/metrics is accessible open wide

[reynico]

Hi!

The /metrics endpoint is accessible open wide to the Internet with the default configuration:

server_url: https://tailscale.dev:8080

# Address to listen to / bind to on the server
#
listen_addr: 0.0.0.0:8080

Note that listen_addr should be listening on 0.0.0.0 so the clients can authenticate to the server, but I think /metrics should be available only for the local network, either by listening on a different port or by a blocking rule.

Bonus points to make /metrics a toggleable endpoint!

[kradalby]

Hi, we would happily take a PR with a flag to make it localhost / a specific network only.

Turning off metrics would be an anti-pattern, so we will refrain for adding that.

Otherwise, this ticket will be put on the backlog.

For people arriving at this issue, one alternative is to lock it down with Nginx or another reverse proxy.

[reynico]

Hi @kradalby, PR is ready for review.