From a8e49ee0c7ef6728f53086fd868ea2b5ac8b13b7 Mon Sep 17 00:00:00 2001
From: Markus Opolka <7090372+martialblog@users.noreply.github.com>
Date: Thu, 12 Mar 2026 14:17:47 +0100
Subject: [PATCH] Add option to set password via env variable

---
 README.md           | 8 ++++++++
 icinga2_exporter.go | 6 ++++++
 2 files changed, 14 insertions(+)

diff --git a/README.md b/README.md
index 25feba3..acaef16 100644
--- a/README.md
+++ b/README.md
@@ -50,6 +50,14 @@ See the `-help` output for more options.
       Path under which to expose metrics. (default "/metrics")
 ```
 
+### Environment Variables
+
+Some values can be set via environment variables:
+
+| Name     | Description |
+| -------- | ----------- |
+| ICINGA2_EXPORTER_HTTP_PASSWORD   | Password to use for basic auth |
+
 ### Cache
 
 The exporter caches the responses from the Icinga2 API to decrease load on the API.
diff --git a/icinga2_exporter.go b/icinga2_exporter.go
index 96dcf6b..185028b 100644
--- a/icinga2_exporter.go
+++ b/icinga2_exporter.go
@@ -111,6 +111,12 @@ func main() {
 		Level: logLevel,
 	}))
 
+	if cliPassword == "" {
+		if v, ok := os.LookupEnv("ICINGA2_EXPORTER_HTTP_PASSWORD"); ok {
+			cliPassword = v
+		}
+	}
+
 	// In general, listen to gosec. But it this case, I don't think someone
 	// is going to overflow the uint TTL for the cache lifetime.
 	// nolint:gosec