Refactor: IP 화이트 리스트 설정으로 모니터링 도구 접근 제한 #49
Conversation
- 프로메테우스, 그라파나 모니터링 도구의 접근을 IP 기반 접근 제한을 두었습니다. - 2명의 개발자의 작업공간 공인 IP 에서만 접근이 가능합니다. - deploy.sh 자동화 쉘 스크립트를 실행했을 때, 화이트 리스트를 적용하기 위해서 동작을 수정했습니다. - deploy.sh 실행 시, Permission denied 오류를 해결하기 위해서 sudo 명령어를 추가했습니다. issue #32
There was a problem hiding this comment.
Pull Request Overview
This PR implements IP-based access control for monitoring tools (Prometheus and Grafana) by introducing a whitelist configuration system. The changes restrict access to these monitoring tools to only specified developer IPs and address permission issues in the deployment script.
- Refactored whitelist file naming from
allowed_ips.conftoallowed_ips.rules - Modified deployment script to use
sudocommands for file operations to resolve permission errors - Updated Nginx configuration to apply IP whitelist restrictions to Grafana and Prometheus endpoints
- Enhanced Docker Compose configuration with persistent volumes and dependency management
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| scripts/deploy.sh | Updated whitelist file name and added sudo commands for file operations |
| nginx/nginx-prod.conf | Applied IP whitelist restrictions to monitoring endpoints and updated include path |
| docker-compose.yml | Added persistent volumes for monitoring data and improved service dependencies |
Comments suppressed due to low confidence (3)
| image: prom/prometheus | ||
| container_name: prometheus | ||
| volumes: | ||
| - ./data/prometheus:/prometheus |
There was a problem hiding this comment.
The volume mapping ./data/prometheus:/prometheus may conflict with Prometheus's default data directory. Consider using /prometheus/data as the container path or ensure the host directory has proper permissions for the prometheus user (UID 65534).
| - ./data/prometheus:/prometheus | |
| - ./data/prometheus:/prometheus/data |
| ports: | ||
| - "3000:3000" | ||
| volumes: | ||
| - ./data/grafana:/var/lib/grafana |
There was a problem hiding this comment.
You have both ./data/grafana:/var/lib/grafana and grafana-storage:/var/lib/grafana mounting to the same container path. This will cause the named volume to be ignored. Consider removing one of these volume mappings to avoid conflicts.
| - ./data/grafana:/var/lib/grafana |
#️⃣ 연관된 이슈
issue #32
📝 작업 내용
💬 리뷰 요구사항