of information is public at the status endpoint (https://demo.hedgedoc.org/status)

4499c911-a789-48f6-8142-c463f9a58947-grafik.png

For a demo instance, that might be fine. But as an administrator of a self-hosted Hedgedoc, I want to decide what kind of transparency I want to share with the world.

]]>https://forum.cloudron.io/post/43027https://forum.cloudron.io/post/43027Wed, 09 Feb 2022 09:50:39 GMT