v0.34.2

src/prometheus/json.rs

@@ -0,0 +1,758 @@
+// Pull-friendly JSON telemetry: a compact chart snapshot plus every numeric
+// sample that the Prometheus text exporter currently emits. Both formats use
+// the same collector switches and security boundaries.
+use super::App;
+use axum::response::{IntoResponse, Response};
+use serde::Serialize;
+use serde_json::{json, Value};
+use std::{
+    collections::BTreeMap,
+    sync::atomic::Ordering,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+#[derive(Default, Serialize)]
+struct MetricSamples {
+    // Metadata is stored separately because histogram/summary samples have
+    // suffixes (_bucket/_sum/_count) that share one Prometheus TYPE family.
+    types: BTreeMap<String, String>,
+    samples: BTreeMap<String, Vec<Sample>>,
+}
+
+#[derive(Serialize)]
+struct Sample {
+    labels: BTreeMap<String, String>,
+    value: Value,
+}
+
+// Read only our own Prometheus exposition, never an untrusted remote payload.
+// Preserve large u64 counters exactly; JSON cannot represent NaN or infinity,
+// so these values become null rather than breaking the whole API response.
+fn sample_value(raw: &str) -> Value {
+    if let Ok(value) = raw.parse::<u64>() {
+        return json!(value);
+    }
+    if let Ok(value) = raw.parse::<i64>() {
+        return json!(value);
+    }
+    raw.parse::<f64>()
+        .ok()
+        .filter(|v| v.is_finite())
+        .map_or(Value::Null, |value| json!(value))
+}
+
+// Prometheus label escaping: \\, \", \n. Scan the quoted value rather than
+// splitting on commas (a configured label may contain commas or quotes).
+fn parse_labels(raw: &str) -> Option<BTreeMap<String, String>> {
+    let bytes = raw.as_bytes();
+    let mut pos = 0;
+    let mut labels = BTreeMap::new();
+    if raw.is_empty() {
+        return Some(labels);
+    }
+    while pos < bytes.len() {
+        let equal = raw[pos..].find("=\"")? + pos;
+        let key = &raw[pos..equal];
+        if key.is_empty() || !key.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_') {
+            return None;
+        }
+        pos = equal + 2;
+        let mut start = pos;
+        let mut value = String::new();
+        let mut closed = false;
+        while pos < bytes.len() {
+            match bytes[pos] {
+                b'\\' => {
+                    value.push_str(&raw[start..pos]);
+                    pos += 1;
+                    let escaped = *bytes.get(pos)?;
+                    value.push(match escaped {
+                        b'n' => '\n',
+                        b'\\' => '\\',
+                        b'"' => '"',
+                        _ => return None,
+                    });
+                    pos += 1;
+                    start = pos;
+                }
+                b'"' => {
+                    value.push_str(&raw[start..pos]);
+                    pos += 1;
+                    closed = true;
+                    break;
+                }
+                _ => pos += 1,
+            }
+        }
+        if !closed || labels.insert(key.to_owned(), value).is_some() {
+            return None;
+        }
+        if pos == bytes.len() {
+            break;
+        }
+        if bytes[pos] != b',' {
+            return None;
+        }
+        pos += 1;
+        if pos == bytes.len() {
+            return None;
+        }
+    }
+    Some(labels)
+}
+
+fn parse_exposition(exposition: &str) -> MetricSamples {
+    let mut result = MetricSamples::default();
+    for line in exposition.lines() {
+        if let Some(spec) = line.strip_prefix("# TYPE ") {
+            if let Some((name, kind)) = spec.split_once(' ') {
+                result.types.insert(name.to_owned(), kind.to_owned());
+            }
+            continue;
+        }
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        let Some((selector, raw_value)) = line.rsplit_once(' ') else {
+            continue;
+        };
+        let (name, labels) = match selector.find('{') {
+            Some(open) if selector.ends_with('}') => {
+                let Some(labels) = parse_labels(&selector[open + 1..selector.len() - 1]) else {
+                    continue;
+                };
+                (&selector[..open], labels)
+            }
+            Some(_) => continue,
+            None => (selector, BTreeMap::new()),
+        };
+        if name.is_empty() || !name.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_') {
+            continue;
+        }
+        result
+            .samples
+            .entry(name.to_owned())
+            .or_default()
+            .push(Sample {
+                labels,
+                value: sample_value(raw_value),
+            });
+    }
+    result
+}
+
+fn counts(total: usize, enabled: usize) -> Value {
+    json!({"total": total, "enabled": enabled, "disabled": total - enabled})
+}
+
+// A small, field-stable projection that an external dashboard can consume
+// without parsing metric families or knowing RustProxy's widget layout.
