From e6e9c894d605c24ea8d15ee83bdd8f410ffb9b54 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 14 Oct 2026 20:21:31 +0200 Subject: [PATCH] docs: the swarm queue publishes its /metrics to the collector --- docs/swarm/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/swarm/README.md b/docs/swarm/README.md index eb61c462..be229c74 100644 --- a/docs/swarm/README.md +++ b/docs/swarm/README.md @@ -132,6 +132,14 @@ reader `deploy.bao.clientCertFile`: issue a leaf whose subject is do, `swarm-bao-nats-tls` fails naming both whenever the queue's certificate is missing or due for renewal. +The queue host's gateway also serves the queue's metrics, at +`https:///metrics`, so a swarm collector on any host +scrapes them. Only the collector's authelia client gets through; any other +session gets `deny`, and every other path on that name is 403. With the +gateway's default self-signed TLS, that vhost serves the queue's own +certificate, so a host whose only swarm service is the queue needs no +swarm-services certificate. + The identity isn't a choice — a hive authenticates as `hive-` and publishes under `hiveName`, the same name that keys `swarm.hives`.