metrics: make metrics endpoint toggleable

app.go

@@ -72,6 +72,7 @@ const (
 type Config struct {
 	ServerURL                      string
 	Addr                           string
+	MetricsEnabled                 bool
 	MetricsAddr                    string
 	GRPCAddr                       string
 	GRPCAllowInsecure              bool
@@ -655,27 +656,29 @@ func (h *Headscale) Serve() error {
 	log.Info().
 		Msgf("listening and serving HTTP on: %s", h.cfg.Addr)
 
-	promRouter := h.createPrometheusRouter()
+	if h.cfg.MetricsEnabled {
+		promRouter := h.createPrometheusRouter()
 
-	promHTTPServer := &http.Server{
-		Addr:         h.cfg.MetricsAddr,
-		Handler:      promRouter,
-		ReadTimeout:  HTTPReadTimeout,
-		WriteTimeout: 0,
+		promHTTPServer := &http.Server{
+			Addr:         h.cfg.MetricsAddr,
+			Handler:      promRouter,
+			ReadTimeout:  HTTPReadTimeout,
+			WriteTimeout: 0,
+		}
+
+		var promHTTPListener net.Listener
+		promHTTPListener, err = net.Listen("tcp", h.cfg.MetricsAddr)
+
+		if err != nil {
+			return fmt.Errorf("failed to bind to TCP address: %w", err)
+		}
+
+		errorGroup.Go(func() error { return promHTTPServer.Serve(promHTTPListener) })
+
+		log.Info().
+			Msgf("listening and serving metrics on: %s", h.cfg.MetricsAddr)
 	}
 
-	var promHTTPListener net.Listener
-	promHTTPListener, err = net.Listen("tcp", h.cfg.MetricsAddr)
-
-	if err != nil {
-		return fmt.Errorf("failed to bind to TCP address: %w", err)
-	}
-
-	errorGroup.Go(func() error { return promHTTPServer.Serve(promHTTPListener) })
-
-	log.Info().
-		Msgf("listening and serving metrics on: %s", h.cfg.MetricsAddr)
-
 	return errorGroup.Wait()
 }
 

cmd/headscale/cli/utils.go

@@ -303,6 +303,7 @@ func getHeadscaleConfig() headscale.Config {
 	return headscale.Config{
 		ServerURL:         viper.GetString("server_url"),
 		Addr:              viper.GetString("listen_addr"),
+		MetricsEnabled:    viper.GetBool("metrics_enabled"),
 		MetricsAddr:       viper.GetString("metrics_listen_addr"),
 		GRPCAddr:          viper.GetString("grpc_listen_addr"),
 		GRPCAllowInsecure: viper.GetBool("grpc_allow_insecure"),

cmd/headscale/headscale_test.go

@@ -56,6 +56,7 @@ func (*Suite) TestConfigLoading(c *check.C) {
 	c.Assert(viper.GetString("server_url"), check.Equals, "http://127.0.0.1:8080")
 	c.Assert(viper.GetString("listen_addr"), check.Equals, "0.0.0.0:8080")
 	c.Assert(viper.GetString("metrics_listen_addr"), check.Equals, "127.0.0.1:9915")
+	c.Assert(viper.GetString("metrics_enabled"), check.Equals, "true")
 	c.Assert(viper.GetString("db_type"), check.Equals, "sqlite3")
 	c.Assert(viper.GetString("db_path"), check.Equals, "/var/lib/headscale/db.sqlite")
 	c.Assert(viper.GetString("tls_letsencrypt_hostname"), check.Equals, "")

config-example.yaml

@@ -16,6 +16,9 @@ server_url: http://127.0.0.1:8080
 #
 listen_addr: 0.0.0.0:8080
 
+# Enable Prometheus metrics endpoint
+metrics_enabled: true
+
 # Address to listen to /metrics, you may want
 # to keep this endpoint private to your internal
 # network

docs/examples/kustomize/base/configmap.yaml

@@ -5,5 +5,6 @@ metadata:
 data:
   server_url: $(PUBLIC_PROTO)://$(PUBLIC_HOSTNAME)
   listen_addr: "0.0.0.0:8080"
+  metrics_enabled: "true"
   metrics_listen_addr: "127.0.0.1:9915"
   ephemeral_node_inactivity_timeout: "30m"

docs/examples/kustomize/postgres/deployment.yaml

@@ -30,6 +30,11 @@ spec:
                 configMapKeyRef:
                   name: headscale-config
                   key: metrics_listen_addr
+            - name: METRICS_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: headscale-config
+                  key: metrics_enabled
             - name: DERP_MAP_PATH
               value: /vol/config/derp.yaml
             - name: EPHEMERAL_NODE_INACTIVITY_TIMEOUT

docs/examples/kustomize/sqlite/statefulset.yaml

@@ -31,6 +31,11 @@ spec:
                 configMapKeyRef:
                   name: headscale-config
                   key: metrics_listen_addr
+            - name: METRICS_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: headscale-config
+                  key: metrics_enabled
             - name: DERP_MAP_PATH
               value: /vol/config/derp.yaml
             - name: EPHEMERAL_NODE_INACTIVITY_TIMEOUT

integration_test/etc/config.yaml

@@ -14,6 +14,7 @@ dns_config:
 db_path: /tmp/integration_test_db.sqlite3
 private_key_path: private.key
 listen_addr: 0.0.0.0:8080
+metrics_enabled: true
 metrics_listen_addr: 127.0.0.1:9915
 server_url: http://headscale:8080