+fn percentage(part: u64, total: u64) -> Option<f64> {
+    (total > 0).then(|| part as f64 * 100.0 / total as f64)
+}
+
+fn summary_from_snapshot(detail: &Value, rates: crate::metrics::SummaryRates) -> Value {
+    let number = |value: &Value| value.as_u64().unwrap_or(0);
+    let requests = &detail["requests"];
+    let vhosts = &detail["vhosts"];
+    let system = &detail["system"];
+    let cache = &detail["cache"];
+    let backends = &detail["backends"];
+    let mut up = 0usize;
+    let mut down = 0usize;
+    let mut checking = 0usize;
+    let mut draining = 0usize;
+    let mut disabled = 0usize;
+    let mut unknown = 0usize;
+    let mut backend_bytes_per_second = 0.0;
+    let mut backend_members = 0usize;
+    let mut ready_pools = 0usize;
+    if let Some(pools) = backends["pools"].as_array() {
+        for pool in pools {
+            if pool["ready"].as_bool() == Some(true) {
+                ready_pools += 1;
+            }
+            if let Some(members) = pool["members"].as_array() {
+                backend_members += members.len();
+                for member in members {
+                    match member["status"].as_str().unwrap_or("unknown") {
+                        "up" => up += 1,
+                        "down" => down += 1,
+                        "checking" => checking += 1,
+                        "draining" => draining += 1,
+                        "disabled" => disabled += 1,
+                        _ => unknown += 1,
+                    }
+                    if let Some(value) = member["traffic_bytes_per_second"]
+                        .as_f64()
+                        .filter(|value| value.is_finite() && *value >= 0.0)
+                    {
+                        backend_bytes_per_second += value;
+                    }
+                }
+            }
+        }
+    }
+    let enabled = number(&vhosts["enabled"]);
+    let serving_estimate = vhosts["items"].as_array().map_or(0, |items| {
+        items
+            .iter()
+            .filter(|item| item["serving_estimate"].as_bool() == Some(true))
+            .count()
+    });
+    let backend_vhosts_ready = vhosts["items"].as_array().map_or(0, |items| {
+        items
+            .iter()
+            .filter(|item| {
+                item["enabled"].as_bool() == Some(true)
+                    && item["backend_ready"].as_bool() == Some(true)
+            })
+            .count()
+    });
+    let backend_vhosts_unready = vhosts["items"].as_array().map_or(0, |items| {
+        items
+            .iter()
+            .filter(|item| {
+                item["enabled"].as_bool() == Some(true)
+                    && item["backend_ready"].as_bool() == Some(false)
+            })
+            .count()
+    });
+    let bytes_in = number(&requests["bytes_in_total"]);
+    let bytes_out = number(&requests["bytes_out_total"]);
+    let bytes_total = bytes_in.saturating_add(bytes_out);
+    let uptime = number(&detail["uptime_seconds"]);
+    let memory_percent = system["memory_used_bytes"]
+        .as_u64()
+        .zip(system["memory_total_bytes"].as_u64())
+        .and_then(|(used, total)| percentage(used, total));
+    let request_error_percent = percentage(
+        number(&requests["errors_total"]),
+        number(&requests["completed_total"]),
+    );
+    let web_requests = detail["web_server"]["services"]
+        .as_array()
+        .map_or(0u64, |items| {
+            items
+                .iter()
+                .map(|item| number(&item["web"]["requests"]))
+                .fold(0u64, u64::saturating_add)
+        });
+    let stream_active = detail["streams"]["items"].as_array().map_or(0u64, |items| {
+        items
+            .iter()
+            .map(|item| number(&item["metrics"]["active"]))
+            .fold(0u64, u64::saturating_add)
+    });
+    let capacity_limit = number(&detail["capacity"]["requests_limit"]);
+    let capacity_available = number(&detail["capacity"]["requests_available"]);
+    let backend_bytes_per_second = backend_bytes_per_second
+        .is_finite()
+        .then_some(backend_bytes_per_second);
+    let vhosts_summary = json!({
+        "total": vhosts["total"], "enabled": enabled, "disabled": vhosts["disabled"],
+        "serving_estimate": serving_estimate,
+        "backend_ready": backend_vhosts_ready, "backend_not_ready": backend_vhosts_unready,
+        "docker_enabled": detail["docker"]["vhosts"]["enabled"]
+    });
+    let backends_summary = json!({
+        "total": backend_members, "configured_static": backends["total"],
+        "up": up, "down": down, "checking": checking,
+        "draining": draining, "disabled": disabled, "unknown": unknown,
+        "pools_total": backends["pools"].as_array().map_or(0, Vec::len),
+        "pools_ready": ready_pools,
+        "active_exchanges": backends["active"],
+        "traffic_bytes_per_second": backend_bytes_per_second
+    });
+    let traffic_summary = json!({
+        "requests_total": requests["total"],
+        "requests_completed_total": requests["completed_total"],
+        "requests_active": requests["active"],
+        "requests_per_second": rates.requests_per_second,
+        "requests_per_second_average": (uptime > 0).then(|| number(&requests["total"]) as f64 / uptime as f64),
+        "errors_total": requests["errors_total"],
+        "errors_per_second": rates.errors_per_second,
+        "error_percent": request_error_percent,
+        "status_2xx_total": requests["status"]["2xx"],
+        "status_4xx_total": requests["status"]["4xx"],
+        "status_5xx_total": requests["status"]["5xx"],
