What does --web.listen-address=0.0.0.0:9090 do, and is it a sensible setting?

Question

Accepted Answer

Prometheus listens on port 9090 on all network interfaces, so anyone who can reach the host can open the web UI and API. That's fine in an isolated lab but risky in production, because there is no authentication by default.

* 0.0.0.0 opens every interface; 127.0.0.1 keeps it local. *
0.0.0.0 means "every IPv4 address of this machine": loopback, LAN, any other interface. The alternative 127.0.0.1:9090 would accept only local connections.
Why it is a judgement call:

For: Grafana or other Prometheus servers on other hosts need to reach the API, and admins want the UI in their browser.
Against: out of the box the UI and API have no login and no TLS. Anyone on the network can read every metric (host names, versions, internal topology), which is useful reconnaissance for an attacker.

Sensible production options: restrict access with a firewall to the hosts that need it, bind to localhost behind a reverse proxy that adds TLS and authentication, or configure Prometheus's own TLS and basic-auth via --web.config.file. Any active firewall must allow 9090/tcp.
Go deeper:

Prometheus — Security model — what the project assumes about network access and authentication.
 Prometheus guide — Securing the API and UI with basic auth — the --web.config.file setup.
 0.0.0.0 — Wikipedia — what the all-zeros address means when a server binds to it.