mirror of
https://github.com/clusterio/clusterio.git
synced 2026-11-12 07:04:52 +09:00
bbassieandClaude Fable 5.1
87aa7b3b4c
The metrics endpoint fans out a gather to every connected host, so anyone who could reach the controller could read cluster statistics and put load on all hosts at will. Scraping now needs a user token holding the new core.controller.metrics permission. The token is accepted via Authorization: Bearer as well as X-Access-Token because Prometheus can only send the former. Concurrent scrapes share one gather so hosts see at most one metrics request at a time. The three connection gauges in controller.ts now no-op before the controller exists, like the other gauges there, so the endpoint can be tested against the mock controller. Closes #1009 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>