vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

swarm-otel: request the bearer-authz scope on the metrics scrape

Browse source 
The collector's client is registered for authelia.bearer.authz, but the
prometheus scrape asked for no scopes, so every token came back carrying
none and authelia refused it at introspection with 'the requested scope
is invalid, unknown, or malformed'. Forgejo metrics were never scraped.

The rule was already stated one field below, for the audience: registered
is not requested. The two travel together, and a config read cannot see
the one that is missing -- every inspection of the rendered config came
back correct, because what was present was correct.
This commit is contained in:
atlas 2026-08-26 18:12:08 +02:00 • committed by mara
commit 4d7af143e3
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/host-modules/swarm-otel.nix
View file

@ -865,6 +865,19 @@ in
# secret, or it lands in the store world-readable.
client_secret_file = collectorSecretPath;
token_url = "${autheliaCfg.url}/api/oidc/token";
# The scope authelia's bearer-authz check looks for.
# The client is REGISTERED for it (the collector's
# entry sets `bearerAuthz`), but prometheus asks for
# no scopes unless told to, so the token came back
# carrying none and every scrape was refused at
# introspection with "the requested scope is
# invalid, unknown, or malformed".
#
# Which is the rule stated directly below for the
# other field, and it was written here before this
# line existed: the two travel together, and a
# config read cannot see the one that is MISSING.
scopes = [ "authelia.bearer.authz" ];
# The audience is the target's own url, and authelia
# checks it against the address being requested.
# Registered ≠ requested: a client that does not ASK