Question:

Hi everyone,

I’m fairly new to using Azure Application Gateway and need some assistance with a setup involving Prometheus, Grafana, and Loki on a single Azure VM. I want to expose these services securely over HTTPS through distinct subdomains (e.g., prometheus.example.com, grafana.example.com, loki.example.com) and manage DNS with AWS Route 53.

My Setup:

1. Azure VM: Hosting Prometheus, Grafana, and Loki.

2. Azure Application Gateway: To route traffic based on subdomains.

3. HTTPS: Enforce HTTPS only for all services.

4. DNS: Managed by AWS Route 53.

Objectives:

• Prometheus: Accessible via https://prometheus.example.com on port 9090.

• Grafana: Accessible via https://grafana.example.com on port 3000.

• Loki: Accessible via https://loki.example.com on port 3100.

• Scalability: Plan to add more applications using the same Azure Application Gateway.

Current Progress:

1. VM Setup: Created an Azure VM and installed Prometheus, Grafana, and Loki.

2. Networking: Configured Azure VNet and NSG to manage network traffic.

3. Application Gateway: Set up with listeners and backend pools.

4. DNS: Managed via AWS Route 53 to point subdomains to the Application Gateway’s public IP.

Challenges I’m Facing:

1. Routing Traffic: Need guidance on configuring Azure Application Gateway to correctly route traffic to Prometheus, Grafana, and Loki based on subdomains.

2. HTTPS Enforcement: How to ensure HTTP requests are redirected to HTTPS for all subdomains.

3. Health Probes: Best practices for setting up health probes for these services.

4. SSL Certificate Management: Does Azure have a certificate manager like AWS Certificate Manager? How can I manage SSL certificates in Azure, without manually created certificates or using Let’s Encrypt?

Here’s my current configuration:

• Application Gateway Listeners:

  • Listener for prometheus.example.com on port 443

  • Listener for grafana.example.com on port 443

  • Listener for loki.example.com on port 443

• Backend Pools:

  • VM with Prometheus, Grafana, and Loki installed

• HTTP Settings:

  • Prometheus: http://<VM private IP>:9090

  • Grafana: http://<VM private IP>:3000

  • Loki: http://<VM private IP>:3100

• DNS Records in AWS Route 53:

  • A records pointing subdomains to the Azure Application Gateway’s public IP.

Specific Questions:

1. Routing Configuration: How do I configure Azure Application Gateway to route traffic correctly to Prometheus, Grafana, and Loki based on subdomains?

2. Health Probes: What are the best practices for setting up health probes for these services?

3. HTTPS Redirection: How can I ensure that HTTP requests are redirected to HTTPS for all subdomains?

4. SSL Certificate Management: Does Azure have a built-in certificate manager similar to AWS Certificate Manager? If so, how can I use it to manage my SSL certificates? Alternatively, how can I manage SSL certificates without manually created certificates or using Let’s Encrypt?

Additional Context:

I’m excited about leveraging Azure Application Gateway for this setup, as it will allow me to add more applications easily in the future. Any guidance, step-by-step instructions, or examples would be greatly appreciated!

Thank you in advance for your help!