Protect monitoring PF API with internal key

internal/pf/http.go

@@ -29,6 +29,8 @@ func (s Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusOK, map[string]string{"service": "monitoring-pf", "ui": "portal", "api": "go"})
 	case !strings.HasPrefix(path, "/api/v1"):
 		writeError(w, http.StatusNotFound, "not found")
+	case !s.checkInternalAuth(w, r):
+		return
 	case path == "/api/v1/access/me" && r.Method == http.MethodGet:
 		s.accessMe(w, r)
 	case path == "/api/v1/summary" && r.Method == http.MethodGet:
@@ -50,6 +52,18 @@ func (s Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func (s Server) checkInternalAuth(w http.ResponseWriter, r *http.Request) bool {
+	want := strings.TrimSpace(s.App.Cfg.InternalAPIKey)
+	if want == "" {
+		return true
+	}
+	if r.Header.Get("X-Internal-Key") != want {
+		writeError(w, http.StatusUnauthorized, "unauthorized")
+		return false
+	}
+	return true
+}
+
 func (s Server) apiPath(path string) string {
 	base := s.App.Cfg.PublicBasePath
 	if base != "" && path == base {