From 37c58e79dc36904b5f1fc0915e1afd63e83efaba Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 13 Oct 2026 08:27:41 +0200 Subject: [PATCH] module-eval: the collector's metrics push path must be the vhost's gated push route The metrics vhost is default-deny; ingest works only because the collector's metrics_endpoint path equals the vhost's gated exact location. The literals live in separate modules, so renaming either broke ingest with CI green. Assert the endpoint path is a location on the metrics vhost carrying auth_request, in the existing core-toggle fixture. Refs #5186 --- nix/module-eval/core-toggle.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix index 522e4629..1a030fac 100644 --- a/nix/module-eval/core-toggle.nix +++ b/nix/module-eval/core-toggle.nix @@ -26,6 +26,7 @@ let bridgePorts bridgePortsOrNone swarmServiceEnables + otelSettings ; inherit (shared) allLocal; @@ -399,6 +400,21 @@ let && lib.hasInfix "auth_request" m.extraConfig && lib.hasInfix "auth_request" l.extraConfig; } + { + # The metrics vhost is default-deny; the collector's push only lands + # because its `metrics_endpoint` path is the vhost's one gated exact + # location. The two literals live in different modules, so renaming + # either alone breaks ingest while everything still evaluates. + name = "the collector's metrics push path is a gated location on the metrics vhost"; + ok = + let + endpoint = (otelSettings allLocal).exporters."otlphttp/victoriametrics".metrics_endpoint; + # "https://host/path" -> "/path" + path = "/" + lib.concatStringsSep "/" (lib.drop 3 (lib.splitString "/" endpoint)); + loc = allLocal.services.nginx.virtualHosts."metrics.t.local".locations."= ${path}" or null; + in + loc != null && lib.hasInfix "auth_request" loc.extraConfig; + } { # The arm that actually protects something. A pusher handed # `error_page 401 =302` FOLLOWS it and POSTs its batch at a login page,