Fix broken main: define Config.public_only, and add a reviewed path to public serving

[tschm]

main is currently broken

github.py filters the repo listing on cfg.public_only, but the field was never added to Config. Every GitHub refresh raises:

File "/app/jq_collector/github.py", line 306, in <genexpr>
    or (cfg.public_only and ...)
AttributeError: 'Config' object has no attribute 'public_only'

This fails quietly. The local refresh loop is unaffected, so the collector keeps serving /metrics and the Prometheus target stays up — it just loses every CI, drift, pull-request and issue series, and the board shows No data on roughly two thirds of its panels. Confirmed by checking out main into a temp dir and instantiating Config.

First commit is the four-line fix, isolated so it can be reviewed or reverted on its own.

Second commit: serving the board world-readable

Restricting collection to public repos is not sufficient on its own, which is the part worth reviewing.

With anonymous access enabled, a visitor can POST arbitrary PromQL to /api/ds/query and read the raw label index via /api/datasources/proxy. Purged names linger in that index until head compaction — measured here, after deleting all seven private repos the index still returned every one of their names, and a Prometheus restart did not clear them. Deleting the data does not remove the names.

So this adds both halves:

• docker-compose.public.yml — anonymous off, Grafana public dashboards on. A public link serves only that dashboard's own queries with no datasource behind it. Verified: public link and its panel queries 200; /api/search, /api/ds/query and the proxy all 401.
• scripts/check-public-safe.sh — the preflight. Verifies each exported repo is public on GitHub rather than trusting our own visibility label, that anonymous queries and the proxy are refused, that Prometheus and the collector stay loopback-only, and that no public link is live while JQ_PUBLIC_ONLY is off. Exits non-zero otherwise.
• scripts/make-public-dashboard.py — public dashboards don't resolve template variables, so every panel filtered on $repo renders No data behind a public link. This generates fleet-public.json from fleet.json with the variable and its selectors stripped.
• check-dashboard.py now validates every dashboard in the folder, so the generated copy can't drift unnoticed.

Verification

No CI exists in this repo, so this was checked by hand from a clean git archive of the branch:

Check	Result
Fix commit alone resolves the crash	Config.public_only = True
Full branch, real collection against GitHub	23 repos, 1018 samples, no private repo leaked
fleet-public.json regenerates from source	byte-identical
Preflight refuses an unsafe config	fails on anonymous mode, passes on the overlay

Default behaviour is unchanged: JQ_PUBLIC_ONLY defaults to false and the overlay is opt-in.

🤖 Generated with Claude Code