From 4d7af143e3961f1c535c0a54389db09db4cb497b Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 26 Aug 2026 18:12:08 +0200 Subject: [PATCH] swarm-otel: request the bearer-authz scope on the metrics scrape The collector's client is registered for authelia.bearer.authz, but the prometheus scrape asked for no scopes, so every token came back carrying none and authelia refused it at introspection with 'the requested scope is invalid, unknown, or malformed'. Forgejo metrics were never scraped. The rule was already stated one field below, for the audience: registered is not requested. The two travel together, and a config read cannot see the one that is missing -- every inspection of the rendered config came back correct, because what was present was correct. --- nix/host-modules/swarm-otel.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix index 60a8faa3..4408ab49 100644 --- a/nix/host-modules/swarm-otel.nix +++ b/nix/host-modules/swarm-otel.nix @@ -865,6 +865,19 @@ in # secret, or it lands in the store world-readable. client_secret_file = collectorSecretPath; token_url = "${autheliaCfg.url}/api/oidc/token"; + # The scope authelia's bearer-authz check looks for. + # The client is REGISTERED for it (the collector's + # entry sets `bearerAuthz`), but prometheus asks for + # no scopes unless told to, so the token came back + # carrying none and every scrape was refused at + # introspection with "the requested scope is + # invalid, unknown, or malformed". + # + # Which is the rule stated directly below for the + # other field, and it was written here before this + # line existed: the two travel together, and a + # config read cannot see the one that is MISSING. + scopes = [ "authelia.bearer.authz" ]; # The audience is the target's own url, and authelia # checks it against the address being requested. # Registered ≠ requested: a client that does not ASK