feat: enhance Prometheus metrics endpoint with private network detection and authentication requirements

Author: nickna

Services/ConduitLLM.Admin/Program.cs

@@ -5,6 +5,7 @@
 using ConduitLLM.Configuration.Extensions;
 using ConduitLLM.Core.Converters;
 using ConduitLLM.Core.Extensions;
+using ConduitLLM.Core.Utilities;
 using ConduitLLM.Providers.Extensions;
 
 using MassTransit; // Added for event bus infrastructure
@@ -351,14 +352,13 @@ public static async Task Main(string[] args)
             Predicate = check => check.Tags.Contains("ready") || check.Tags.Count == 0
         });
 
-        // Map Prometheus metrics endpoint - requires authentication
+        // Map Prometheus metrics endpoint
+        // Allow unauthenticated access from private networks (Docker internal, localhost)
+        // Require authentication for external/public network requests
         app.UseOpenTelemetryPrometheusScrapingEndpoint(
-            context => context.Request.Path == "/metrics" && 
-                      (context.User.Identity?.IsAuthenticated ?? false)
-        );
-
-        // Alternative: Map metrics endpoint without authentication (for monitoring systems)
-        // app.UseOpenTelemetryPrometheusScrapingEndpoint();
+            context => context.Request.Path == "/metrics" &&
+                      (IpAddressHelper.IsPrivateNetworkRequest(context) ||
+                       context.User.Identity?.IsAuthenticated == true));
 
         // For the prometheus-net library metrics
         app.UseHttpMetrics(options =>

Services/ConduitLLM.Gateway/Program.Endpoints.cs

@@ -1,4 +1,5 @@
 using System.Text.Json;
+using ConduitLLM.Core.Utilities;
 
 public partial class Program
 {
@@ -85,8 +86,13 @@ public static void ConfigureEndpoints(WebApplication app)
         });
 
         // Map Prometheus metrics endpoint for scraping
-        app.UseOpenTelemetryPrometheusScrapingEndpoint("/metrics");
-        Console.WriteLine("[Gateway API] Prometheus metrics endpoint registered at /metrics");
+        // Allow unauthenticated access from private networks (Docker internal, localhost)
+        // Require authentication for external/public network requests
+        app.UseOpenTelemetryPrometheusScrapingEndpoint(
+            context => context.Request.Path == "/metrics" &&
+                      (IpAddressHelper.IsPrivateNetworkRequest(context) ||
+                       context.User.Identity?.IsAuthenticated == true));
+        Console.WriteLine("[Gateway API] Prometheus metrics endpoint registered at /metrics (private network or authenticated)");
 
         Console.WriteLine("[Gateway API] All API endpoints are now handled by controllers.");
     }

Shared/ConduitLLM.Core/Utilities/IpAddressHelper.cs

@@ -363,6 +363,29 @@ public static string GetClientIpAddress(Microsoft.AspNetCore.Http.HttpContext co
 
         #endregion
 
+        #region Private Network Request Detection
+
+        /// <summary>
+        /// Checks if an HTTP request originates from a private/internal network.
+        /// Useful for allowing internal monitoring tools (e.g., Prometheus) to access
+        /// endpoints without authentication while still requiring auth for external requests.
+        /// </summary>
+        /// <param name="context">The HTTP context.</param>
+        /// <returns>True if the request comes from a private network, false otherwise.</returns>
+        public static bool IsPrivateNetworkRequest(Microsoft.AspNetCore.Http.HttpContext context)
+        {
+            // For internal Docker network requests, we check the direct connection IP
+            // rather than forwarded headers (which could be spoofed from external sources)
+            var remoteIp = context.Connection.RemoteIpAddress;
+
+            if (remoteIp == null)
+                return false;
+
+            return IsPrivateIp(remoteIp);
+        }
+
+        #endregion
+
         #region Address Family Detection
 
         /// <summary>