HTTPS

[josephglanville]

It would be good to be able to expose the node_exporter metrics over HTTPS with basic auth. Bonus points for client certificate verification.

For now will probably use a reverse proxy for this but it does seem like something that makes sense to have baked in.

[brian-brazil]

The stance of the project is that auth is not an essential part of monitoring, and you're better off using tools designed to provide such features (such as nginx) rather than adding it to prometheus components as this would distract us from our focus on monitoring issues. As one example just HTTPS/SSL has 20+ configuration parameters that'd need to be exposed and maintained.

[juliusv]

Thanks!

But basically, what @brian-brazil said. See also prometheus/prometheus#972 and prometheus/docs#149 about this issue. It has come up many times, but for the foreseeable future we have decided not to go the route of integrating auth/SSL into any serving components (but do support both on the scraping side).