+        "bytes_in_total": bytes_in,
+        "bytes_out_total": bytes_out,
+        "bytes_total": bytes_total,
+        "megabytes_total": bytes_total as f64 / 1_000_000.0,
+        "bytes_in_per_second": rates.bytes_in_per_second,
+        "bytes_out_per_second": rates.bytes_out_per_second,
+        "bytes_per_second": rates.bytes_in_per_second.zip(rates.bytes_out_per_second).map(|(a, b)| a + b),
+        "sample_interval_seconds": rates.sample_interval_seconds,
+        "network_rx_bytes_per_second": system["network_rx_bytes_per_second"],
+        "network_tx_bytes_per_second": system["network_tx_bytes_per_second"]
+    });
+    let system_summary = json!({
+        "cpu_percent": system["cpu_percent"],
+        "process_cpu_percent": system["process_cpu_percent"],
+        "memory_percent": memory_percent,
+        "memory_used_bytes": system["memory_used_bytes"],
+        "memory_total_bytes": system["memory_total_bytes"],
+        "process_rss_bytes": system["process_rss_bytes"],
+        "sampled_at_ms": system["sampled_at_ms"]
+    });
+    let cache_summary = json!({
+        "hits_total": cache["hits"], "misses_total": cache["misses"],
+        "hit_percent": cache["hit_ratio"].as_f64().map(|v| v * 100.0),
+        "hot_entries": cache["entries"], "cold_entries": cache["cold_entries"],
+        "hot_bytes": cache["resident_bytes"], "cold_bytes": cache["cold_bytes"]
+    });
+    json!({
+        "collected_at_ms": detail["collected_at_ms"],
+        "uptime_seconds": uptime,
+        "vhosts": vhosts_summary,
+        "backends": backends_summary,
+        "traffic": traffic_summary,
+        "system": system_summary,
+        "cache": cache_summary,
+        "web_server": {
+            "services_total": detail["web_server"]["total"],
+            "requests_total": web_requests
+        },
+        "streams": {
+            "total": detail["streams"]["total"],
+            "enabled": detail["streams"]["enabled"],
+            "active_sessions": stream_active
+        },
+        "capacity": {
+            "requests_limit": capacity_limit,
+            "requests_used": capacity_limit.saturating_sub(capacity_available),
+            "requests_used_percent": percentage(capacity_limit.saturating_sub(capacity_available), capacity_limit)
+        }
+    })
+}
+
+fn snapshot(app: &App) -> Value {
+    let snapshot = app.config.load_full();
+    let config = &snapshot.envelope.config;
+    let metrics = app.metrics.view();
+    let system = app.diagnostics.view();
+    let cache = app.cache.view();
+
+    let vhosts = config
+        .vhosts
+        .iter()
+        .map(|host| {
+            let live = snapshot.vhost_metrics.get(&host.id).map(|m| m.view());
+            let pool_ready = snapshot
+                .pools
+                .iter()
+                .find(|pool| pool.id == host.id)
+                .map(|pool| pool.ready());
+            let serving_estimate =
+                host.enabled && (pool_ready == Some(true) || !host.source.is_reverse_proxy());
+            json!({"id": host.id, "enabled": host.enabled, "metrics": live,
+            "backend_ready": pool_ready, "serving_estimate": serving_estimate})
+        })
+        .collect::<Vec<_>>();
+    let mut backend_up = 0usize;
+    let mut backend_down = 0usize;
+    let mut backend_active = 0u64;
+    let pools = snapshot
+        .pools
+        .iter()
+        .map(|pool| {
+            let view = pool.view();
+            let members = view["members"]
+                .as_array()
+                .map(|items| {
+                    items.iter().map(|member| {
+            let status = member["status"].as_str().unwrap_or("unknown");
+            if status == "up" { backend_up += 1; }
+            if status == "down" { backend_down += 1; }
+            backend_active = backend_active.saturating_add(member["active"].as_u64().unwrap_or(0));
+            json!({
+                "id": member["id"], "status": status, "healthy": member["healthy"],
+                "active": member["active"], "requests_total": member["requests"],
+                "errors_total": member["errors"], "latency_ms": member["latency_ms"],
+                "traffic_bytes_per_second": member["traffic_bytes_per_second"]
+            })
+        }).collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+            json!({"vhost": pool.id, "ready": pool.ready(), "members": members})
+        })
+        .collect::<Vec<_>>();
+
+    let services = config
+        .web_services
+        .iter()
+        .filter_map(|service| {
+            let compiled = snapshot.web_php_services.get(&service.id)?;
+            let php = compiled.php.as_ref().map(|handler| {
+                let available = handler.permits.available_permits();
+                json!({"metrics": handler.metrics.view(), "capacity_limit": handler.max_concurrent,
+                "capacity_used": handler.max_concurrent.saturating_sub(available),
+                "capacity_available": available})
+            });
+            Some(json!({"id": service.id, "web": compiled.web_metrics.view(), "php": php}))
+        })
+        .collect::<Vec<_>>();
+    let streams = config
+        .streams
+        .iter()
+        .map(|stream| {
+            let live = app.stream_metrics.get(&stream.id).map(|m| {
+                let view = m.view();
+                // The dashboard's full stream view includes configured backend
+                // socket addresses and health internals. Metrics consumers only
+                // need counters/status, never infrastructure addresses.
