diff --git a/docs/networking/gateway.md b/docs/networking/gateway.md index d0203c15..768df671 100644 --- a/docs/networking/gateway.md +++ b/docs/networking/gateway.md @@ -52,8 +52,6 @@ The gateway always terminates TLS. Which certificate it serves depends on what y `tls.certDir` together with `tls.acme.enable` fails an assertion — pick one. -⚠️ One vhost class has no TLS: a vhost bound to loopback for a local consumer. `grafana-metrics` (`nix/host-modules/swarm-grafana.nix`) is the one in the tree: it listens on `127.0.0.1` only and serves `= /metrics` from grafana's unix socket for this host's collector. The published `grafana.` vhost answers `/metrics` with 403. Everything with a routable name follows the table above. - ### ACME / Let's Encrypt (`tls.acme`) The simplest production path for a public domain: diff --git a/docs/swarm/services.md b/docs/swarm/services.md index 09c8f046..154ac7a3 100644 --- a/docs/swarm/services.md +++ b/docs/swarm/services.md @@ -180,6 +180,11 @@ collector's authelia client: authelia refuses any other session or client there. It refuses every other path, the store's write and admin API included, with 403. The bare domain redirects to vmui. +The collector scrapes Grafana's own metrics at +`https:///metrics`, so a collector on a host without +Grafana still gets them. The gateway admits only the collector's client to +that path; any other session gets `deny`. + The collector scrapes the store's own metrics the same way, at `https:///metrics`, so a collector on a host that doesn't run the store still gets them. On this name the gateway admits