linuxserver / reverse-proxy-confs

These confs are pulled into our SWAG image: https://github.com/linuxserver/docker-swag
GNU General Public License v3.0
1.33k stars 299 forks source link

restrict access to jellyfin's /metrics endpoint in subdomain #695

Closed leoperegrino closed 1 week ago

leoperegrino commented 3 weeks ago

linuxserver.io



Description

According to the docs, Jellyfin is able to expose an endpoint which provide metrics about the instance. A user would have to change a text file configuration to activate it but the endpoint it's not meant to be publicly exposed.

Benefits of this PR and context

Despite /metrics not being available by default, users could benefit from already having the configuration inserted and avoiding misconfiguration in Jellyfin opening a security risk.

This indeed comes with the cost of a longer conf file for the benefit of only those who expose this Prometheus metrics. Tried to look for similar PRs but didn't find anything similar so I decided to open but I understand if this is not welcome.

I did not changed the subfolder because I don't actually use it but if anyone is able to provide the configuration this could also be added.

How Has This Been Tested?

Ran nginx with the inserted block and tried to access it.

Source / References

Docs