Dropping Cloudflare from a Prometheus scrape retired two of its three defense layers

The check that made the swap safe was one command. From inside jo4-impress, a request to http://10.108.0.3:8080/actuator/prometheus carrying no bearer token came back HTTP/1.1 401 Unauthorized with a WWW-Authenticate: Bearer header ^[13]. Spring Security's filter chain runs the same way for traffic arriving on the private interface, so the OAuth requirement belongs to the endpoint and not to the network path ^[14]. The author said hand-verifying it was worth the trouble because being fairly sure on that question is the kind of thing that gets you fired ^[18].

That distinction decides which of the three controls the move made redundant. A WAF allowlist on /actuator/* is a statement about a route ^[3]. So is a cloud firewall admitting port 443 only from Cloudflare's published CIDR ranges ^[5]. The client_credentials grant with scope metrics:read is a statement about an endpoint ^[4], and the corrected topology keeps it, alongside a single DigitalOcean firewall rule allowing tcp/8080 from tag:impress ^[11]. The post's own count is three layers of defense with two of them unnecessary ^[19], and it does not say whether the WAF rule was deleted or just left in place.

A 30-second interval is 2,880 scrapes a day ^[20]. Each one opened a TLS session with Cloudflare and a second with nginx, then evaluated the WAF rule and minted or reused a token ^[7], so the pair was running roughly 5,760 handshakes a day ^[21]. The payload was about 80 KB a scrape ^[6], near 230 MB a day ^[22], between droplets at 10.108.0.3 and 10.108.0.5 ^[8].

Nothing on the new path uses TLS. The job's scheme is http and the token URL is http://10.108.0.3:8080/oauth/token, since the token endpoint lives on the same Spring Boot app ^[15][16]. According to the post, droplets in one VPC reach each other on private interfaces with no public exposure and no encryption-in-transit requirement, the VPC being a private L2 segment ^[10]. That segment is 10.108.0.0/16, DigitalOcean's default VPC for nyc3 ^[9].

This transfers to another stack only under conditions the post happens to satisfy. Both ends have to sit in the same VPC and region ^[8]. The app has to be listening on a port the private interface can reach, which here it already was, because :8080 served the nginx upstream ^[12]. And the gate has to be in the app. Test it with a request that carries no credential ^[13]. The author wrote: "I had built a public path to talk between two machines on the same private network. That's the kind of thing you laugh at in someone else's design review." ^[17]