HTTPS and authentication

Alertmanager supports basic authentication and TLS. This is experimental and might change in the future.

Currently TLS is supported for the HTTP traffic and gossip traffic.

HTTP Traffic

To specify which web configuration file to load, use the --web.config.file flag.

The file is written in YAML format, defined by the scheme described below. Brackets indicate that a parameter is optional. For non-list parameters the value is set to the specified default.

The file is read upon every http request, such as any change in the configuration and the certificates is picked up immediately.

Generic placeholders are defined as follows:

  • <boolean>: a boolean that can take the values true or false
  • <filename>: a valid path in the current working directory
  • <secret>: a regular string that is a secret, such as a password
  • <string>: a regular string
  1. tls_server_config:
  2.   # Certificate and key files for server to use to authenticate to client.
  3.   cert_file: <filename>
  4.   key_file: <filename>
  6.   # Server policy for client authentication. Maps to ClientAuth Policies.
  7.   # For more detail on clientAuth options:
  8.   # https://golang.org/pkg/crypto/tls/#ClientAuthType
  9.   #
  10.   # NOTE: If you want to enable client authentication, you need to use
  11.   # RequireAndVerifyClientCert. Other values are insecure.
  12.   [ client_auth_type: <string> | default = "NoClientCert" ]
  14.   # CA certificate for client certificate authentication to the server.
  15.   [ client_ca_file: <filename> ]
  17.   # Minimum TLS version that is acceptable.
  18.   [ min_version: <string> | default = "TLS12" ]
  20.   # Maximum TLS version that is acceptable.
  21.   [ max_version: <string> | default = "TLS13" ]
  23.   # List of supported cipher suites for TLS versions up to TLS 1.2. If empty,
  24.   # Go default cipher suites are used. Available cipher suites are documented
  25.   # in the go documentation:
  26.   # https://golang.org/pkg/crypto/tls/#pkg-constants
  27.   [ cipher_suites:
  28.     [ - <string> ] ]
  30.   # prefer_server_cipher_suites controls whether the server selects the
  31.   # client's most preferred ciphersuite, or the server's most preferred
  32.   # ciphersuite. If true then the server's preference, as expressed in
  33.   # the order of elements in cipher_suites, is used.
  34.   [ prefer_server_cipher_suites: <bool> | default = true ]
  36.   # Elliptic curves that will be used in an ECDHE handshake, in preference
  37.   # order. Available curves are documented in the go documentation:
  38.   # https://golang.org/pkg/crypto/tls/#CurveID
  39.   [ curve_preferences:
  40.     [ - <string> ] ]
  42. http_server_config:
  43.   # Enable HTTP/2 support. Note that HTTP/2 is only supported with TLS.
  44.   # This can not be changed on the fly.
  45.   [ http2: <boolean> | default = true ]
  46.   # List of headers that can be added to HTTP responses.
  47.   [ headers:
  48.     # Set the Content-Security-Policy header to HTTP responses.
  49.     # Unset if blank.
  50.     [ Content-Security-Policy: <string> ]
  51.     # Set the X-Frame-Options header to HTTP responses.
  52.     # Unset if blank. Accepted values are deny and sameorigin.
  53.     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
  54.     [ X-Frame-Options: <string> ]
  55.     # Set the X-Content-Type-Options header to HTTP responses.
  56.     # Unset if blank. Accepted value is nosniff.
  57.     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
  58.     [ X-Content-Type-Options: <string> ]
  59.     # Set the X-XSS-Protection header to all responses.
  60.     # Unset if blank. Accepted value is nosniff.
  61.     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
  62.     [ X-XSS-Protection: <string> ]
  63.     # Set the Strict-Transport-Security header to HTTP responses.
  64.     # Unset if blank.
  65.     # Please make sure that you use this with care as this header might force
  66.     # browsers to load Prometheus and the other applications hosted on the same
  67.     # domain and subdomains over HTTPS.
  68.     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
  69.     [ Strict-Transport-Security: <string> ] ]
  71. # Usernames and hashed passwords that have full access to the web
  72. # server via basic authentication. If empty, no basic authentication is
  73. # required. Passwords are hashed with bcrypt.
  74. basic_auth_users:
  75.   [ <string>: <secret> ... ]

Gossip Traffic

To specify whether to use mutual TLS for gossip, use the --cluster.tls-config flag.

The server and client sides of the gossip are configurable.

  1. tls_server_config:
  2.   # Certificate and key files for server to use to authenticate to client.
  3.   cert_file: <filename>
  4.   key_file: <filename>
  6.   # Server policy for client authentication. Maps to ClientAuth Policies.
  7.   # For more detail on clientAuth options:
  8.   # https://golang.org/pkg/crypto/tls/#ClientAuthType
  9.   [ client_auth_type: <string> | default = "NoClientCert" ]
  11.   # CA certificate for client certificate authentication to the server.
  12.   [ client_ca_file: <filename> ]
  14.   # Minimum TLS version that is acceptable.
  15.   [ min_version: <string> | default = "TLS12" ]
  17.   # Maximum TLS version that is acceptable.
  18.   [ max_version: <string> | default = "TLS13" ]
  20.   # List of supported cipher suites for TLS versions up to TLS 1.2. If empty,
  21.   # Go default cipher suites are used. Available cipher suites are documented
  22.   # in the go documentation:
  23.   # https://golang.org/pkg/crypto/tls/#pkg-constants
  24.   [ cipher_suites:
  25.     [ - <string> ] ]
  27.   # prefer_server_cipher_suites controls whether the server selects the
  28.   # client's most preferred ciphersuite, or the server's most preferred
  29.   # ciphersuite. If true then the server's preference, as expressed in
  30.   # the order of elements in cipher_suites, is used.
  31.   [ prefer_server_cipher_suites: <bool> | default = true ]
  33.   # Elliptic curves that will be used in an ECDHE handshake, in preference
  34.   # order. Available curves are documented in the go documentation:
  35.   # https://golang.org/pkg/crypto/tls/#CurveID
  36.   [ curve_preferences:
  37.     [ - <string> ] ]
  39. tls_client_config:
  40.   # Path to the CA certificate with which to validate the server certificate.
  41.   [ ca_file: <filepath> ]
  43.   # Certificate and key files for client cert authentication to the server.
  44.   [ cert_file: <filepath> ]
  45.   [ key_file: <filepath> ]
  47.   # Server name extension to indicate the name of the server.
  48.   # http://tools.ietf.org/html/rfc4366#section-3.1
  49.   [ server_name: <string> ]
  51.   # Disable validation of the server certificate.
  52.   [ insecure_skip_verify: <boolean> | default = false]