GitLab components report metrics via Prometheus, and sometimes start a pprof listener to aid live profiling. Either of these may be open and listening when running GitLab in production, as they are on GitLab.com * [gitlab-workhorse](workhorse/main.go#L84) * [gitlab-rails](config/initializers/7_prometheus_metrics.rb) * [gitlab-sshd](https://gitlab.com/gitlab-org/gitlab-shell/-/blob/main/cmd/gitlab-sshd/main.go#L60) * [gitlab-pages](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/master/main.go#L161) Currently, none of these endpoints are capable of being TLS-secured. In a FIPS-compliant setup, I think we *must* TLS-secure them all. This implies taking a key+cert in addition to the listen address. ~~We also need to get https://github.com/prometheus/common/pull/283 merged, as prometheus uses MD5 internally for one thing.~~ See https://gitlab.com/groups/gitlab-org/-/epics/7479#note_843747473