From d0a5007a35d11ebbeeca953b2e622fa0829ef38a Mon Sep 17 00:00:00 2001
From: Artem Sheremet <dot.doom@gmail.com>
Date: Sat, 10 Oct 2026 07:31:37 +0000
Subject: [PATCH] Secure by default for prometheus_client

---
 modules/telegraf.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/telegraf.nix b/modules/telegraf.nix
index bc6f59e..32d55b8 100644
--- a/modules/telegraf.nix
+++ b/modules/telegraf.nix
@@ -15,7 +15,8 @@
       };
       outputs = {
         prometheus_client = {
-          listen = ":9273";
+          # Do not set port here, as some host may prefer to hide it behind a
+          # reverse proxy. Secure by default.
           metric_version = 2;
           # Maintain persistent HTTP keep-alive connections across Prometheus scrapes (e.g. 15s intervals).
           # Default is 10s which forces premature TCP teardown and frequent reconnects.