+                let backends = view
+                    .backends
+                    .iter()
+                    .map(|backend| {
+                        json!({
+                            "id": backend.id,
+                            "enabled": backend.enabled,
+                            "status": backend.status,
+                            "active": backend.active,
+                            "sessions_total": backend.sessions_total,
+                            "sessions_completed": backend.sessions_completed,
+                            "errors": backend.errors,
+                            "rejected": backend.rejected,
+                            "bytes_in": backend.bytes_in,
+                            "bytes_out": backend.bytes_out,
+                            "packets_in": backend.packets_in,
+                            "packets_out": backend.packets_out
+                        })
+                    })
+                    .collect::<Vec<_>>();
+                json!({
+                    "sessions_total": view.sessions_total,
+                    "sessions_completed": view.sessions_completed,
+                    "active": view.active,
+                    "rejected": view.rejected,
+                    "errors": view.errors,
+                    "bytes_in": view.bytes_in,
+                    "bytes_out": view.bytes_out,
+                    "packets_in": view.packets_in,
+                    "packets_out": view.packets_out,
+                    "backends": backends
+                })
+            });
+            json!({"id": stream.id, "enabled": stream.enabled, "metrics": live})
+        })
+        .collect::<Vec<_>>();
+    let traffic = app.traffic.view(None);
+    let data = &traffic.data;
+    let methods = data
+        .method_families
+        .iter()
+        .filter(|x| {
+            super::safe_traffic_state(
+                &x.value,
+                &[
+                    "GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "CONNECT", "TRACE",
+                    "OTHER",
+                ],
+            )
+        })
+        .collect::<Vec<_>>();
+    let statuses = data
+        .statuses
+        .iter()
+        .filter(|x| super::safe_traffic_state(&x.value, &["1xx", "2xx", "3xx", "4xx", "5xx"]))
+        .collect::<Vec<_>>();
+    let cache_results = data
+        .cache
+        .iter()
+        .filter(|x| super::safe_traffic_state(&x.value, &["HIT", "MISS", "BYPASS", "-"]))
+        .collect::<Vec<_>>();
+    let sources = data
+        .sources
+        .iter()
+        .filter(|x| {
+            super::safe_traffic_state(
+                &x.value,
+                &[
+                    "reverse_proxy",
+                    "web_server",
+                    "local_response",
+                    "unresolved",
+                ],
+            )
+        })
+        .collect::<Vec<_>>();
+    let agents = &config.docker_agents.agents;
+    let docker_vhosts = agents
+        .iter()
+        .map(|agent| agent.assignments.len())
+        .sum::<usize>();
+    let docker_enabled = agents
+        .iter()
+        .filter(|agent| agent.enabled)
+        .flat_map(|agent| &agent.assignments)
+        .filter(|assignment| assignment.enabled)
+        .count();
+    let now_ms = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_millis() as u64;
+
+    // Split the JSON builders: a single giant json! macro would exceed the
+    // default macro recursion depth on supported stable Rust toolchains.
