v0.25.5

docs/PROMETHEUS.md

@@ -2,8 +2,8 @@
 
 RustProxy exposes Prometheus text exposition 0.0.4 on a dedicated read-only
 listener. It is independent from administrator browser sessions and does not
-export request paths, query strings, cookies, credentials, backend URLs or ACME
-account secrets.
+export raw client IPs, request paths, query strings, full User-Agent strings, cookies,
+credentials, backend URLs or ACME account secrets.
 
 ## Configuration
 
@@ -18,6 +18,7 @@ account secrets.
     "allow_trusted_network_without_token": false,
     "include_system": true,
     "include_vhosts": true,
+    "include_traffic": true,
     "include_backends": true,
     "include_docker_vhosts": true,
     "include_cache_domains": true,
@@ -68,6 +69,8 @@ The exporter represents all scalar fields currently sampled by `diagnostics::Vie
 | GeoIP | loaded state plus IPv4/IPv6 range counts |
 | Cache | hot entries/bytes, global hit ratio and counters, cold entries/bytes and movement/error counters, fill bytes, cold queue bytes/items, active cold read/write bytes, combined transient bytes, configured-domain hot/cold occupancy, hit ratio and decision data |
 | Vhosts | desired enable/domain/path/cache settings, per-vhost traffic/status/error/byte counters and cumulative exchange-duration histogram |
+| Traffic analytics | independent live collector (`include_traffic`): capture-state gauges, per-vhost request/error/body-byte/duration totals; approximate bounded top countries; fixed User-Agent families; fixed HTTP method families; status classes; cache outcomes; serving source (`web_server`, `reverse_proxy`, `local_response`, `unresolved`); and currently configured route IDs |
+| Built-in Web Server | configured Web Service count/info, PHP and directory-listing flags, vhost/route source metadata, plus actual request traffic through the shared vhost counters and Traffic serving-source metrics |
 | Redirect/404 hosts | desired enable state, domain/rule counts and local-response status |
 | Backends | pool readiness/policy info, bounded backend status, health/drain/backup, active work and configured request-concurrency/queue limits, requests/errors/bytes, weight, separate active/passive failure state, active/passive successes and health-failure totals, unconditional HTTP-5xx/timeout/connect/I/O/slow-response observation counters, DNS/TLS/header-timeout/read-timeout/send-timeout diagnostics, capacity rejection/queue-timeout counters, plus `passive_http_5xx_total`, `passive_timeouts_total`, `passive_connect_errors_total`, `passive_io_errors_total` and `passive_slow_total` aliases, health transitions, last status, current/EWMA latency, last-probe/failure/ejection/recovery timestamps, traffic rate, and retry attempt/success totals for ordinary vhosts |
 | Docker vhosts | separate `rust_proxy_docker_vhost_*` and `rust_proxy_docker_backend_*` families: configured agents/assignments/domains, vhost traffic/status/duration plus backend readiness, health, requests/errors/bytes, latency/EWMA, separate active/passive failure state, unconditional observation counters and matching passive-health aliases, transitions and probe results |
@@ -77,8 +80,9 @@ The exporter represents all scalar fields currently sampled by `diagnostics::Vie
 | Inventory | listeners/protocol flags, vhost/redirect/404/stream/ACL counts, request capacity and available permits, config revision and restart-required state |
 
 Values unavailable on the running OS are omitted rather than fabricated. Series
-labels are bounded by configured IDs/domains, finite states and fixed protocol/status
-families. Per-request URLs and arbitrary Host input are never labels.
+labels are bounded by configured IDs/domains, finite states, fixed protocol/status/UA/method/source
+families, or the finite two-letter country space. Per-request URLs, raw client IPs, full
+User-Agent values and arbitrary Host input are never labels.
 
 This is complete for **currently implemented bounded diagnostic views**. It does
 not intentionally expose secrets, raw configuration documents, access-log entries
@@ -112,6 +116,27 @@ Vhost rate:
 sum by (vhost) (rate(rust_proxy_vhost_requests_total[5m]))
 ```
 
+Web Server traffic rate:
+
+```promql
+sum by (vhost) (rate(rust_proxy_traffic_source_requests_total{source="web_server"}[5m]))
+```
+
+Top country snapshot from bounded Traffic analytics:
+
+```promql
+sum by (country) (rust_proxy_traffic_country_requests)
+```
+
+Country series are populated when **Settings -> Logging -> Capture country** is enabled; User-Agent family series follow **Capture User-Agent**. The exporter never turns those request-path captures on by itself.
+Current capture state is exposed as `rust_proxy_traffic_country_capture_enabled` and `rust_proxy_traffic_user_agent_capture_enabled`. Configured-route snapshots use `rust_proxy_traffic_route_requests`; raw URL paths are never exported as labels.
+
+Fixed User-Agent families:
+
+```promql
+sum by (family) (rust_proxy_traffic_user_agent_family_requests_total)
+```
+
 Vhost p95 exchange lifetime:
 
 ```promql