feat: 모니터링 설정#58
Open
byunhm02 wants to merge 7 commits into
Open
Conversation
📝 WalkthroughWalkthroughPrometheus·Grafana 모니터링 기능이 추가되었습니다: Docker Compose에 Prometheus, Grafana, nginx-exporter와 영속 볼륨이 추가되고 Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant CI as CI/CD Deploy
participant EC2 as EC2 Host
participant Prom as Prometheus
participant App as Application (blue/green)
participant NExp as nginx-exporter
participant Graf as Grafana
CI->>EC2: Upload `docker-compose.yml`,`prometheus.yml`,nginx templates,...
EC2->>Prom: Start Prometheus service (reads /prometheus.yml)
Prom->>App: GET /actuator/prometheus (blue:8080, green:8080) (scrape)
Prom->>NExp: GET /metrics (nginx-exporter:9113) (scrape)
Graf->>Prom: Query metrics (Prometheus API)
Graf-->>User: Render dashboards
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
nginx/conf.d/nginx-green.conf.template (2)
13-17: 들여쓰기가 일관되지 않습니다.
location /stub_status블록 내부의 들여쓰기가 상위location /블록과 일치하지 않습니다. 가독성과 유지보수를 위해 일관된 들여쓰기를 사용해주세요.🔧 들여쓰기 수정 제안
location /stub_status { - stub_status on; - allow 172.0.0.0/8; - deny all; - } + stub_status on; + allow 172.0.0.0/8; + deny all; + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nginx/conf.d/nginx-green.conf.template` around lines 13 - 17, 들여쓰기 불일치: location /stub_status 블록의 들여쓰기가 상위 location / 블록과 맞지 않으니 location /stub_status, stub_status on;, allow 172.0.0.0/8;, deny all;, 그리고 마지막 중괄호의 들여쓰기를 상위 location / 블록과 동일한 수준으로 정렬해 주세요; 각 중첩 블록은 프로젝트의 기존 스타일(예: 4스페이스 또는 탭)을 따라 통일된 들여쓰기를 사용하도록 수정하면 됩니다.
15-15: IP 대역 범위가 과도하게 넓습니다.
172.0.0.0/8은 172.0.0.0 ~ 172.255.255.255 전체를 허용하며, 이 중 일부는 공용 IP 대역입니다. Docker 브릿지 네트워크는 일반적으로172.17.0.0/16또는172.16.0.0/12(사설 IP 범위)를 사용합니다. 보안을 위해 더 제한적인 CIDR을 사용하는 것이 좋습니다.🔒 더 제한적인 IP 대역 사용 제안
location /stub_status { - allow 172.0.0.0/8; + allow 172.16.0.0/12; deny all; }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nginx/conf.d/nginx-green.conf.template` at line 15, The nginx allow directive currently uses an overly broad CIDR "allow 172.0.0.0/8;": replace this with a more restrictive private-range CIDR (e.g., "allow 172.17.0.0/16;" or "allow 172.16.0.0/12;") or make it configurable via a template variable, updating the allow directive in nginx-green.conf.template accordingly to limit access to the expected Docker/private subnet.scripts/deploy.sh (1)
96-100: 동일한 IP 대역 범위 문제가 있습니다.템플릿 파일들과 마찬가지로
172.0.0.0/8대역이 과도하게 넓습니다.172.16.0.0/12로 변경을 권장합니다.🔒 IP 대역 수정 제안
location /stub_status { stub_status on; - allow 172.0.0.0/8; + allow 172.16.0.0/12; deny all; }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/deploy.sh` around lines 96 - 100, In the nginx "location /stub_status" block the allowed CIDR is overly broad (172.0.0.0/8); update the allow directive to the narrower RFC1918 range 172.16.0.0/12 to match the template security recommendation (modify the allow 172.0.0.0/8; line to allow 172.16.0.0/12;).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deploy.yml:
- Line 54: The deploy workflow's source list omits the monitoring directory
referenced by the docker-compose Grafana volume, so update the "source" entry
that currently lists "docker-compose.yml,nginx/,scripts/,prometheus.yml" to also
include "monitoring/" (or specifically "monitoring/grafana/provisioning") so the
provisioning files are uploaded; alternatively, if the provisioning directory
doesn't exist yet, create the "monitoring/grafana/provisioning" directory and
add the required Grafana provisioning files before updating the source list so
the Grafana service's "./monitoring/grafana/provisioning" volume mount is
present on the target host.
In `@docker-compose.yml`:
- Around line 129-156: Prometheus and Grafana are exposed without
authentication; update the docker-compose service definitions for prometheus and
grafana to bind ports to localhost (change the ports mapping from "9090:9090"
and "3000:3000" to host-bound mappings like "127.0.0.1:9090:9090" and
"127.0.0.1:3000:3000"), add Grafana environment configuration to set a secure
admin password (use GF_SECURITY_ADMIN_PASSWORD in the grafana service), and
instead of exposing these services publicly recommend placing them behind an
authenticated reverse proxy (e.g., nginx) configured to handle TLS and access
control so prometheus and grafana services remain localhost-only.