+    let requests = json!({
+        "total": metrics.requests, "completed_total": metrics.completed,
+        "active": metrics.active, "errors_total": metrics.errors,
+        "rejected_total": metrics.rejected_requests,
+        "status": {
+            "1xx": app.metrics.status_1xx.load(Ordering::Relaxed),
+            "2xx": app.metrics.status_2xx.load(Ordering::Relaxed),
+            "3xx": app.metrics.status_3xx.load(Ordering::Relaxed),
+            "4xx": app.metrics.status_4xx.load(Ordering::Relaxed),
+            "5xx": app.metrics.status_5xx.load(Ordering::Relaxed)
+        },
+        "bytes_in_total": app.metrics.bytes_in.load(Ordering::Relaxed),
+        "bytes_out_total": app.metrics.bytes_out.load(Ordering::Relaxed),
+        "mean_duration_ms": metrics.mean_duration_ms,
+        "connections_total": metrics.connections,
+        "connections_active": metrics.active_connections,
+        "websockets_total": metrics.websocket_total,
+        "websockets_active": metrics.websocket_active,
+        "http1_total": metrics.http1_requests,
+        "http2_total": metrics.http2_requests,
+        "http3_total": metrics.http3_requests
+    });
+    let system = json!({
+        "sampled_at_ms": system.sampled_at_ms,
+        "cpu_percent": system.cpu_percent,
+        "process_cpu_percent": system.process_cpu_percent,
+        "logical_cpus": system.logical_cpus,
+        "system_uptime_seconds": system.system_uptime_seconds,
+        "memory_total_bytes": system.memory_total_bytes,
+        "memory_used_bytes": system.memory_used_bytes,
+        "process_rss_bytes": system.process_rss_bytes,
+        "process_virtual_memory_bytes": system.process_virtual_memory_bytes,
+        "process_threads": system.process_threads,
+        "open_fds": system.open_fds,
+        "max_fds": system.max_fds,
+        "process_read_bytes": system.process_read_bytes,
+        "process_write_bytes": system.process_write_bytes,
+        "cgroup_memory_current_bytes": system.cgroup_memory_current_bytes,
+        "cgroup_memory_max_bytes": system.cgroup_memory_max_bytes,
+        "swap_total_bytes": system.system_swap_total_bytes,
+        "swap_used_bytes": system.system_swap_used_bytes,
+        "network_rx_bytes_per_second": system.network_rx_bytes_per_second,
+        "network_tx_bytes_per_second": system.network_tx_bytes_per_second,
+        "network_rx_bytes_total": system.network_rx_bytes,
+        "network_tx_bytes_total": system.network_tx_bytes,
+        "network_interfaces": system.network_interfaces,
+        "load_average": system.load_average
+    });
+    let traffic = json!({
+        "requests_total": data.requests,
+        "errors_total": data.errors,
+        "request_bytes_total": data.request_bytes,
+        "response_bytes_total": data.response_bytes,
+        "mean_duration_ms": data.mean_duration_ms,
+        "queue_dropped_total": traffic.queue_dropped,
+        "approximate_top_lists": traffic.approximate_top_lists,
+        "methods": methods, "statuses": statuses,
+        "cache": cache_results, "sources": sources
+    });
+    let mut detail = json!({
+        "version": env!("CARGO_PKG_VERSION"),
+        "collected_at_ms": now_ms,
+        "uptime_seconds": app.started.elapsed().as_secs(),
+        "revision": snapshot.envelope.revision,
+        "vhosts": {
+            "total": config.vhosts.len(),
+            "enabled": config.vhosts.iter().filter(|h| h.enabled).count(),
+            "disabled": config.vhosts.iter().filter(|h| !h.enabled).count(),
+            "items": vhosts
+        },
+        "redirect_hosts": counts(config.redirects.len(), config.redirects.iter().filter(|h| h.enabled).count()),
+        "not_found_hosts": counts(config.not_found_hosts.len(), config.not_found_hosts.iter().filter(|h| h.enabled).count()),
+        "requests": requests,
+        "system": system,
+        "cache": cache,
+        "backends": {
+            "total": config.vhosts.iter().map(|h| h.backends.len()).sum::<usize>(),
+            "up": backend_up, "down": backend_down, "active": backend_active,
+            "pools": pools
+        },
+        "web_server": {"total": config.web_services.len(), "services": services},
+        "streams": {
+            "total": config.streams.len(),
+            "enabled": config.streams.iter().filter(|s| s.enabled).count(),
+            "disabled": config.streams.iter().filter(|s| !s.enabled).count(),
+            "items": streams
+        },
+        "docker": {
+            "agents": counts(agents.len(), agents.iter().filter(|a| a.enabled).count()),
+            "vhosts": counts(docker_vhosts, docker_enabled)
+        },
+        "traffic": traffic,
+        "transform": app.transform_metrics.total(),
+        "logging": {
+            "dropped_total": app.logs.dropped.load(Ordering::Relaxed),
+            "sinks": app.logs.stats()
+        },
+        "capacity": {
+            "requests_limit": app.max_inflight,
+            "requests_available": app.inflight.available_permits(),
+            "listeners_active": app.active_listeners.len()
+        }
+    });
+    // Share the exact same computed summary between the full and small APIs.
