/metrics is a PublicPage guarded by openmetrics_allowed_clients. For a Prometheus scraping locally that works well, and the loopback default is a good one.
I maintain an open-source monitoring dashboard for Nextcloud instances, where a single collector reads from many servers across networks. In that setup the allowlist ends up being the only credential, and it behaves ifferently from one: if the collector's egress address is ever released and reallocated, whoever receives it inherits read access on every instance that listed it. There is also no way to revoke access for a single instance, and on a server behind a proxy with trusted_proxies unset the observed address is the proxy's, so allowlisting it would let anything arriving through that proxy read the endpoint.
Would an optional bearer token be considered, in addition to the allowlist rather than instead of it? serverinfo authenticates comparable data that way, so the pattern already exists in the project.
/metricsis aPublicPageguarded byopenmetrics_allowed_clients. For a Prometheus scraping locally that works well, and the loopback default is a good one.I maintain an open-source monitoring dashboard for Nextcloud instances, where a single collector reads from many servers across networks. In that setup the allowlist ends up being the only credential, and it behaves ifferently from one: if the collector's egress address is ever released and reallocated, whoever receives it inherits read access on every instance that listed it. There is also no way to revoke access for a single instance, and on a server behind a proxy with
trusted_proxiesunset the observed address is the proxy's, so allowlisting it would let anything arriving through that proxy read the endpoint.Would an optional bearer token be considered, in addition to the allowlist rather than instead of it? serverinfo authenticates comparable data that way, so the pattern already exists in the project.