From 78d30026cef478970ab1cc2c9e68b6b73aee60ea Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Thu, 24 Sep 2026 01:56:05 -0700
Subject: [PATCH] orion: allowlist vmui's /prometheus API prefix

Default Server URL is /prometheus; keep import/admin 403.
---
 hw/orion/metrics.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/orion/metrics.nix b/hw/orion/metrics.nix
index 0338e01..3abca37 100644
--- a/hw/orion/metrics.nix
+++ b/hw/orion/metrics.nix
@@ -296,6 +296,14 @@ in
         "~ ^/api/v1/label/[^/]+/values$" = vmuiProxy;
         "= /api/v1/metadata" = vmuiProxy;
         "/api/v1/status" = vmuiProxy;
+        "= /prometheus/api/v1/query" = vmuiProxy;
+        "= /prometheus/api/v1/query_range" = vmuiProxy;
+        "= /prometheus/api/v1/series" = vmuiProxy;
+        "= /prometheus/api/v1/labels" = vmuiProxy;
+        "= /prometheus/api/v1/metadata" = vmuiProxy;
+        "~ ^/prometheus/api/v1/label/[^/]+/values$" = vmuiProxy;
+        "/prometheus/api/v1/status" = vmuiProxy;
+        "/prometheus/vmui" = vmuiProxy;
       };
     };
   };