- Line 151: docker-compose.yml references a host mount
./monitoring/grafana/provisioning which doesn't exist; either create the missing
directory with required provisioning files, add an initialization step that
creates ./monitoring/grafana/provisioning and places default provisioning files
before bringing Grafana up, or change the service's volume definition (the line
mounting ./monitoring/grafana/provisioning) to use a named volume or conditional
setup so Grafana won't fail on startup when the host path is absent.
In `@prometheus.yml`:
- Around line 6-11: Add the Prometheus endpoint to the public endpoints so
unauthenticated GET scrapes succeed: update the PublicEndpoint registry by
adding a new PublicEndpoint("/actuator/prometheus", HttpMethod.GET) (ensure
HttpMethod is imported/used consistently) so SecurityConfig's public-endpoint
checks will allow Prometheus to access /actuator/prometheus on blue/green
without authentication.
---
Nitpick comments:
In `@nginx/conf.d/nginx-green.conf.template`:
- Around line 13-17: 들여쓰기 불일치: location /stub_status 블록의 들여쓰기가 상위 location / 블록과
맞지 않으니 location /stub_status, stub_status on;, allow 172.0.0.0/8;, deny all;,
그리고 마지막 중괄호의 들여쓰기를 상위 location / 블록과 동일한 수준으로 정렬해 주세요; 각 중첩 블록은 프로젝트의 기존 스타일(예:
4스페이스 또는 탭)을 따라 통일된 들여쓰기를 사용하도록 수정하면 됩니다.
- Line 15: The nginx allow directive currently uses an overly broad CIDR "allow
172.0.0.0/8;": replace this with a more restrictive private-range CIDR (e.g.,
"allow 172.17.0.0/16;" or "allow 172.16.0.0/12;") or make it configurable via a
template variable, updating the allow directive in nginx-green.conf.template
accordingly to limit access to the expected Docker/private subnet.
In `@scripts/deploy.sh`:
- Around line 96-100: In the nginx "location /stub_status" block the allowed
CIDR is overly broad (172.0.0.0/8); update the allow directive to the narrower
RFC1918 range 172.16.0.0/12 to match the template security recommendation
(modify the allow 172.0.0.0/8; line to allow 172.16.0.0/12;).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 57934f65-fe09-4aaa-a940-d2ee972f0815
📒 Files selected for processing (6)
.github/workflows/deploy.ymldocker-compose.ymlnginx/conf.d/nginx-blue.conf.templatenginx/conf.d/nginx-green.conf.templateprometheus.ymlscripts/deploy.sh
| username: ${{ secrets.EC2_USER }} | ||
| key: ${{ secrets.EC2_SSH_KEY }} | ||
| source: "docker-compose.yml,nginx/,scripts/" | ||
| source: "docker-compose.yml,nginx/,scripts/,prometheus.yml" |
There was a problem hiding this comment.
monitoring/ 디렉토리가 전송 목록에서 누락되었습니다.
docker-compose.yml의 Grafana 서비스에서 ./monitoring/grafana/provisioning 볼륨을 마운트하고 있지만, 이 디렉토리가 EC2로 전송되지 않습니다. Grafana 컨테이너가 시작 시 실패하거나 프로비저닝 없이 기본 설정으로 실행됩니다.
🐛 monitoring 디렉토리 추가 제안
- source: "docker-compose.yml,nginx/,scripts/,prometheus.yml"
+ source: "docker-compose.yml,nginx/,scripts/,prometheus.yml,monitoring/"또는 monitoring/grafana/provisioning 디렉토리가 아직 생성되지 않았다면, 해당 디렉토리와 프로비저닝 파일을 먼저 추가해야 합니다.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| source: "docker-compose.yml,nginx/,scripts/,prometheus.yml" | |
| source: "docker-compose.yml,nginx/,scripts/,prometheus.yml,monitoring/" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deploy.yml at line 54, The deploy workflow's source list
omits the monitoring directory referenced by the docker-compose Grafana volume,
so update the "source" entry that currently lists
"docker-compose.yml,nginx/,scripts/,prometheus.yml" to also include
"monitoring/" (or specifically "monitoring/grafana/provisioning") so the
provisioning files are uploaded; alternatively, if the provisioning directory
doesn't exist yet, create the "monitoring/grafana/provisioning" directory and
add the required Grafana provisioning files before updating the source list so
the Grafana service's "./monitoring/grafana/provisioning" volume mount is
present on the target host.
