fix(ops): bridge production metrics securely

monitoring/edge/ewoooc_metrics_nginx_bridge.conf

@@ -0,0 +1,24 @@
+# Internal bridge from the 110 Prometheus network to the 188 EwoooC ingress.
+server {
+    listen 172.20.0.1:9191;
+    server_name ewooooc-metrics.internal;
+    access_log off;
+
+    location = /metrics {
+        allow 172.16.0.0/12;
+        deny all;
+
+        proxy_pass https://192.168.0.188/metrics;
+        proxy_http_version 1.1;
+        proxy_ssl_server_name on;
+        proxy_ssl_name mo.wooo.work;
+        proxy_ssl_verify on;
+        proxy_ssl_verify_depth 3;
+        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+        proxy_set_header Host mo.wooo.work;
+    }
+
+    location / {
+        return 404;
+    }
+}

monitoring/edge/ewoooc_metrics_nginx_location.conf

@@ -1,13 +0,0 @@
-# Source-owned exact-match edge policy for EwoooC Prometheus metrics.
-location = /metrics {
-    allow 127.0.0.1;
-    allow ::1;
-    allow 172.16.0.0/12;
-    deny all;
-
-    proxy_pass http://127.0.0.1:5003/metrics;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-}

monitoring/edge/ewoooc_prometheus_scrape.yml

@@ -1,10 +1,10 @@
   - job_name: 'ewoooc-app'
-    scheme: https
+    scheme: http
     metrics_path: /metrics
     scrape_interval: 30s
     scrape_timeout: 15s
     static_configs:
-      - targets: ['mo.wooo.work']
+      - targets: ['172.20.0.1:9191']
         labels:
           environment: 'production'
           product: 'ewoooc'