Basic auth only for specific directory

Question

I have a small envirnment where I have 3 services on one server and I want to put all three behind a reverse proxy.

Prometheus server running on port 9090
Prometheus Alert manager running on port 9093
Grafana running on port 3000

My current configuration is below

<VirtualHost *:80>
    ServerName metrics.example.com
    Redirect permanent / https://metrics.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin admin@example.com
    ServerName metrics.example.com

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3

    SSLCertificateFile /etc/apache2/ssl.crt/example.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/example.key

    ErrorLog /var/log/apache2/metrics.example.com-error_log
    CustomLog /var/log/apache2/metrics.example.com-access_log combined

    <Location "/">
        ProxyPreserveHost On
        ProxyPass http://localhost:9090/
        ProxyPassReverse http://localhost:9090/
    </Location>

    <Location "/alertmanager/">
        ProxyPreserveHost On
        ProxyPass http://localhost:9093/
        ProxyPassReverse http://localhost:9093/
    </Location>

    <Location "/grafana/">
        RequestHeader set X-Forwarded-Proto "https"
        ProxyPreserveHost On
        ProxyPass http://localhost:3000/
        ProxyPassReverse http://localhost:3000/
    </Location>

    # <Proxy *>
    #     AuthType Basic
    #     AuthName "Restricted Content"
    #     AuthUserFile /etc/apache2/.htpasswd
    #     Require valid-user
    # </Proxy>
</VirtualHost>

For now everything works, but Prometheus and Alertmanager don't have own auth, Grafana does. If I uncomment section Grafana stops working. The goal is to protect both Prometheus and Alertmanager with basic auth but not the Grafana instance. Is it possible (and how) to protect root ("/") directory and /alertmanager subdirectory but with omitting /grafana subdirectory in single vhost?

Basic auth only for specific directory

0 Answers0