Revert "config: Add a flag to control the /metrics and /status endpoints"

This reverts commit d10ead4c6c.

Signed-off-by: Stéphane Maniaci <stephane.maniaci@beta.gouv.fr>

app.js

@@ -75,10 +75,8 @@ app.use(morgan('combined', {
 }))
 
 // Register prometheus metrics endpoint
-if (config.observability.exposeMetrics) {
-  app.use(apiMetrics())
-  metrics.setupCustomPrometheusMetrics()
-}
+app.use(apiMetrics())
+metrics.setupCustomPrometheusMetrics()
 
 // socket io
 const io = require('socket.io')(server, { cookie: false })
@@ -228,17 +226,7 @@ app.locals.enableGitHubGist = config.isGitHubEnable
 app.locals.enableGitlabSnippets = config.isGitlabSnippetsEnable
 
 app.use(require('./lib/web/baseRouter'))
-
-if (config.observability.exposeStatus) {
-  app.use(require('./lib/web/statusRouter'))
-} else {
-  // the `/status` route is used by the hedgedoc container's
-  // healtcheck route so keep the endpoint alive
-  app.get('/status', function (req, res, next) {
-    res.sendStatus(200)
-  })
-}
-
+app.use(require('./lib/web/statusRouter'))
 app.use(require('./lib/web/auth'))
 app.use(require('./lib/web/historyRouter'))
 app.use(require('./lib/web/userRouter'))

docs/content/configuration.md

@@ -77,7 +77,7 @@ these are rarely used for various reasons.
 ## Web security aspects
 
 | config file                   | environment                    | **default** and example value                                                             | description                                                                                                                                                               |
-|-------------------------------|------------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| ----------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `hsts`                        |                                | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year)                          |
 |                               | `CMD_HSTS_ENABLE`              | **`true`** or `false`                                                                     | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`)                                          |
 |                               | `CMD_HSTS_INCLUDE_SUBDOMAINS`  | **`true`** or `false`                                                                     | set to include subdomains in HSTS (default is `true`)                                                                                                                     |
@@ -94,10 +94,6 @@ these are rarely used for various reasons.
 | `csp.allowFraming`            | `CMD_CSP_ALLOW_FRAMING`        | **`true`** or `false`                                                                     | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks.             |
 | `csp.allowPDFEmbed`           | `CMD_CSP_ALLOW_PDF_EMBED`      | **`true`** or `false`                                                                     | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks.                                                |
 | `cookiePolicy`                | `CMD_COOKIE_POLICY`            | **`lax`**, `strict` or `none`                                                             | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor.                           | 
-| `observability.exposeMetrics  | `CMD_OBSERVABILITY_EXPOSE_METRICS` | **true** or `false`                                                                       | Controls whether the /metrics endpoint is exposed.                                                                                                                        |
-| `observability.exposeStatus   | `CMD_OBSERVABILITY_EXPOSE_STATUS`  | **true** or `false`                                                                       | Controls whether the /status routes are exposed. Note that /status will still return 200 for healthcheck purposes, but no data will be exposed.                           |
-|
-
 
 ## Privacy and External Requests
 

lib/config/default.js

@@ -29,10 +29,6 @@ module.exports = {
     allowFraming: true,
     allowPDFEmbed: true
   },
-  observability: {
-    exposeMetrics: true,
-    exposeStatus: true
-  },
   cookiePolicy: 'lax',
   protocolUseSSL: false,
   allowAnonymous: true,

lib/config/environment.js

@@ -18,10 +18,6 @@ module.exports = {
     includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS),
     preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD)
   },
-  observability: {
-    exposeMetrics: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_METRICS),
-    exposeStatus: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_STATUS)
-  },
   csp: {
     enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
     reportURI: process.env.CMD_CSP_REPORTURI,

public/docs/release-notes.md

@@ -2,9 +2,6 @@
 
 ## UNRELEASED
 
-### Enhancements
-- Allow disabling the /metrics and /status endpoints
-
 ### Bugfixes
 - Fix note titles with special characters producing invalid file names in user export zip file