# Setting Up Prometheus with NGINX Proxy & Authentication + Configuring Agent Pools

## Challenge: Monitoring System

Deploy a Prometheus monitoring system on an Ubuntu cloud instance. The system should be secured and accessible through a reverse proxy, with proper authentication, and connected to an external Node Exporter. You can follow these steps:

* Install Prometheus and Node Exporter:
    

Update your package list and install Prometheus with the following commands:

```plaintext
sudo apt update
sudo apt install prometheus prometheus-node-exporter
```

Verify the installation by checking the status of Prometheus services:

```plaintext
sudo service prometheus status
sudo service prometheus-node-exporter status
```

Completion Criteria

* Use NGINX as a reverse proxy to forward requests from your server's IP address to Prometheus' default ports as follows:
    

```plaintext
http://{YOUR-SERVER-IP}/ to Prometheus (<http://localhost:9090/>)
http://{YOUR-SERVER-IP}/metrics/ to the Node Exporter (<http://localhost:9100/>)
```

* Basic authentication is set up, requiring credentials to access both endpoints.
    
* Direct access to ports 9090 (Prometheus) and 9100 (Node Exporter) is blocked, and access is only allowed via NGINX.
    
* Prometheus is scraping metrics from an external Node Exporter running the same saver
    

## Prerequisites

* Azure Devops Account
    
* Cloud Azure Account
    
* Created a vm1 on Azure
    

### **Step 1: Create Vm1 on Azure and configure the security group**

1. Go to [Azure Port](https://portal.azure.com/)[al.](https://portal.azure.com/)
    
2. [Sign in](https://portal.azure.com/) with your A[zure account](https://portal.azure.com/).
    
3. In the Azure Portal, search for **Virtual Machines** in the search bar
    
4. Click **Create** → **Azure Virtual Machine**.
    
    1. **Subscription**: Select your Azure subscription.
        
    2. **Resource Group**: Choose an existing one or create a new one.
        
    3. **Region**: Select the closest or preferred Azure region.
        
    4. **Image**: Select the OS (e.g., **Ubuntu 20.04 LTS**).
        
    5. **VM Size**: Choose a size based on your workload (e.g., `Standard_B2s` for small workloads).
        
5. Open the **NSG** you just created.
    
6. Go to **Inbound security rules** under **Settings**.
    
7. Click **\+ Add Rule** to create a new rule.
    
    1. First, go to this site to know what your public IP is - [https://nordvpn.com/pt-br/what-is-my-ip/](https://nordvpn.com/pt-br/what-is-my-ip/)
        
    2. Add an Inbound role with source your public IP and destination your VM, you will create two roles one for port 80 and the other for port 22.
        
    3. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739887820066/2c515a8f-ae89-4283-aa77-d0fdfb937dc0.png align="center")
        

### **Step 2: Connect in your VM with putty**

1. Go to Putty Gen with your credentials, access Conversions → Import Key, and select .pem key
    
2. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739888199287/00a68232-9adf-4c8a-8413-7292e07c0f62.png align="center")
    
    Select on creating your private key
    
3. Now you will open the Putty
    
4. Select the public IP of your VM and Go to SSH → Auth → Browser and select your .ppk key
    

### **Step 3: Configure and Install Agent Pools in Azure DevOps**

1. Go to [**Azure DevOps**](https://dev.azure.com/).
    
2. Sign in with your account.
    
3. Select your **organization**
    
4. Click on **Organization Settings** (bottom left corner).
    
5. Under **Pipelines**, select **Default**.
    
6. Click **\+ New Agent**.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739890175087/e801fffe-7b2d-4b78-84ed-2e24de1f76ec.png align="center")
    
7. Select Linux and follow this installation
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739890252710/66680c63-6c9e-402f-8837-a64d4fe42673.png align="center")
    
8. When you are executing the Configure Agent with ./config in one step will ask you about the token, so you will need to create this token:
    
    1. Click on your **Profile Icon** (top-right corner).
        
    2. Select **Personal Access Tokens**.
        
    3. Click **\+ New Token**.
        
    4. Put the name.
        
    5. Scope: **Full Access**.
        
9. After you enter the token, just click enter with the default settings.
    
10. Start the Agent with ./run.sh
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739891523108/e0b00890-3bdf-41f6-88f5-5ace3b64f7e4.png align="center")

### **Step 4: Create, Configure, and test your Pipeline**

1. Create file `azure-pipelines.yml`
    
2. Enter these configurations:
    
    1. ```plaintext
        trigger:
        - main
        
        pr:
          branches:
            include:
            -  main
        
        stages:
            - stage: Prometheus
            displayName: Prometheus
            pool:
              name: Default
              vmImage: 'vm1'
            jobs:
            - job: Prometheus
              displayName: "Prometheus"
              steps:
              - script: |
                  sudo apt install -y prometheus prometheus-node-exporter nginx apache2-utils
                  
                  sudo systemctl enable --now prometheus
                  sudo systemctl enable --now prometheus-node-exporter
                  sudo systemctl enable --now nginx
        
                  systemctl status prometheus --no-pager
                  systemctl status prometheus-node-exporter --no-pager
                  systemctl status nginx --no-pager
        
                displayName: "Prometheus Install"
        
              - script: |
                  echo 'global:
                    scrape_interval: 15s
        
                  scrape_configs:
                    - job_name: "prometheus"
                      static_configs:
                        - targets: ["localhost:9090"]
        
                    - job_name: "node_exporter"
                      static_configs:
                        - targets: ["localhost:9100"]
                  ' | sudo tee /etc/prometheus/prometheus.yml
        
                  sudo systemctl restart prometheus
                displayName: "Configurar Prometheus para coletar métricas"
        
              - script: |
                  sudo ufw allow ssh
                  sudo ufw allow http
                  sudo ufw allow https
                  sudo ufw deny 9090
                  sudo ufw deny 9100
                  sudo ufw enable
                displayName: "Configurar Acessos"
              
              - script: |
                  echo 'server {
                      listen 80;
                      server_name _;
        
                      location / {
                          proxy_pass http://127.0.0.1:9090/;
                          proxy_set_header Host $host;
                          proxy_set_header X-Real-IP $remote_addr;
                          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                          auth_basic "Restricted Access";
                          auth_basic_user_file /etc/nginx/.htpasswd;
                      }
        
                      location /metrics/ {
                          proxy_pass http://127.0.0.1:9100/;
                          proxy_set_header Host $host;
                          proxy_set_header X-Real-IP $remote_addr;
                          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                          auth_basic "Restricted Access";
                          auth_basic_user_file /etc/nginx/.htpasswd;
                      }
                  }' | sudo tee /etc/nginx/sites-available/default
        
                  sudo systemctl restart nginx
                displayName: "Configurar Nginx"
        
              - script: |
                  echo "Setting up Nginx authentication..."
                  
                  # Create .htpasswd file and add user
                  echo "senha123" | sudo htpasswd -c -i /etc/nginx/.htpasswd joaochiroli
        
                  sudo systemctl restart nginx
                displayName: "Configure Basic Auth for Nginx"
        ```
        
3. Test the configuration
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739892143761/bffd3091-b6b9-4801-b174-46cb6f87b390.png align="center")

4. See this Dashboard
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739892361850/f20a847a-47df-45e2-b1cd-ccf4980de892.png align="center")