Server web e reverse proxy

1. Add these arguments to Traefik's command (or the same keys to its static configuration), then restart it.

   --api.insecure=true
   --metrics.prometheus=true

2. Open http://traefik.lan:8080/api/overview from the DumbMonit host: it must answer with JSON.

3. Optional: protect /api and /metrics with a basicAuth middleware on an entry point of your own, and create the user with htpasswd.

   htpasswd -nbB dumbmonit 'a-long-password'

4. In DumbMonit, enter the Traefik host, for example traefik.lan, with the port of that entry point if it is not 8080.

Attenzione. Port 8080 answers without a password: filter it so that only the DumbMonit host reaches it.

1. Hash a password for the user dumbmonit.

   caddy hash-password --plaintext 'a-long-password'

2. Add this site to the Caddyfile, put the hash in place of HASH, then reload Caddy.

   :2020 {
   basic_auth {
   dumbmonit HASH
   }
   @readonly {
   method GET
   path /config/apps/http/servers /reverse_proxy/upstreams /metrics
   }
   handle @readonly {
   reverse_proxy localhost:2019 {
   header_up Host localhost:2019
   }
   }
   respond 403
   }

3. Optional: add metrics to the global options block at the top of the Caddyfile to count requests and errors.

   metrics

4. Filter port 2020 so that only the DumbMonit host reaches it.

5. In DumbMonit, enter the Caddy host with that port, for example caddy.lan:2020, and the user dumbmonit with its password.

Attenzione. Never expose the admin API itself: whoever reaches port 2019 can replace the configuration or stop Caddy.

1. Add this location to the server block Nginx already serves, restricted to the DumbMonit host (adjust the address).

   location /basic_status {
   stub_status;
   allow 10.0.0.5;
   deny all;
   }

2. Reload Nginx.

   nginx -s reload

3. Open http://nginx.lan/basic_status from the DumbMonit host: it must show Active connections.

4. In DumbMonit, enter the Nginx host, for example nginx.lan, and the path if it is not /basic_status.

5. If NGINX Plus is installed, tick Read the NGINX Plus API to add upstream health and per-zone counters.

Attenzione. stub_status only counts connections and requests: a configuration error in a server block or an unreachable backend does not show there.

1. Enable mod_status (it ships with Apache and is usually on already).

   a2enmod status

2. Add this location to the Apache configuration, restricted to the DumbMonit host (adjust the address).

   <Location "/server-status">
   SetHandler server-status
   Require ip 10.0.0.5
   </Location>

3. Optional: turn on the request and byte counters.

   ExtendedStatus On

4. Reload Apache, then open http://apache.lan/server-status?auto from the DumbMonit host.

   apachectl graceful

5. In DumbMonit, enter the Apache host, for example apache.lan, and the path if it is not /server-status.

Attenzione. Without ExtendedStatus, requests and bytes are not reported at all: the chart stays empty rather than flat.

1. In Nginx Proxy Manager, open Users → Add User, give it an email of its own such as [email protected], and leave every role unticked.

2. From that user's menu, open Permissions and set the levels listed below.

3. From the same menu, choose Change Password and set a password.

4. In DumbMonit, enter the Nginx Proxy Manager host with its web port, for example npm.lan:81, and that email and password.

Attenzione. Leave SSL Certificates on Hidden: Nginx Proxy Manager hands private keys to any user allowed to view them.