From 56111e9219361323d543ebaee6cae6a38f132391 Mon Sep 17 00:00:00 2001
From: tiennm99 <tiennm99@outlook.com>
Date: Tue, 6 Oct 2026 16:45:13 +0700
Subject: [PATCH] fix(alloy): pass the Grafana token as GCLOUD_RW_API_KEY

Fleet Management's self-monitoring pipelines read the token from that name;
without it their remote-write fails with 401 invalid token.
---
 alloy/README.md   | 6 ++++++
 alloy/compose.yml | 1 +
 2 files changed, 7 insertions(+)

diff --git a/alloy/README.md b/alloy/README.md
index 20f501b..51e45a7 100644
--- a/alloy/README.md
+++ b/alloy/README.md
@@ -43,6 +43,12 @@ All nine are required; `docker compose up` fails fast if any is unset.
 | `LOKI_URL` / `LOKI_USER` | Loki push endpoint and user id |
 | `GRAFANA_TOKEN` | One Cloud Access Policy token, scopes `metrics:write` + `logs:write` + `fleet-management:read` |
 
+`GRAFANA_TOKEN` is also passed into the container as `GCLOUD_RW_API_KEY`.
+Fleet Management's auto-generated `self_monitoring_*` pipelines read the token
+from that fixed name; without it their remote-write gets an empty password and
+Grafana Cloud answers `401 invalid token`, so the collector shows no health
+data in Fleet Management.
+
 Find the values under Grafana Cloud → your stack → **Details** on each data
 source, and under Fleet Management. The same token serves `remotecfg`,
 Prometheus and Loki basic-auth.
diff --git a/alloy/compose.yml b/alloy/compose.yml
index 55347c4..84345c8 100644
--- a/alloy/compose.yml
+++ b/alloy/compose.yml
@@ -22,6 +22,7 @@ services:
       LOKI_URL: ${LOKI_URL:?required}
       LOKI_USER: ${LOKI_USER:?required}
       GRAFANA_TOKEN: ${GRAFANA_TOKEN:?required}
+      GCLOUD_RW_API_KEY: ${GRAFANA_TOKEN:?required}
     volumes:
       - alloy-data:/var/lib/alloy/data
       - /proc:/rootproc:ro