Guard the endpoint¶

A /metrics endpoint exposes internal counters; a pprof endpoint exposes heap and goroutine dumps. Neither may ever be an unauthenticated open port. There are two safe postures — pick one.

Option 1 — auth middleware¶

Pass your service's auth guard via WithMiddleware. It wraps the metrics endpoint (and pprof, if enabled). The parameter is the standard Go middleware signature, so go/transport's AuthMiddleware (or any func(http.Handler) http.Handler) works directly:

import transporthttp "gitlab.com/phpboyscout/go/transport/http"

metrics.Register(mux,
    metrics.WithMiddleware(transporthttp.AuthMiddleware(/* … */)),
)

Multiple middlewares apply in order — the first is the outermost (first to see the request):

metrics.WithMiddleware(recover, authenticate, ratelimit)

Option 2 — bind to loopback¶

For a single-user local tool, binding the server to 127.0.0.1 (or an internal address unreachable from outside) is a sufficient guard on its own:

_ = http.ListenAndServe("127.0.0.1:8080", mux)

or, with a standalone metrics server, rely on its loopback-by-default bind (server.New binds 127.0.0.1 unless you pass WithHost/WithBindAddress) so it is never externally reachable.

Why it warns "mounted without guard middleware"¶

If you call MountOn / Register with no WithMiddleware, the module logs a warning:

metrics endpoint mounted without guard middleware; ensure it is bound to loopback or fronted by auth

That is expected and correct for the loopback posture — it is a reminder, not an error. Supply WithLogger to route it through your logger. If you did intend middleware, the warning tells you it did not reach Register.

There is no option to suppress it. The module is handed a *http.ServeMux, which carries no bind address, so "was any middleware supplied" is the only signal it has — it cannot tell a loopback-bound service from an open port, and it cannot tell a real auth guard from a passthrough. Supplying middleware is what stops it.