Add internal mTLS bridge service for monitoring stack

monitoring/mtls-bridge/Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app.py .
+
+EXPOSE 8080
+
+CMD ["python", "app.py"]

monitoring/mtls-bridge/README.md

@@ -0,0 +1,38 @@
+# mTLS Bridge Service
+
+Internal HTTP-to-mTLS bridge for services that cannot present client certificates directly (for example, Grafana webhooks).
+
+## How it works
+
+1. Accepts plain HTTP requests inside the Docker network.
+2. Forwards requests to an HTTPS upstream.
+3. Presents a client certificate/key pair for mTLS authentication.
+
+## Environment variables
+
+- `TARGET_URL` (required): HTTPS upstream base URL.
+- `CLIENT_CERT` (default `/certs/client.crt`): client certificate path.
+- `CLIENT_KEY` (default `/certs/client.key`): client private key path.
+- `CA_CERT` (default `/certs/ca.crt`): CA certificate bundle used to verify upstream TLS.
+- `TIMEOUT` (default `5`): request timeout in seconds.
+- `LOG_LEVEL` (default `INFO`): Python logging level.
+
+## Endpoints
+
+- `GET /health` returns `200 OK` for container health checks.
+- `/*` proxies requests to `${TARGET_URL}` with method/body/headers preserved.
+
+## Compose integration
+
+This repository includes `monitoring/mtls-bridge/docker-compose.yml`:
+
+- No public port exposure.
+- Read-only cert mount (`${PROJECT_ROOT}/core/traefik/certs:/certs:ro`).
+- Joined to internal monitoring/traefik networks.
+
+## Example test
+
+```bash
+curl http://mtls-bridge:8080/health
+curl -X POST http://mtls-bridge:8080
+```

monitoring/mtls-bridge/app.py

@@ -0,0 +1,69 @@
+import logging
+import os
+
+import requests
+from flask import Flask, Response, request
+
+app = Flask(__name__)
+
+logging.basicConfig(
+    level=os.environ.get("LOG_LEVEL", "INFO"),
+    format="%(asctime)s %(levelname)s %(message)s",
+)
+logger = logging.getLogger("mtls-bridge")
+
+# Config via env
+TARGET_URL = os.environ.get("TARGET_URL")
+CLIENT_CERT = os.environ.get("CLIENT_CERT", "/certs/client.crt")
+CLIENT_KEY = os.environ.get("CLIENT_KEY", "/certs/client.key")
+CA_CERT = os.environ.get("CA_CERT", "/certs/ca.crt")
+TIMEOUT = int(os.environ.get("TIMEOUT", "5"))
+
+
+@app.route("/health", methods=["GET"])
+def health():
+    return "OK", 200
+
+
+@app.route("/", defaults={"path": ""}, methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
+@app.route("/<path:path>", methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
+def proxy(path):
+    logger.info("request method=%s path=/%s", request.method, path)
+
+    if not TARGET_URL:
+        return Response("TARGET_URL is not set", status=500)
+
+    try:
+        url = f"{TARGET_URL.rstrip('/')}/{path}".rstrip("/")
+        headers = {k: v for k, v in request.headers if k.lower() != "host"}
+        headers["X-Forwarded-By"] = "mtls-bridge"
+
+        resp = requests.request(
+            method=request.method,
+            url=url,
+            headers=headers,
+            data=request.get_data(),
+            cookies=request.cookies,
+            cert=(CLIENT_CERT, CLIENT_KEY),
+            verify=CA_CERT,
+            timeout=TIMEOUT,
+        )
+
+        logger.info("upstream status=%s url=%s", resp.status_code, url)
+
+        excluded_headers = ["content-encoding", "content-length", "transfer-encoding", "connection"]
+        response_headers = [
+            (k, v)
+            for k, v in resp.raw.headers.items()
+            if k.lower() not in excluded_headers
+        ]
+
+        return Response(resp.content, resp.status_code, response_headers)
+
+    except Exception as e:
+        logger.exception("proxy request failed")
+        return Response(str(e), status=500)
+
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=8080)

monitoring/mtls-bridge/docker-compose.yml

@@ -0,0 +1,18 @@
+services:
+  mtls-bridge:
+    profiles: ["monitoring", "all", "mtls-bridge"]
+    build:
+      context: ${PROJECT_ROOT}/monitoring/mtls-bridge
+    container_name: mtls-bridge
+    restart: unless-stopped
+    environment:
+      - TARGET_URL=https://node-red.lan.ddnsgeek.com/docker-update-lockouts/clear
+      - CLIENT_CERT=/certs/client.crt
+      - CLIENT_KEY=/certs/client.key
+      - CA_CERT=/certs/ca.crt
+      - TIMEOUT=5
+    volumes:
+      - ${PROJECT_ROOT}/core/traefik/certs:/certs:ro
+    networks:
+      - monitor
+      - traefik

monitoring/mtls-bridge/requirements.txt

@@ -0,0 +1,2 @@
+flask
+requests