Prometheus web.listen-address transition from 0.0.0.0 to restricted binding for API exposure

Prometheus binds its HTTP server to 0.0.0.0 by default in many releases, which exposes the query and admin APIs on every network interface. The --web.listen-address flag can restrict this to 127.0.0.1 or a specific IP, and newer versions support TLS and basic authentication via --web.tls-cert-file and --web.basic-auth-file. When moving from a standalone or development deployment to a production architecture fronted by a reverse proxy, the exact network boundary for the Prometheus process becomes an unresolved design decision.

The uncertainty centers on whether loopback binding is mandatory when a proxy terminates TLS and enforces authentication, or whether a private interface binding is acceptable for multi-host scraping. Older releases lack built-in authentication entirely, so the migration path from proxy-only security to native TLS and basic-auth introduces a compatibility boundary that is not always clearly documented. Teams must decide if the listen-address should change alongside the introduction of native security flags, or remain fixed to the loopback interface regardless of version.

Should --web.listen-address be restricted to 127.0.0.1 whenever a reverse proxy handles external traffic, or is a specific private IP sufficient to prevent accidental public exposure? Does the availability of built-in TLS and basic-auth flags alter the recommended binding strategy for supported versions compared to older releases that rely solely on a proxy? Are there documented version transitions where the default binding behavior changed in a way that affects existing deployments?