ADR-0150: monitoring.moosequest.net is gated by an ALB Google OIDC action, not Cloudflare Access (proposed as a dedicated ALB; built as a host rule on the shared Woodpecker ALB)

Status: Accepted (accepted 2026-10-30; Decision 2 amended by operator decision 2026-09-03, see "As built") Date: 2026-08-31 Refs: docs/architecture/monitoring-public-ingress.md, #4547, #4568, [ADR-0149](https://internal-docs.raxx.app/architecture/adr/0149-session-agent-credential-model.html), ADR-0134

Context

Grafana on ci-monitoring is loopback-only today (SSM port-forward access only). We need a public hostname, monitoring.moosequest.net, with real authentication — not a bare login-form exposure (see FreeScout finding: open /login port bound to 0.0.0.0/0 was already flagged as a mistake class in this estate). Two existing precedents exist in the org for gating a hostname with SSO:

• vault.raxx.app → Cloudflare Access (Google Workspace SSO) — requires the hostname's DNS to be proxied through Cloudflare.
• ci.moosequest.net → AWS ALB authenticate-oidc action (Google Workspace) — used because moosequest.net is NOT on Cloudflare (Oracle Dyn zone, hand-typed records, confirmed live via dig +short moosequest.net NS → ns[1-4].dns.dyn.com).

monitoring.moosequest.net is under the Dyn-managed moosequest.net zone.

Decision

1. Auth gate: AWS ALB authenticate-oidc against Google Workspace, the ci.moosequest.net pattern — not Cloudflare Access. Cloudflare Access is architecturally unavailable here because the zone isn't proxied through Cloudflare; forcing it would require either moving moosequest.net to Cloudflare (a much larger, unscoped change affecting every record in that zone) or a Cloudflare-for-SaaS custom-hostname setup (added complexity with no precedent in this codebase). ALB OIDC is a known-good, already-running pattern.
2. A new, dedicated ALB (monitoring-grafana-alb), not a second hostname/cert on the existing ci-woodpecker-alb. Reasons: (a) blast-radius isolation — the WP ALB already carries a live OIDC-bypass listener-rule set tuned to Woodpecker's own auth quirks (/hook*, /api/badge*, /api/*, /authorize, /login, /logout) and an in-flight ASG-of-1 cutover; adding Grafana routing here risks entangling two unrelated availability domains; (b) Grafana needs zero bypass rules (no webhook/badge-equivalent unauthenticated path), so it doesn't benefit from sharing that rule set; (c) cost delta is ~$16/mo for a second ALB, which is cheap insurance against a shared-ALB regression touching CI login.
3. Grafana's own login stays enabled as a second, independent factor behind the OIDC gate — not because we distrust the ALB gate, but because "OIDC gate is the only defense" is exactly the single-point-of-failure shape this ADR is trying to avoid repeating from the FreeScout finding, just one layer removed.
4. The box-side change is minimal and isolated: Grafana's docker-compose port publish moves from 127.0.0.1:3000:3000 to 3000:3000, gated by a new, narrowly-scoped security-group rule (TCP 3000 from the new ALB's SG only). No other config on ci-monitoring changes as part of enabling ingress — scrape/alert config changes are sequenced into separate cards (see design doc §8).

Alternatives considered

• Cloudflare Access, migrating moosequest.net to Cloudflare DNS. Rejected for this card: moving an entire hand-typed Dyn zone to Cloudflare is a large, independently-risky change (every existing record needs review) — out of scope for "expose one Grafana instance," and not requested by the operator.
• Reuse ci-woodpecker-alb with a second ACM cert (SAN) + host-header listener rule. Technically simpler (one fewer ALB) but couples Grafana's public-ingress availability and any future WAF/rate-limit change to Woodpecker's ALB, which is mid-cutover (Option D, ASG-of-1) per infra/ci/alb.tf. Rejected on blast-radius grounds, consistent with this design's explicit goal of not repeating the CI incident's fragility.
• Grafana's own OAuth (Google) instead of an outer ALB gate. Grafana supports a native Google OAuth provider. Rejected as the sole gate because it reintroduces "app's own login form is the only defense," the exact FreeScout-class mistake; kept as a defense-in-depth inner layer instead, with the ALB as the outer gate.
• VPN / bastion instead of public ALB. No existing VPN infra in this estate; would be a much larger net-new investment for one dashboard. SSM port-forward already serves the "no public access needed" use case for anyone who doesn't need the public hostname; this ADR is specifically about the cases that do (mobile checks, sharing a link with a non-SSM-privileged stakeholder).

Consequences

• (Superseded, see "As built") New Terraform root infra/monitoring-ingress/ (ALB, TG, SGs, ACM cert, OIDC SSM reads) — separate state from both terraform/ci-monitoring/ and infra/ci/, so a plan/apply here cannot accidentally touch either existing stack.
• (Path superseded, see "As built") New SSM secrets under /ci/monitoring/oidc/ (client_id, client_secret) — can reuse the existing Google Workspace OAuth app used for ci.moosequest.net if its redirect-URI allowlist can add https://monitoring.moosequest.net/oauth2/idpresponse, or a new OAuth client if that's cleaner for revocation-blast-radius reasons — left to the implementing developer, flagged as an implementation-sized decision in the sub-card, not an architectural one.
• One SG rule added to the existing ci-monitoring-sg (additive, single port, single source SG) and one docker-compose line changed on the shared box — the only shared-box touch in this whole design.
• A manual, unautomatable Dyn DNS step is now the sole cutover point — matches the existing ci.moosequest.net operational reality; no new class of manual-step risk introduced, but see design doc §5 / card #4547 for the pre-existing gap this doesn't solve (no existence monitor for hand-typed Dyn records).
• Sizing risk (flagged by TradeMasterAPI review, 2026-08-31): ci-monitoring is a single t4g.small, already flagged for memory pressure (#4500/#4435) and also hosting the CI build caches (devpi/registry mirror). Card B's change makes Grafana reachable via the ALB in addition to SSM port-forward, so this box now carries CI-cache traffic + all monitoring services + public-ish dashboard traffic on one small instance. Not blocking this design, but a resize (or splitting Grafana onto its own instance) should be revisited if dashboard usage or cache load grows — treat sustained memory pressure after this ships as the trigger, not a fixed timeline.

Language/runtime choice rationale

N/A — no new service/process is introduced. Grafana, Prometheus, Alertmanager, and blackbox-exporter are unchanged; this ADR only adds an ALB (managed AWS resource, no runtime to choose) in front of the existing stack.

As built (verified against develop, 2026-10-30 UTC)

Status moved from Proposed to Accepted on 2026-10-30 because the decision it records (gate the hostname with an ALB authenticate-oidc action against Google Workspace) is implemented in infra/ci/monitoring-ingress.tf (Card A, #4570). Implementation departed from the text above in several places; this section is authoritative.

Related cards: Card C (#4572, blackbox probes for console, tickets and vault) and Card D (#4573, the product-status-overview dashboard) are in the ci-monitoring cloud-init template. Cards E (#4574, Grafana role mapping) and F (#4575, ALB access logs and WAF) are open and waiting on operator decisions. The parent epic is #4568. Whether the Card A Terraform has been applied is not visible from the repo.

The "Consequences" bullets about a new Terraform root and the /ci/monitoring/oidc/ SSM path above describe the original proposal and are superseded by this table.