Comment on lines
+129
to
+156
| prometheus: | ||
| image: prom/prometheus | ||
| container_name: prometheus | ||
| ports: | ||
| - "9090:9090" | ||
| volumes: | ||
| - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro | ||
| - prometheus_data:/prometheus | ||
| command: | ||
| - '--config.file=/etc/prometheus/prometheus.yml' | ||
| - '--storage.tsdb.path=/prometheus' | ||
| networks: | ||
| - app-network | ||
| restart: always | ||
|
|
||
| grafana: | ||
| image: grafana/grafana | ||
| container_name: grafana | ||
| ports: | ||
| - "3000:3000" | ||
| volumes: | ||
| - grafana_data:/var/lib/grafana | ||
| - ./monitoring/grafana/provisioning:/etc/grafana/provisioning | ||
| restart: always | ||
| depends_on: | ||
| - prometheus | ||
| networks: | ||
| - app-network |
There was a problem hiding this comment.
Prometheus와 Grafana가 외부에 인증 없이 노출됩니다.
Prometheus (포트 9090)와 Grafana (포트 3000)가 공용 네트워크에 직접 노출되어 있습니다. 이는 다음과 같은 보안 위험이 있습니다:
- Prometheus: 민감한 메트릭 데이터 노출, 타겟 정보 유출
- Grafana: 기본 자격 증명(admin/admin)으로 접근 가능
운영 환경에서는 다음을 권장합니다:
- 포트를
127.0.0.1:9090:9090으로 바인딩하여 로컬 접근만 허용 - Nginx 리버스 프록시를 통해 인증 추가
- Grafana 환경 변수로 기본 비밀번호 변경 (
GF_SECURITY_ADMIN_PASSWORD)
🔒 보안 강화 제안 (로컬 바인딩)
prometheus:
image: prom/prometheus
container_name: prometheus
ports:
- - "9090:9090"
+ - "127.0.0.1:9090:9090"
...
grafana:
image: grafana/grafana
container_name: grafana
ports:
- - "3000:3000"
+ - "127.0.0.1:3000:3000"
+ environment:
+ - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
...📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| prometheus: | |
| image: prom/prometheus | |
| container_name: prometheus | |
| ports: | |
| - "9090:9090" | |
| volumes: | |
| - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro | |
| - prometheus_data:/prometheus | |
| command: | |
| - '--config.file=/etc/prometheus/prometheus.yml' | |
| - '--storage.tsdb.path=/prometheus' | |
| networks: | |
| - app-network | |
| restart: always | |
| grafana: | |
| image: grafana/grafana | |
| container_name: grafana | |
| ports: | |
| - "3000:3000" | |
| volumes: | |
| - grafana_data:/var/lib/grafana | |
| - ./monitoring/grafana/provisioning:/etc/grafana/provisioning | |
| restart: always | |
| depends_on: | |
| - prometheus | |
| networks: | |
| - app-network | |
| prometheus: | |
| image: prom/prometheus | |
| container_name: prometheus | |
| ports: | |
| - "127.0.0.1:9090:9090" | |
| volumes: | |
| - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro | |
| - prometheus_data:/prometheus | |
| command: | |
| - '--config.file=/etc/prometheus/prometheus.yml' | |
| - '--storage.tsdb.path=/prometheus' | |
| networks: | |
| - app-network | |
| restart: always | |
| grafana: | |
| image: grafana/grafana | |
| container_name: grafana | |
| ports: | |
| - "127.0.0.1:3000:3000" | |
| environment: | |
| - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD} | |
| volumes: | |
| - grafana_data:/var/lib/grafana | |
| - ./monitoring/grafana/provisioning:/etc/grafana/provisioning | |
| restart: always | |
| depends_on: | |
| - prometheus | |
| networks: | |
| - app-network |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docker-compose.yml` around lines 129 - 156, Prometheus and Grafana are
exposed without authentication; update the docker-compose service definitions
for prometheus and grafana to bind ports to localhost (change the ports mapping
from "9090:9090" and "3000:3000" to host-bound mappings like
"127.0.0.1:9090:9090" and "127.0.0.1:3000:3000"), add Grafana environment
configuration to set a secure admin password (use GF_SECURITY_ADMIN_PASSWORD in
the grafana service), and instead of exposing these services publicly recommend
placing them behind an authenticated reverse proxy (e.g., nginx) configured to
handle TLS and access control so prometheus and grafana services remain
localhost-only.
Contributor
|
설정 자체에는 문제가 없는거 같아요! |
Kyoung-M1N
approved these changes
Mar 25, 2026
Kyoung-M1N
left a comment
Kyoung-M1N
left a comment
Contributor
There was a problem hiding this comment.
대시보드 구성 너무 좋네요!
고생하셨습니다!!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Related issue
closes #54
#️⃣ Summary
🎯 Work Description
👍 동작 확인
💬 To Reviewers
Summary by CodeRabbit
새로운 기능
작업(Chores)