# Grafana dashboard

`rustproxy-overview.json` is a provisioning/import dashboard for the dedicated
RustProxy Prometheus exporter. It covers global traffic, status classes, vhost
latency, backend health/latency, upstream-client generation/retry/rotation diagnostics,
a dedicated Docker-vhost section, hot/cold/transient cache memory, Linux process and cgroup diagnostics, HTTP/2/HTTP/3/TLS/WebSocket
counters, Layer-4 streams, structured-log sink health, configuration inventory and bounded Traffic analytics.

The **Docker vhosts** row uses only the dedicated `rust_proxy_docker_*` metric
families and includes configured/enabled counts, request/error rates, p95 exchange
latency, backend health/EWMA latency/active work, traffic, probe age and upstream-client lifecycle/retry panels. Dashboard
variables **Docker agent** and **Docker service** filter only this section, which keeps
multi-agent installations readable without changing the ordinary vhost panels.

The **Traffic analytics and Web Server** row uses the `rust_proxy_traffic_*` families.
The **Traffic vhost** variable filters that row and exposes Web Server request rate,
serving-source rate, top countries, fixed User-Agent families, HTTP methods, status
classes, cache outcomes, capture-state gauges and configured-route traffic. Raw IP addresses, request paths and full User-Agent strings
are intentionally absent from Prometheus labels.

Import the JSON in Grafana and select a Prometheus datasource when prompted. The
dashboard expects RustProxy 0.26.5 metric names and a scrape interval around 15s.
Collectors can be disabled in RustProxy settings; panels for disabled collectors
will simply show no series.

Recommended scrape job:

```yaml
scrape_configs:
  - job_name: rustproxy
    scrape_interval: 15s
    metrics_path: /metrics
    static_configs:
      - targets: ['rustproxy-host:9191']
```

When the exporter is protected with a bearer token, configure Prometheus
`authorization.credentials_file`. For a private monitoring VLAN, RustProxy can
instead explicitly allow actual peers from configured trusted CIDRs to scrape
without a token. Forwarded client-IP headers never satisfy that trust check.