vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-victoriametrics: forward only the store's read API

Browse source 
The metrics vhost's `/` proxied every path to VictoriaMetrics with no
auth_request, so anything that could reach metrics.<swarm> could write
(`/api/v1/import`, `/api/v1/write`, ...) and delete
(`/api/v1/admin/tsdb/delete_series`) series. Only the OTLP push route
was gated.

`/` now answers 403. The read routes Grafana's Prometheus datasource
and vmui use are forwarded by exact or `^~` prefix location, each with
the matched path as its proxy_pass URI. The bare domain, which the
swarm UI's Metrics quick link opens, redirects to vmui instead of the
store's index page. The OTLP push location is unchanged.

Closes #5186
This commit is contained in:
atlas 2026-10-13 01:45:55 +02:00 • committed by mara
commit 53d0d59be0
3 changed files with 94 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/swarm/services.md
View file

@ -164,8 +164,12 @@ Grafana start — see [`secrets.md`](secrets.md).
**Where the data comes from.** The swarm's OTEL collector, below.
Neither container is reachable except through the gateway: both bind
loopback, and VictoriaMetrics' write endpoint takes no credential, so
the collector is the only intended writer.
loopback, and VictoriaMetrics authenticates nothing itself. The
`metrics.<swarm-domain>` vhost forwards only the store's read API (the
Prometheus query, series, label and metadata routes, plus the vmui web UI)
without a credential. It forwards the collector's OTLP push only with an
authelia token, and refuses every other path, the store's write and admin
API included, with 403. The bare domain redirects to vmui.
### Logs (VictoriaLogs)