grafana started to listen globally by default instead of only on localhost (22.05 -> 22.11)

[herbetom]

Issue description

#191768 changed on which address Grafana listens by default. Previously (under 22.05) it was localhost only and it was necessary to explicitly adjust this if so desired. Now (with 22.11) Grafana is listening on all IPs.

Previously:

nixpkgs/nixos/modules/services/monitoring/grafana.nix

Lines 293 to 297 in 79e63f3

	addr = mkOption {
	description = "Listening address.";
	default = "127.0.0.1";
	type = types.str;
	};

[root@stats:~]# ss -tlnp | grep -E "State|grafana"
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                                                  
LISTEN 0      4096       127.0.0.1:3000      0.0.0.0:*    users:(("grafana-server",pid=774,fd=8))

New default is to listen on all IPs:

nixpkgs/nixos/modules/services/monitoring/grafana.nix

Lines 366 to 370 in becdf0e

	http_addr = mkOption {
	description = lib.mdDoc "Listening address.";
	default = "";
	type = types.str;
	};

[root@stats:~]# ss -tlnp | grep -E "State|grafana"
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                                                     
LISTEN 0      4096               *:3000            *:*    users:(("grafana-server",pid=286547,fd=11))

Without enabled (and properly configured) firewall this could result in situations where people are exposing their Grafana installation unintentionally.

@offline @fpletz @WilliButz @globin @Ma27 @Frostman @KFearsoff

Technical details

[root@stats:~]# nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 5.15.77, NixOS, 22.11 (Raccoon), 22.11.1137.dac57a4eccf`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.11.1`
 - channels(root): `"nixos-22.11"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

[SuperSandro2000]

Without enabled (and properly configured) firewall this could result in situations where people are exposing their Grafana installation unintentionally.

but the default settings should suffice to catch this, right?

This also matches the upstream grafana default https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#http_addr

[herbetom]

but the default settings should suffice to catch this, right?

Yes, I would think so. Therefore not really dramatic in most cases.