Added option to disable metrics collection and defaulted it to off

4 files changed, 42 insertions, 7 deletions

diff --git a/Jellyfin.Server/Jellyfin.Server.csproj b/Jellyfin.Server/Jellyfin.Server.csproj
index c49fc41f46..88114d9994 100644
--- a/Jellyfin.Server/Jellyfin.Server.csproj
+++ b/Jellyfin.Server/Jellyfin.Server.csproj
@@ -45,7 +45,6 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="3.1.3" />
     <PackageReference Include="prometheus-net" Version="3.5.0" />
     <PackageReference Include="prometheus-net.AspNetCore" Version="3.5.0" />
-    <PackageReference Include="prometheus-net.DotNetRuntime" Version="3.3.1" />
     <PackageReference Include="Serilog.AspNetCore" Version="3.2.0" />
     <PackageReference Include="Serilog.Enrichers.Thread" Version="3.1.0" />
     <PackageReference Include="Serilog.Settings.Configuration" Version="3.1.0" />
diff --git a/Jellyfin.Server/Migrations/Routines/DisableMetricsCollection.cs b/Jellyfin.Server/Migrations/Routines/DisableMetricsCollection.cs
new file mode 100644
index 0000000000..b5dc43614e
--- /dev/null
+++ b/Jellyfin.Server/Migrations/Routines/DisableMetricsCollection.cs
@@ -0,0 +1,33 @@
+using System;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Model.Configuration;
+using Microsoft.Extensions.Logging;
+
+namespace Jellyfin.Server.Migrations.Routines
+{
+    /// <summary>
+    /// Disable metrics collections for all installations since it can be a security risk if not properly secured.
+    /// </summary>
+    internal class DisableMetricsCollection : IMigrationRoutine
+    {
+        /// <inheritdoc/>
+        public Guid Id => Guid.Parse("{4124C2CD-E939-4FFB-9BE9-9B311C413638}");
+
+        /// <inheritdoc/>
+        public string Name => "DisableMetricsCollection";
+
+        /// <inheritdoc/>
+        public void Perform(CoreAppHost host, ILogger logger)
+        {
+            // Set EnableMetrics to false since it can leak sensitive information if not properly secured
+            var metrics = host.ServerConfigurationManager.Configuration.EnableMetrics;
+            if (metrics)
+            {
+                logger.LogInformation("Disabling metrics collection during migration");
+                metrics = false;
+
+                host.ServerConfigurationManager.SaveConfiguration("false", metrics);
+            }
+        }
+    }
+}
diff --git a/Jellyfin.Server/Program.cs b/Jellyfin.Server/Program.cs
index be070f9d52..193d30e3a7 100644
--- a/Jellyfin.Server/Program.cs
+++ b/Jellyfin.Server/Program.cs
@@ -28,7 +28,6 @@ using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using Prometheus.DotNetRuntime;
 using Serilog;
 using Serilog.Extensions.Logging;
 using SQLitePCL;
@@ -162,9 +161,6 @@ namespace Jellyfin.Server
 
             ApplicationHost.LogEnvironmentInfo(_logger, appPaths);
 
-            // Initialize runtime stat collection
-            IDisposable collector = DotNetRuntimeStatsBuilder.Default().StartCollecting();
-
             // Make sure we have all the code pages we can get
             // Ref: https://docs.microsoft.com/en-us/dotnet/api/system.text.codepagesencodingprovider.instance?view=netcore-3.0#remarks
             Encoding.RegisterProvider(CodePagesEncodingProvider.Instance);
diff --git a/Jellyfin.Server/Startup.cs b/Jellyfin.Server/Startup.cs
index 2e5f843e3a..8f85161c7d 100644
--- a/Jellyfin.Server/Startup.cs
+++ b/Jellyfin.Server/Startup.cs
@@ -70,11 +70,18 @@ namespace Jellyfin.Server
             app.UseJellyfinApiSwagger();
             app.UseRouting();
             app.UseAuthorization();
-            app.UseHttpMetrics(); // Must be registered after any middleware that could chagne HTTP response codes or the data will be bad
+            if (_serverConfigurationManager.Configuration.EnableMetrics)
+            {
+                app.UseHttpMetrics(); // Must be registered after any middleware that could chagne HTTP response codes or the data will be bad
+            }
+
             app.UseEndpoints(endpoints =>
             {
                 endpoints.MapControllers();
-                endpoints.MapMetrics();
+                if (_serverConfigurationManager.Configuration.EnableMetrics)
+                {
+                    endpoints.MapMetrics();
+                }
             });
 
             app.Use(serverApplicationHost.ExecuteHttpHandlerAsync);