search

QubitProducts / exporter_exporter

A reverse proxy designed for Prometheus exporters
Apache License 2.0
332 stars 55 forks source link

Http module add to root ca #98

Closed AlexandarY closed 8 months ago

AlexandarY commented 8 months ago

If the http module to which the exporter_exporter proxies is protected by a certificate authority, which is not part of the system root CA pool, connections will fail with

msg="Proxy error for module 'node': x509: certificate signed by unknown authority"

The changes in commit 7afa456 allow per http module inclusion of a Root CA to the Root CA pool that is being used by the httpProxy client. The changes in commit 3b66f6d allow per http module overwrite of the ServerName that is used to validate the SAN of the server tls certificate. In other words, if you have an exporter protected with a TLS certificate with SAN name test.com, but you want to connect to it by IP address, you can do the following:

modules:
  node:
    method: http
    http:
      scheme: https
      port: 9100
      address: 127.0.0.1
      server_name: test.com
tcolgate commented 8 months ago

Looks good, thanks!