Scrape Prometheus Over the VPC, Not Through Cloudflare
This article was originally published on Jo4 Blog . We built three layers of defense for our Prometheus scrape. Two of them were unnecessary. This isn't a "we found a bug" post. It's a "we designed the wrong architecture, then corrected it" post. The system worked. It was just doing far more than it needed to. Sharing it because the wrong path was the obvious-looking one, and the right path was…
This article discusses how a Prometheus scrape configuration for a Spring Boot API behind Nginx was overly complex due to unnecessary security layers. The original setup involved three layers of defense: Cloudflare WAF, OAuth2 client_credentials grant, and DigitalOcean cloud firewall. However, the scrape was only happening between two droplets in the same private Virtual Private Cloud (VPC).
The author noticed that both droplets were in the same region and adjacent private IPs, meaning they were already connected on a private network without public exposure.
After realizing this, the author redesigned the architecture to remove the Cloudflare layer and the TLS termination at Nginx. The Prometheus scrape would now connect directly to the private IP of the Spring Boot API using HTTP. The OAuth2 authentication was retained at the application layer. The changes were minimal, involving updates to the prometheus.yml configuration file.
The simplified architecture now only involves a single hop between the droplets, with no public internet traffic, TLS handshakes, or additional security layers. This change demonstrates that unnecessary complexity can often be eliminated to improve efficiency and security.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
