From aa6a37d59168a890b8b27aaa0d1fd97ba37187ec Mon Sep 17 00:00:00 2001
From: Carlos Bermudez Porto <cbermudez.dev@gmail.com>
Date: Thu, 27 Nov 2025 13:40:37 -0300
Subject: [PATCH] internal/debug: add basic authentication support for
 pyroscope profiler

---
 internal/debug/api.go   | 12 ++++++++----
 internal/debug/flags.go | 23 ++++++++++++++++++++++-
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/internal/debug/api.go b/internal/debug/api.go
index af02d6f03e..2a3dd5e7ce 100644
--- a/internal/debug/api.go
+++ b/internal/debug/api.go
@@ -150,6 +150,8 @@ func (l *pyroscopeLogger) Errorf(format string, v ...interface{}) {
 // StartPyroscopeProfiler starts the Pyroscope profiler for later use
 func (h *HandlerT) StartPyroscopeProfiler(
 	server string,
+	authUsername string,
+	authPassword string,
 	tags map[string]string,
 ) error {
 	h.mu.Lock()
@@ -160,10 +162,12 @@ func (h *HandlerT) StartPyroscopeProfiler(
 	}
 	profiler, err := pyroscope.Start(
 		pyroscope.Config{
-			ApplicationName: "geth",
-			ServerAddress:   server,
-			Logger:          &pyroscopeLogger{Logger: log.Root().With("module", "pyroscope")},
-			Tags:            tags,
+			ApplicationName:   "geth",
+			ServerAddress:     server,
+			BasicAuthUser:     authUsername,
+			BasicAuthPassword: authPassword,
+			Logger:            &pyroscopeLogger{Logger: log.Root().With("module", "pyroscope")},
+			Tags:              tags,
 			ProfileTypes: []pyroscope.ProfileType{
 				// Enabling all profile types
 				pyroscope.ProfileCPU,
diff --git a/internal/debug/flags.go b/internal/debug/flags.go
index 40b000cbd3..75c3a34f6d 100644
--- a/internal/debug/flags.go
+++ b/internal/debug/flags.go
@@ -153,6 +153,18 @@ var (
 		Value:    "http://localhost:4040",
 		Category: flags.LoggingCategory,
 	}
+	pyroscopeAuthUsernameFlag = &cli.StringFlag{
+		Name:     "pyroscope.username",
+		Usage:    "Pyroscope basic authentication username",
+		Value:    "",
+		Category: flags.LoggingCategory,
+	}
+	pyroscopeAuthPasswordFlag = &cli.StringFlag{
+		Name:     "pyroscope.password",
+		Usage:    "Pyroscope basic authentication password",
+		Value:    "",
+		Category: flags.LoggingCategory,
+	}
 	pyroscopeTagsFlag = &cli.StringFlag{
 		Name:     "pyroscope.tags",
 		Usage:    "Comma separated list of key=value tags to add to profiling data",
@@ -183,6 +195,8 @@ var Flags = []cli.Flag{
 	traceFlag,
 	pyroscopeFlag,
 	pyroscopeServerFlag,
+	pyroscopeAuthUsernameFlag,
+	pyroscopeAuthPasswordFlag,
 	pyroscopeTagsFlag,
 }
 
@@ -324,6 +338,8 @@ func Setup(ctx *cli.Context) error {
 	// Pyroscope profiling
 	if ctx.Bool(pyroscopeFlag.Name) {
 		pyroscopeServer := ctx.String(pyroscopeServerFlag.Name)
+		pyroscopeAuthUsername := ctx.String(pyroscopeAuthUsernameFlag.Name)
+		pyroscopeAuthPassword := ctx.String(pyroscopeAuthPasswordFlag.Name)
 
 		rawTags := ctx.String(pyroscopeTagsFlag.Name)
 		tags := make(map[string]string)
@@ -335,7 +351,12 @@ func Setup(ctx *cli.Context) error {
 			}
 		}
 
-		Handler.StartPyroscopeProfiler(pyroscopeServer, tags)
+		Handler.StartPyroscopeProfiler(
+			pyroscopeServer,
+			pyroscopeAuthUsername,
+			pyroscopeAuthPassword,
+			tags,
+		)
 	}
 
 	if len(logFile) > 0 || rotation {