+    detail["summary"] = summary_from_snapshot(&detail, app.metrics.summary_rates());
+    detail
+}
+
+pub fn summary_payload(app: &App) -> Value {
+    snapshot(app)["summary"].clone()
+}
+
+pub fn summary_response(app: &App) -> Response {
+    (
+        [
+            ("cache-control", "no-store"),
+            ("x-content-type-options", "nosniff"),
+        ],
+        axum::Json(summary_payload(app)),
+    )
+        .into_response()
+}
+
+pub fn payload(app: &App) -> Value {
+    let mut result = snapshot(app);
+    // Use one exporter implementation, so new Prometheus families automatically
+    // appear here without implementing the same counters a second time.
+    result["prometheus"] = json!(parse_exposition(&super::render(app)));
+    result
+}
+
+pub fn response(app: &App) -> Response {
+    (
+        [
+            ("cache-control", "no-store"),
+            ("x-content-type-options", "nosniff"),
+        ],
+        axum::Json(payload(app)),
+    )
+        .into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn summary_computes_backend_states_rps_totals_and_percentages() {
+        let detail: Value = serde_json::from_str(
+            r#"{
+            "collected_at_ms": 456, "uptime_seconds": 100,
+            "vhosts": {"total": 4, "enabled": 3, "disabled": 1, "items": [
+                {"enabled": true, "backend_ready": true, "serving_estimate": true},
+                {"enabled": true, "backend_ready": false, "serving_estimate": false},
+                {"enabled": true, "backend_ready": null, "serving_estimate": true},
+                {"enabled": false, "backend_ready": true, "serving_estimate": false}
+            ]},
+            "docker": {"vhosts": {"enabled": 2}},
+            "backends": {"total": 3, "active": 5, "pools": [
+                {"ready": true, "members": [
+                    {"status": "up", "traffic_bytes_per_second": 1000.0},
+                    {"status": "down", "traffic_bytes_per_second": 50.0},
+                    {"status": "checking", "traffic_bytes_per_second": null}
+                ]},
+                {"ready": false, "members": [
+                    {"status": "disabled", "traffic_bytes_per_second": 0.0},
+                    {"status": "draining", "traffic_bytes_per_second": 250.0}
+                ]}
+            ]},
+            "requests": {"total": 100, "completed_total": 80, "active": 2,
+                "errors_total": 4, "bytes_in_total": 20000000,
+                "bytes_out_total": 80000000,
+                "status": {"2xx": 70, "4xx": 5, "5xx": 5}},
+            "system": {"cpu_percent": 25.0, "process_cpu_percent": 4.0,
+                "memory_used_bytes": 200, "memory_total_bytes": 800,
+                "process_rss_bytes": 32, "sampled_at_ms": 111,
+                "network_rx_bytes_per_second": 10.0,
+                "network_tx_bytes_per_second": 20.0},
+            "cache": {"hits": 3, "misses": 1, "hit_ratio": 0.75,
+                "entries": 1, "cold_entries": 2, "resident_bytes": 300, "cold_bytes": 500},
+            "web_server": {"total": 2, "services": [
+                {"web": {"requests": 4}}, {"web": {"requests": 5}}]},
+            "streams": {"total": 2, "enabled": 1, "items": [
+                {"metrics": {"active": 2}}, {"metrics": null}]},
+            "capacity": {"requests_limit": 10, "requests_available": 7}
+        }"#,
+        )
+        .unwrap();
+        let summary = summary_from_snapshot(
+            &detail,
+            crate::metrics::SummaryRates {
+                requests_per_second: Some(7.5),
+                errors_per_second: Some(0.5),
+                bytes_in_per_second: Some(1000.0),
+                bytes_out_per_second: Some(2000.0),
+                sample_interval_seconds: Some(2.0),
+            },
+        );
+        assert_eq!(summary["vhosts"]["serving_estimate"], 2);
+        assert_eq!(summary["vhosts"]["backend_ready"], 1);
+        assert_eq!(summary["vhosts"]["backend_not_ready"], 1);
+        assert_eq!(summary["backends"]["total"], 5);
+        assert_eq!(summary["backends"]["configured_static"], 3);
+        assert_eq!(summary["backends"]["up"], 1);
+        assert_eq!(summary["backends"]["down"], 1);
+        assert_eq!(summary["backends"]["checking"], 1);
+        assert_eq!(summary["backends"]["draining"], 1);
+        assert_eq!(summary["backends"]["disabled"], 1);
+        assert_eq!(summary["backends"]["traffic_bytes_per_second"], 1300.0);
+        assert_eq!(summary["traffic"]["requests_per_second"], 7.5);
+        assert_eq!(summary["traffic"]["bytes_per_second"], 3000.0);
+        assert_eq!(summary["traffic"]["bytes_total"], 100_000_000);
+        assert_eq!(summary["traffic"]["megabytes_total"], 100.0);
+        assert_eq!(summary["traffic"]["error_percent"], 5.0);
