In this demo, I will show you how to enable TLS
and authentication on your Prometheus server.
So I'm logged in again to the Prometheus server,
and I'm going to go to the Git repository,
into the scripts directory, and here are the scripts.
Reverse-proxy.sh.
I want to enable a reverse proxy on localhost port 9090,
which is where the Prometheus server is running on.
You need to run this script as root or with sudo.
It's going to first install nginx and OpenSSL
and also apache2-utils so that we can use htpasswd
to create a password.
We need to create an SSL certificate,
so in here we're going to generate a self-signed certificate
and we're going to move it to /etc/ssl.
If you want a real certificate, you can always buy one
or you can use something like Let's Encrypt
and then you can put the real certificates in these folders.
Then we're going to configure our nginx server,
so we are going to say server listen on port 443,
which is HTTPS, SSL on, the path of the SSL certificate,
the path of the SSL certificate key,
and then for location / we're going to do a proxy pass
to the host and port.
This is then going to enable a reverse proxy
to the Prometheus server.
We're also going to enable authentication
so we can say authentication basic Prometheus
and the passwords are stored here in /etc/nginx/.htpasswd.
Going to write this to /etc/nginx/sites-enabled/prometheus
and then, if we then enable nginx and then restart nginx
then our reverse proxy will be up and working.
And then we can connect on the external IP address on HTTPS.
So let's execute this script, reverse-proxy.sh.
It installs nginx, creates the certificates
and then the last line should be reverse proxy enabled
on this IP address.
And then we should be able to open our browser
and go to this IP address.
We get an error the certificate is invalid
because we used a self-signed certificate.
I'm going to click Advanced and then Proceed.
It's going to ask for a sign in.
We haven't configured a login and password yet
so let me do that now.
So TLS definitely already works,
now we just have to configure authentication.
We can do that using a tool htpasswd.
I just have to pass -c /etc/nginx/.htpasswd
and then the user that we wanna add.
So I'm gonna add myuser and give it a password.
So now we added the password for user myuser.
If we have a look at this file we then see
myuser and then the hashed password.
So let's try to log in now.
Let's refresh.
Myuser and my password.
And now I'm logged in to Prometheus server
using authentication and using TLS.
I don't have real certificate
but if you want a real certificate you can just add one.
So now my connection to Prometheus is encrypted
and it still works exactly as before.