From 8775c3841ac10779b03ffa118b3221b3a124bb31 Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Sat, 21 Feb 2026 12:37:59 -0800
Subject: [PATCH] Allow anonymous access to zot /metrics endpoint

Add accessControl.metrics.users with empty string to allow
unauthenticated Prometheus/Alloy scraping. Zot represents
anonymous users with an empty username internally.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 ansible/roles/zot/templates/config.json.j2 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ansible/roles/zot/templates/config.json.j2 b/ansible/roles/zot/templates/config.json.j2
index 1090554..25d1bb0 100644
--- a/ansible/roles/zot/templates/config.json.j2
+++ b/ansible/roles/zot/templates/config.json.j2
@@ -26,6 +26,9 @@
       "apikey": true
     },
     "accessControl": {
+      "metrics": {
+        "users": [""]
+      },
       "repositories": {
         "**": {
           "policies": [