+        assert_eq!(summary["system"]["memory_percent"], 25.0);
+        assert_eq!(summary["cache"]["hit_percent"], 75.0);
+        assert_eq!(summary["web_server"]["requests_total"], 9);
+        assert_eq!(summary["streams"]["active_sessions"], 2);
+        assert_eq!(summary["capacity"]["requests_used"], 3);
+        assert_eq!(summary["capacity"]["requests_used_percent"], 30.0);
+    }
+
+    #[test]
+    fn json_samples_preserve_labels_large_counters_and_histograms() {
+        let labels = super::super::labels(&[
+            ("vhost", "a,\\\"b\nwith newline"),
+            ("domain", "example.test"),
+        ]);
+        let source = format!(
+            "# TYPE rust_proxy_requests_total counter\nrust_proxy_requests_total 9007199254740993\n\
+             # TYPE rust_proxy_vhost_exchange_duration_seconds histogram\n\
+             rust_proxy_vhost_exchange_duration_seconds_bucket{{{labels},le=\"+Inf\"}} 2\n\
+             rust_proxy_vhost_exchange_duration_seconds_sum{{{labels}}} 1.25\n"
+        );
+        let parsed = parse_exposition(&source);
+        assert_eq!(parsed.types["rust_proxy_requests_total"], "counter");
+        assert_eq!(
+            parsed.types["rust_proxy_vhost_exchange_duration_seconds"],
+            "histogram"
+        );
+        assert_eq!(
+            parsed.samples["rust_proxy_requests_total"][0]
+                .value
+                .as_u64(),
+            Some(9007199254740993)
+        );
+        let bucket = &parsed.samples["rust_proxy_vhost_exchange_duration_seconds_bucket"][0];
+        assert_eq!(bucket.labels["vhost"], "a,\\\"b\nwith newline");
+        assert_eq!(bucket.labels["le"], "+Inf");
+        assert_eq!(bucket.value.as_u64(), Some(2));
+        assert_eq!(
+            parsed.samples["rust_proxy_vhost_exchange_duration_seconds_sum"][0]
+                .value
+                .as_f64(),
+            Some(1.25)
+        );
+        assert!(parse_labels("vhost=\"broken").is_none());
+        assert!(parse_labels("vhost=\"one\",vhost=\"two\"").is_none());
+        assert_eq!(sample_value("+Inf"), serde_json::Value::Null);
+    }
+}

src/prometheus/model.rs

@@ -140,10 +140,15 @@ pub fn router(app: Arc<App>, token: Option<Zeroizing<String>>) -> Router {
 async fn scrape(State(exporter): State<Arc<Exporter>>, request: Request) -> Response {
     let config = exporter.app.config.load_full();
     let settings = &config.envelope.config.prometheus;
+    // JSON is a sibling of the configured path, with identical transport auth.
+    let json_path = format!("{}.json", settings.path);
+    let wants_json = request.uri().path() == json_path.as_str();
+    let summary_path = format!("{}.summary.json", settings.path);
+    let wants_summary = request.uri().path() == summary_path.as_str();
     // Revocation is immediate even when changing bind/credentials needs restart.
     if !settings.enabled
         || settings.restart_differs(&exporter.app.active_prometheus)
-        || request.uri().path() != settings.path
+        || (request.uri().path() != settings.path && !wants_json && !wants_summary)
         || request.uri().query().is_some()
     {
         return StatusCode::NOT_FOUND.into_response();
@@ -201,7 +206,13 @@ async fn scrape(State(exporter): State<Arc<Exporter>>, request: Request) -> Resp
     let Ok(_permit) = exporter.slots.try_acquire() else {
         return StatusCode::TOO_MANY_REQUESTS.into_response();
     };
-    response(&exporter.app)
+    if wants_json {
+        json_response(&exporter.app)
+    } else if wants_summary {
+        summary_response(&exporter.app)
+    } else {
+        response(&exporter.app)
+    }
 }
 pub fn response(app: &App) -> Response {
     (

src/prometheus/tests.rs

@@ -56,4 +56,168 @@ mod tests {
         assert_eq!(text.matches("# TYPE x").count(), 1);
         assert!(text.ends_with('\n'));
     }
+
+    #[tokio::test]
+    async fn json_exporter_enforces_peer_bearer_and_exact_path() {
+        use crate::{
+            auth,
+            config::{self, Config, ValidationPolicy},
+            db::Store,
+        };
+        use axum::body::Body;
+        use http::Request;
+        use std::{sync::Arc, time::Duration};
+        use tower::ServiceExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let mut config = Config::default();
+        config.prometheus.enabled = true;
+        let policy = ValidationPolicy {
+            tls_addr: None,
+            cert_dir: None,
+            data_dir: None,
+            proxy_addr: "127.0.0.1:8080".parse().unwrap(),
+            admin_addr: "127.0.0.1:9090".parse().unwrap(),
+        };
+        let store = Store::open(&dir.path().join("db"), &config).await.unwrap();
+        store
+            .initialize_admin("owner", "unused-test-hash", "test")
