config: Add a flag to control the /metrics and /status endpoints

It can be a security concern in some environments to expose system
capabilities even though they don't expose any PII. Add some
flags (defaulted `true` to maintain existing behaviour) to control
whether the /metrics and /status (and anything in the StatusRouter)
are exposed.

Signed-off-by: Stéphane Maniaci <stephane.maniaci@beta.gouv.fr>

app.js

@@ -75,8 +75,10 @@ app.use(morgan('combined', {
 }))
 
 // Register prometheus metrics endpoint
-app.use(apiMetrics())
+if (config.observability.exposeMetrics) {
-metrics.setupCustomPrometheusMetrics()
+  app.use(apiMetrics())
+  metrics.setupCustomPrometheusMetrics()
+}
 
 // socket io
 const io = require('socket.io')(server, { cookie: false })
@@ -226,7 +228,17 @@ app.locals.enableGitHubGist = config.isGitHubEnable
 app.locals.enableGitlabSnippets = config.isGitlabSnippetsEnable
 
 app.use(require('./lib/web/baseRouter'))
-app.use(require('./lib/web/statusRouter'))
+
+if (config.observability.exposeStatus) {
+  app.use(require('./lib/web/statusRouter'))
+} else {
+  // the `/status` route is used by the hedgedoc container's
+  // healtcheck route so keep the endpoint alive
+  app.get('/status', function (req, res, next) {
+    res.sendStatus(200)
+  })
+}
+
 app.use(require('./lib/web/auth'))
 app.use(require('./lib/web/historyRouter'))
 app.use(require('./lib/web/userRouter'))

docs/content/configuration.md

@@ -77,7 +77,7 @@ these are rarely used for various reasons.
 ## Web security aspects
 
 | config file                   | environment                        | **default** and example value                                                             | description                                                                                                                                                               |
-| ----------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+|-------------------------------|------------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `hsts`                        |                                    | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year)                          |
 |                               | `CMD_HSTS_ENABLE`                  | **`true`** or `false`                                                                     | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`)                                          |
 |                               | `CMD_HSTS_INCLUDE_SUBDOMAINS`      | **`true`** or `false`                                                                     | set to include subdomains in HSTS (default is `true`)                                                                                                                     |
@@ -94,6 +94,10 @@ these are rarely used for various reasons.
 | `csp.allowFraming`            | `CMD_CSP_ALLOW_FRAMING`            | **`true`** or `false`                                                                     | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks.             |
 | `csp.allowPDFEmbed`           | `CMD_CSP_ALLOW_PDF_EMBED`          | **`true`** or `false`                                                                     | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks.                                                |
 | `cookiePolicy`                | `CMD_COOKIE_POLICY`                | **`lax`**, `strict` or `none`                                                             | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor.                           |
+| `observability.exposeMetrics  | `CMD_OBSERVABILITY_EXPOSE_METRICS` | **true** or `false`                                                                       | Controls whether the /metrics endpoint is exposed.                                                                                                                        |
+| `observability.exposeStatus   | `CMD_OBSERVABILITY_EXPOSE_STATUS`  | **true** or `false`                                                                       | Controls whether the /status routes are exposed. Note that /status will still return 200 for healthcheck purposes, but no data will be exposed.                           |
+|
+
 
 ## Privacy and External Requests
 

lib/config/default.js

@@ -29,6 +29,10 @@ module.exports = {
     allowFraming: true,
     allowPDFEmbed: true
   },
+  observability: {
+    exposeMetrics: true,
+    exposeStatus: true
+  },
   cookiePolicy: 'lax',
   protocolUseSSL: false,
   allowAnonymous: true,

lib/config/environment.js

@@ -18,6 +18,10 @@ module.exports = {
     includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS),
     preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD)
   },
+  observability: {
+    exposeMetrics: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_METRICS),
+    exposeStatus: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_STATUS)
+  },
   csp: {
     enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
     reportURI: process.env.CMD_CSP_REPORTURI,

public/docs/release-notes.md

@@ -2,6 +2,9 @@
 
 ## UNRELEASED
 
+### Enhancements
+- Allow disabling the /metrics and /status endpoints
+
 ### Bugfixes
 - Fix note titles with special characters producing invalid file names in user export zip file