OpenMetrics: optional token authentication alongside the IP allowlist

/metrics is a PublicPage guarded by openmetrics_allowed_clients. For a Prometheus scraping locally that works well, and the loopback default is a good one.

I maintain an open-source monitoring dashboard for Nextcloud instances, where a single collector reads from many servers across networks. In that setup the allowlist ends up being the only credential, and it behaves ifferently from one: if the collector's egress address is ever released and reallocated, whoever receives it inherits read access on every instance that listed it. There is also no way to revoke access for a single instance, and on a server behind a proxy with trusted_proxies unset the observed address is the proxy's, so allowlisting it would let anything arriving through that proxy read the endpoint.

Would an optional bearer token be considered, in addition to the allowlist rather than instead of it? serverinfo authenticates comparable data that way, so the pattern already exists in the project.

Start with the /metrics endpoint, its PublicPage guard, and the openmetrics_allowed_clients setting. Compare that authentication pattern with serverinfo, which the issue identifies as handling comparable data with a token. Done means an optional bearer token can work alongside the allowlist, with the intended access and revocation behavior covered.