search

cactus / go-camo

A secure image proxy server
MIT License
254 stars 48 forks source link

Add option to disable /debug/vars endpoint #65

Closed dee-see closed 9 months ago

dee-see commented 9 months ago

Specifications

There's a /debug/vars which dumps a bunch of information about the running process. It would be great if we could disable this with a command-line option. I had a quick look to open a PR but it wasn't obvious to me how this is done. If you have any pointers I'm happy to open the PR myself.

Expected Behavior

A new command-line option to disable /debug/vars. I think it should be disabled by default but I understand it would be a breaking change.

Actual Behavior

/debug/vars cannot be disabled

Steps to reproduce

Start camo and visit /debug/vars

dropwhile commented 9 months ago

It looks like the prometheus library is importing the go stdlib expvar, which in turn is auto-registering /debug/vars on the default servemux. Oof! This is certain not intented, and I will add a change to stop this from happening (it should only be available if the --metrics flag is supplied to go-cam).

Thank you for catching this!

dropwhile commented 9 months ago

@dee-see I just released a fixed version. Let me know if it doesn't resolve the issue.

dee-see commented 9 months ago

Thank you very much for the very quick fix!!

dee-see commented 9 months ago

@dropwhile would you be open to some sort of --metrics-without-debug switch (name needs some work :sweat_smile:) that enables the /metrics endpoint without /debug/vars? We see no use for the /debug/vars/ endpoint and would like to hide it in any case. Happy to contribute this feature if you think it can be useful.

dropwhile commented 9 months ago

@dee-see I have no problem adding something like that. 👍 Can you open a new issue for that feature request?

EDIT: Maybe something like --metrics --no-debug-vars