Grafana dashboard

rustproxy-overview.json is a provisioning/import dashboard for the dedicated RustProxy Prometheus exporter. It covers global traffic, status classes, vhost latency, backend health/latency, upstream-client generation/retry/rotation diagnostics, a dedicated Docker-vhost section, hot/cold/transient cache memory, Linux process and cgroup diagnostics, HTTP/2/HTTP/3/TLS/WebSocket counters, Layer-4 streams, structured-log sink health, configuration inventory and bounded Traffic analytics.

The Docker vhosts row uses only the dedicated rust_proxy_docker_* metric families and includes configured/enabled counts, request/error rates, p95 exchange latency, backend health/EWMA latency/active work, traffic, probe age and upstream-client lifecycle/retry panels. Dashboard variables Docker agent and Docker service filter only this section, which keeps multi-agent installations readable without changing the ordinary vhost panels.

The Traffic analytics and Web Server row uses the rust_proxy_traffic_* families. The Traffic vhost variable filters that row and exposes Web Server request rate, serving-source rate, top countries, fixed User-Agent families, HTTP methods, status classes, cache outcomes, capture-state gauges and configured-route traffic. Raw IP addresses, request paths and full User-Agent strings are intentionally absent from Prometheus labels.

Import the JSON in Grafana and select a Prometheus datasource when prompted. The dashboard expects RustProxy 0.25.7 metric names and a scrape interval around 15s. Collectors can be disabled in RustProxy settings; panels for disabled collectors will simply show no series.

Recommended scrape job:

scrape_configs:
  - job_name: rustproxy
    scrape_interval: 15s
    metrics_path: /metrics
    static_configs:
      - targets: ['rustproxy-host:9191']

When the exporter is protected with a bearer token, configure Prometheus authorization.credentials_file. For a private monitoring VLAN, RustProxy can instead explicitly allow actual peers from configured trusted CIDRs to scrape without a token. Forwarded client-IP headers never satisfy that trust check.