SSL/TLS Encryption Support

[chanyongkit]

Feature Description

Implement SSL Encryption for the endpoints exposed to Prometheus. This feature would include the ability to configure CA certs and optionally enable SSL/TLS.

Implementation: chanyongkit@3f7679a

Version of logstash-exporter this feature request applies to

v1

Motivation and Goals

Due to certain regulatory reasons I'm unable to use reverse proxy and hence need an OOTB solution to encrypt traffic to Prometheus.

Alternatives Considered

1. Reverse Proxy

Additional Context

No response

[satk0]

Nice, can you make a PR for it? Your commit looks cool, thanks for contrib ;)

[michael-doubez]

It is part of prometheus exporter-toolkit github.com/prometheus/exporter-toolkit/web

Usual change is aabout using web.Listen instead of server.Listen.

import (
    ...
    "github.com/prometheus/exporter-toolkit/web")

...


webcfgFile    = cmdLine.String("web.config", "", "Path to config yaml file that can enable TLS or authentication.")
....
web.ListenAndServe(server, *webcfgFile, logger); err != nil { ...
```

[michael-doubez]

Well, still waiting for prometheus/exporter-toolkit#151 to avoid blocking /ready.

[satk0]

Oh, so are you suggesting that we should use the exporter-toolkit approach? Seems cool, @kuskoman could you please check this out?

[kuskoman]

@satk0 you can research it. for v2 it should not be a problem, just try not to break hot reload (if you want to do that)
for v1 we should not do any breaking changes, so you must ensure, that without any additional configuration the app will behave exactly the same

[kuskoman]

@chanyongkit @michael-doubez I checked out this library and it is not a stable one and would break existing behaviour for v1. I don't see any possibility of implementing it for v1. It also relies on its own config file, while the convention for v1 was to use environment variables. I can consider using it for v2 in the future, but currently it seems to be lacking documentation, so I am waiting for it to be more mature to reconsider it.

[kuskoman]

i actually misunderstood the context, @chanyongkit feel free to create a PR with this kind of configuration. as long as we don't break or change existing functionality this seems fine
the comment above is about prometheus toolkit