balena-metrics-guard-base abstract the protection of :80/metrics via secret token into a thin layer on top of the service base image, using haproxy (implementers should have their exporter set to listen on :9099, the backend to which haproxy forwards if auth is valid)