Hmm, that is indeed correct, the query service updater needs read access.

A vaguely hacky way to fix this would be to wrap the line that you have setting wgGroupPermissions in some condition, such as a condition making sure that the location of the request is internal / came from the updater IP address. You could increase the security of this by also providing some static token in a header to be communicated between the 2 services, but that might require altering the wdqs itself or putting a proxy in between (which would defeat the point)

As for the updater logging in when retrieving updates, that could be possible, but would require alteration of the wdqs code and more complexity than the above which might work for you.

Tagged the query service as this is a usecase for third party wikis that may want a little bit of thought.

I would like to give this issue a bump. I have a WIkibase instance that runs within a government network where I need to restrict read access to all anonymous users. I wanted to whitelist the main page as an introduction page for non-members.

Has this issue been discussed further since 2019?

Regards,

Maarten Zeinstra