add option to hide /debug/ pages

CHANGELOG.md

@@ -11,6 +11,7 @@
 - [#8574](https://github.com/influxdata/influxdb/pull/8574): Add 'X-Influxdb-Build' to http response headers so users can identify if a response is from an OSS or Enterprise service.
 - [#8426](https://github.com/influxdata/influxdb/issues/8426): Add `parse-multivalue-plugin` to allow users to choose how multivalue plugins should be handled by the collectd service.
 - [#8548](https://github.com/influxdata/influxdb/issues/8548): Allow panic recovery to be disabled when investigating server issues.
+- [#5305](https://github.com/influxdata/influxdb/issues/5305): Add configuration option to disable the `/debug/vars` HTTP API endpoint
 
 ### Bugfixes
 

etc/config.sample.toml

@@ -219,6 +219,10 @@
   # troubleshooting and monitoring.
   # pprof-enabled = true
 
+  # Determines whether the debug endpoint is enabled.  This endpoint is used for
+  # gathering runtime statistics.
+  # pprof-enabled = true
+
   # Determines whether HTTPS is enabled.
   # https-enabled = false
 

services/httpd/config.go

@@ -24,6 +24,7 @@ type Config struct {
 	LogEnabled         bool   `toml:"log-enabled"`
 	WriteTracing       bool   `toml:"write-tracing"`
 	PprofEnabled       bool   `toml:"pprof-enabled"`
+	DebugEnabled       bool   `toml:"debug-enabled"`
 	HTTPSEnabled       bool   `toml:"https-enabled"`
 	HTTPSCertificate   string `toml:"https-certificate"`
 	HTTPSPrivateKey    string `toml:"https-private-key"`

services/httpd/config_test.go

@@ -16,6 +16,7 @@ bind-address = ":8080"
 auth-enabled = true
 log-enabled = true
 write-tracing = true
+debug-enabled = true
 https-enabled = true
 https-certificate = "/dev/null"
 unix-socket-enabled = true
@@ -34,6 +35,8 @@ max-body-size = 100
 		t.Fatalf("unexpected auth enabled: %v", c.AuthEnabled)
 	} else if c.LogEnabled != true {
 		t.Fatalf("unexpected log enabled: %v", c.LogEnabled)
+	} else if c.DebugEnabled != true {
+		t.Fatalf("unexpected debug enabled: %v", c.DebugEnabled)
 	} else if c.WriteTracing != true {
 		t.Fatalf("unexpected write tracing: %v", c.WriteTracing)
 	} else if c.HTTPSEnabled != true {

services/httpd/handler.go

@@ -256,9 +256,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	if strings.HasPrefix(r.URL.Path, "/debug/pprof") && h.Config.PprofEnabled {
 		h.handleProfiles(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/debug/vars") {
+	} else if strings.HasPrefix(r.URL.Path, "/debug/vars") && h.Config.DebugEnabled {
 		h.serveExpvar(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/debug/requests") {
+	} else if strings.HasPrefix(r.URL.Path, "/debug/requests") && h.Config.DebugEnabled {
 		h.serveDebugRequests(w, r)
 	} else {
 		h.mux.ServeHTTP(w, r)