Documentation Grafana Cloud Instrument and send data Grafana Alloy Reference Configuration blocks http

http

http is an optional configuration block used to customize how the Alloy HTTP server functions. http is specified without a label and can only be provided once per configuration file.

Usage

alloy Copy

http {

}

Arguments

The http block doesn’t support any arguments. You can configure this block with inner blocks.

Blocks

You can use the following blocks with http:

The > symbol indicates deeper levels of nesting. For example, auth > basic refers to an basic block defined inside an auth block.

auth

The auth block configures server authentication for the http block. This can be used to enable basic authentication and to set authentication filters for specified API paths.

basic

The basic block enables basic HTTP authentication by requiring both a username and password for access.

filter

The filter block is used to configure which API paths should be protected by authentication. It allows you to specify a list of paths, using prefix matching, that will require authentication.

tls

The tls block configures TLS settings for the HTTP server.

When the tls block is specified, arguments for the TLS certificate (using cert_pem or cert_file) and for the TLS key (using key_pem or key_file) are required.

The following pairs of arguments are mutually exclusive, and only one may be configured at a time:

• cert_pem and cert_file
• key_pem and key_file
• client_ca_pem and client_ca_file

The client_auth_type argument determines whether to validate client certificates. The default value, NoClientCert, indicates that the client certificate isn’t validated. The client_ca_pem and client_ca_file arguments may only be configured when client_auth_type is not NoClientCert.

The following values are accepted for client_auth_type:

• NoClientCert: client certificates are neither requested nor validated.
• RequestClientCert: requests clients to send an optional certificate. Certificates provided by clients aren’t validated.
• RequireAnyClientCert: requires at least one certificate from clients. Certificates provided by clients aren’t validated.
• VerifyClientCertIfGiven: requests clients to send an optional certificate. If a certificate is sent, it must be valid.
• RequireAndVerifyClientCert: requires clients to send a valid certificate.

The client_ca_pem or client_ca_file arguments may be used to perform client certificate validation. These arguments may only be provided when client_auth_type isn’t set to NoClientCert.

The cipher_suites argument determines what cipher suites to use. If you don’t provide cipher suite, a default list is used. The set of cipher suites specified may be from the following:

The curve_preferences argument determines the set of elliptic curves to prefer during a handshake in preference order. If not provided, a default list is used. The set of elliptic curves specified may be from the following:

The min_version and max_version arguments determine the oldest and newest TLS version that’s acceptable from clients. If you don’t provide the min and max TLS version, a default value is used.

The following versions are recognized:

• TLS13 for TLS 1.3
• TLS12 for TLS 1.2
• TLS11 for TLS 1.1
• TLS10 for TLS 1.0

windows certificate filter

The windows_certificate_filter block is used to configure retrieving certificates from the built-in Windows certificate store. When you use the windows_certificate_filter block the following TLS settings are overridden and cause an error if defined.

• cert_pem
• cert_file
• key_pem
• key_file
• client_ca
• client_ca_file

client

The client block is used to check the certificate presented to the server.

server

The server block is used to find the certificate to check the signer. If multiple certificates are found, the windows_certificate_filter chooses the certificate with the expiration farthest in the future.

Examples

Example of enforcing authentication on /metrics and every endpoint that has /v1 as prefix:

alloy Copy

http {
  auth {
    basic {
      username = sys.env("BASIC_AUTH_USERNAME")
      password = sys.env("BASIC_AUTH_PASSWORD")
    }

    filter {
      paths                       = ["/metrics", "/v1"]
      authenticate_matching_paths = true
    }
  }
}

Example enforcing authentication on all endpoints except /metrics:

alloy Copy

http {
  auth {
    basic {
      username = sys.env("BASIC_AUTH_USERNAME")
      password = sys.env("BASIC_AUTH_PASSWORD")
    }

    filter {
      paths                       = ["/metrics"]
      authenticate_matching_paths = false
    }
  }
}