fix: allow internal metrics scrapes without ssl redirect

Author: masterkain

config/prod.exs

@@ -8,6 +8,7 @@ config :codex_pooler, CodexPoolerWeb.Endpoint,
     rewrite_on: [:x_forwarded_host, :x_forwarded_port, :x_forwarded_proto],
     exclude: [
       hosts: ["localhost", "127.0.0.1"],
+      paths: ["/metrics"],
       conn: {CodexPoolerWeb.Plugs.ForwardedSSL, :websocket_over_forwarded_ssl?, []}
     ]
   ]

test/codex_pooler_web/controllers/browser/browser_security_headers_test.exs

@@ -93,6 +93,17 @@ defmodule CodexPoolerWeb.Browser.BrowserSecurityHeadersTest do
     refute conn.status == 301
   end
 
+  test "production Plug.SSL allows internal metrics scrapes without redirecting" do
+    opts = Plug.SSL.init(production_force_ssl_options!())
+
+    conn = build_conn(:get, "/metrics")
+
+    conn = Plug.SSL.call(conn, opts)
+
+    refute conn.halted
+    refute conn.status == 301
+  end
+
   test "Plug.SSL still redirects non-websocket forwarded HTTP requests" do
     opts =
       Plug.SSL.init(
@@ -163,4 +174,15 @@ defmodule CodexPoolerWeb.Browser.BrowserSecurityHeadersTest do
 
   defp restore_env(key, nil), do: Application.delete_env(:codex_pooler, key)
   defp restore_env(key, value), do: Application.put_env(:codex_pooler, key, value)
+
+  defp production_force_ssl_options! do
+    endpoint_config =
+      File.cwd!()
+      |> Path.join("config/prod.exs")
+      |> Config.Reader.read!()
+      |> Keyword.fetch!(:codex_pooler)
+      |> Keyword.fetch!(CodexPoolerWeb.Endpoint)
+
+    Keyword.fetch!(endpoint_config, :force_ssl)
+  end
 end