+            .await
+            .unwrap();
+        let auth = auth::Auth::new(store.clone(), dir.path().to_path_buf())
+            .await
+            .unwrap();
+        let snapshot = config::compile(config, 0, &policy).unwrap();
+        let state = App::new(
+            store.clone(),
+            snapshot,
+            policy,
+            auth,
+            10,
+            Duration::from_secs(30),
+            Duration::from_secs(30),
+            Duration::from_secs(300),
+        );
+        let token = "test-secret-1234567890-abcdefghijklmnopqrstuvwxyz";
+        state
+            .prometheus_token_hash
+            .store(Some(Arc::new(auth::secret_hash(token))));
+        let router = router(state);
+        let make = |path: &str, peer: Option<&str>, bearer: Option<&str>| {
+            let mut builder = Request::builder().uri(path);
+            if let Some(peer) = peer {
+                builder = builder.extension(PeerAddr(peer.parse().unwrap()));
+            }
+            if let Some(bearer) = bearer {
+                builder = builder.header("authorization", format!("Bearer {bearer}"));
+            }
+            builder.body(Body::empty()).unwrap()
+        };
+        for (path, peer, bearer, expected) in [
+            ("/metrics.json", None, Some(token), StatusCode::FORBIDDEN),
+            (
+                "/metrics.json",
+                Some("203.0.113.1:5555"),
+                Some(token),
+                StatusCode::FORBIDDEN,
+            ),
+            (
+                "/metrics.json",
+                Some("127.0.0.1:5555"),
+                None,
+                StatusCode::UNAUTHORIZED,
+            ),
+            (
+                "/metrics.json",
+                Some("127.0.0.1:5555"),
+                Some("invalid"),
+                StatusCode::UNAUTHORIZED,
+            ),
+            (
+                "/metrics.json?no=1",
+                Some("127.0.0.1:5555"),
+                Some(token),
+                StatusCode::NOT_FOUND,
+            ),
+            (
+                "/metrics.json/",
+                Some("127.0.0.1:5555"),
+                Some(token),
+                StatusCode::NOT_FOUND,
+            ),
+            (
+                "/metrics.summary.json",
+                None,
+                Some(token),
+                StatusCode::FORBIDDEN,
+            ),
+            (
+                "/metrics.summary.json",
+                Some("127.0.0.1:5555"),
+                None,
+                StatusCode::UNAUTHORIZED,
+            ),
+            (
+                "/metrics.summary.json?any=1",
+                Some("127.0.0.1:5555"),
+                Some(token),
+                StatusCode::NOT_FOUND,
+            ),
+            (
+                "/metrics.summary.json/",
+                Some("127.0.0.1:5555"),
+                Some(token),
+                StatusCode::NOT_FOUND,
+            ),
+        ] {
+            let response = router
+                .clone()
+                .oneshot(make(path, peer, bearer))
+                .await
+                .unwrap();
+            assert_eq!(response.status(), expected, "{path} {peer:?}");
+        }
+        let response = router
+            .clone()
+            .oneshot(make("/metrics.json", Some("127.0.0.1:5555"), Some(token)))
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response.headers()["cache-control"], "no-store");
+        assert!(response.headers()["content-type"]
+            .to_str()
+            .unwrap()
+            .starts_with("application/json"));
+        let bytes = axum::body::to_bytes(response.into_body(), 8_000_000)
+            .await
+            .unwrap();
+        let body: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(body["vhosts"]["total"], 0);
+        assert!(body["requests"]["total"].is_number());
+        assert!(body["prometheus"]["samples"]["rust_proxy_requests_total"].is_array());
+        let response = router
+            .clone()
+            .oneshot(make(
+                "/metrics.summary.json",
+                Some("127.0.0.1:5555"),
+                Some(token),
+            ))
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response.headers()["cache-control"], "no-store");
+        let bytes = axum::body::to_bytes(response.into_body(), 1_000_000)
+            .await
+            .unwrap();
+        let summary: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(summary["vhosts"]["total"], 0);
+        assert!(summary["traffic"]["bytes_total"].is_number());
+        assert!(summary.get("prometheus").is_none());
+        let response = router
+            .oneshot(make("/metrics", Some("127.0.0.1:5555"), Some(token)))
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+        store.close().await;
+    }
 }