npm - fbi-proxy - Versions diffs - 1.13.0 → 1.15.0 - Mend

fbi-proxy 1.13.0 → 1.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +3 -3
package/package.json +1 -1
package/release/fbi-proxy-linux-arm64 +0 -0
package/release/fbi-proxy-linux-x64 +0 -0
package/release/fbi-proxy-macos-arm64 +0 -0
package/release/fbi-proxy-macos-x64 +0 -0
package/release/fbi-proxy-windows-arm64.exe +0 -0
package/release/fbi-proxy-windows-x64.exe +0 -0
package/rs/fbi-proxy.rs +216 -8
package/rs/lib.rs +3 -8
package/rs/metrics.rs +111 -0

package/README.md CHANGED Viewed

@@ -40,9 +40,9 @@ FBI-Proxy provides easy HTTPS access to your local services with intelligent dom
 ### Next Up 🚧
-- [ ] **Custom Domain Wizard polish** — Print the DNS A-records to add (`*.example.dev → <ip>`) and a Caddyfile-with-DNS-01 sample for Cloudflare during `--reconfigure` on a non-fbi.com domain
-- [ ] **Hot Reload** — Watch `routes.yaml` and recompile rules without a restart
-- [ ] **Metrics** — `/varz`-style counters: requests, 2xx/4xx/5xx, upstream-connect-failures, sessions-issued, sessions-refreshed (Prometheus format)
+- [x] **Custom Domain Wizard polish** — Print the DNS A-records to add (`*.example.dev → <ip>`) and a Caddyfile-with-DNS-01 sample for Cloudflare during `--reconfigure` on a non-fbi.com domain
+- [x] **Hot Reload** — `routes.yaml` is watched; edits reload atomically without a restart (typos keep the previous rules live)
+- [x] **Metrics** — Set `FBI_PROXY_METRICS_PORT=<port>` to expose Prometheus counters on a separate 127.0.0.1-bound admin endpoint: requests, 2xx/3xx/4xx/5xx, upstream connect failures, upstream timeouts, WebSocket upgrades, host-rejected. (fbi-auth-side session counters still on the to-do.)
 - [ ] **Health Checks** — Active upstream liveness probes, not just per-request failure detection
 - [ ] **Cloudflare Tunnel / ngrok Integration** — Expose `*.your-domain` publicly without owning a static IP

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "fbi-proxy",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "FBI-Proxy provides easy HTTPS access to your local services with intelligent domain routing",
   "keywords": [
     "development-tools",

package/release/fbi-proxy-linux-arm64 CHANGED Viewed

Binary file

package/release/fbi-proxy-linux-x64 CHANGED Viewed

Binary file

package/release/fbi-proxy-macos-arm64 CHANGED Viewed

Binary file

package/release/fbi-proxy-macos-x64 CHANGED Viewed

Binary file

package/release/fbi-proxy-windows-arm64.exe CHANGED Viewed

Binary file

package/release/fbi-proxy-windows-x64.exe CHANGED Viewed

Binary file

package/rs/fbi-proxy.rs CHANGED Viewed

@@ -1,4 +1,5 @@
 use clap::{Arg, Command};
+use fbi_proxy::metrics::Metrics;
 use fbi_proxy::routes::{self, CompiledRoute, RouteHit};
 use futures_util::{SinkExt, StreamExt};
 use http_body_util::{BodyExt, Full};
@@ -11,7 +12,8 @@ use hyper_tungstenite::{HyperWebsocket, WebSocketStream};
 use hyper_util::client::legacy::{Client, connect::HttpConnector};
 use hyper_util::rt::TokioIo;
 use hyper_rustls::HttpsConnector;
-use log::{error, info};
+use arc_swap::ArcSwap;
+use log::{error, info, warn};
 use regex::Regex;
 use std::convert::Infallible;
 use std::net::SocketAddr;
@@ -33,7 +35,11 @@ pub struct FBIProxy {
     client: Client<HttpsConnector<HttpConnector>, BoxBody>,
     number_regex: Regex,
     domain_filter: Option<String>,
-    compiled_routes: Vec<CompiledRoute>,
+    /// Compiled routes wrapped in an ArcSwap so they can be replaced
+    /// atomically at runtime (hot reload from `--routes`). Reads use
+    /// `.load()` and never block; writes are atomic Arc swaps.
+    compiled_routes: Arc<ArcSwap<Vec<CompiledRoute>>>,
+    metrics: Arc<Metrics>,
 }
 /*
@@ -85,10 +91,24 @@ impl FBIProxy {
             client,
             number_regex: Regex::new(r"^\d+$").unwrap(),
             domain_filter,
-            compiled_routes,
+            compiled_routes: Arc::new(ArcSwap::from_pointee(compiled_routes)),
+            metrics: Metrics::new(),
         }
     }
+    /// Return a handle to the live routes Arc so callers (e.g. the
+    /// file watcher) can swap them at runtime without re-creating the
+    /// proxy.
+    pub fn routes_handle(&self) -> Arc<ArcSwap<Vec<CompiledRoute>>> {
+        Arc::clone(&self.compiled_routes)
+    }
+    /// Return a handle to the live metrics counters so the metrics
+    /// admin endpoint can read them.
+    pub fn metrics_handle(&self) -> Arc<Metrics> {
+        Arc::clone(&self.metrics)
+    }
     fn landing_page_html() -> String {
         r#"<!DOCTYPE html>
 <html lang="en">
@@ -216,8 +236,12 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
             }
         }
+        // Lock-free read of the live routes (may have been swapped by
+        // the file watcher mid-flight). `.load()` returns an Arc; we
+        // hold a reference for the duration of the match.
+        let routes_guard = self.compiled_routes.load();
         let hit = routes::match_host_with_domain(
-            &self.compiled_routes,
+            routes_guard.as_ref(),
             host_header,
             self.domain_filter.as_deref(),
         )?;
@@ -251,6 +275,8 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     host_header,
                     uri
                 );
+                self.metrics.host_rejected_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                self.metrics.record_status(502);
                 return Ok(Response::builder()
                     .status(StatusCode::BAD_GATEWAY)
                     .body(Full::new(Bytes::from("Bad Gateway: Host not allowed")).map_err(|e| match e {}).boxed())?);
@@ -260,6 +286,7 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
         // Serve landing page for root domain access
         if target_host == "@LANDING" {
             info!("GET {} => LANDING 200", host_header);
+            self.metrics.record_status(200);
             return Ok(Response::builder()
                 .status(StatusCode::OK)
                 .header("Content-Type", "text/html; charset=utf-8")
@@ -393,6 +420,7 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
         // Handle WebSocket upgrade requests
         if hyper_tungstenite::is_upgrade_request(&req) {
+            self.metrics.websocket_upgrades_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
             return self
                 .handle_websocket_upgrade(req, &target_host, &new_host)
                 .await;
@@ -442,6 +470,7 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     original_uri,
                     status.as_u16()
                 );
+                self.metrics.record_status(status.as_u16());
                 // Convert the response body back to BoxBody
                 let (parts, body) = response.into_parts();
                 let boxed_body = body.map_err(|e| e).boxed();
@@ -456,6 +485,8 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     original_uri,
                     e
                 );
+                self.metrics.upstream_connect_failures_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                self.metrics.record_status(502);
                 Ok(Response::builder()
                     .status(StatusCode::BAD_GATEWAY)
                     .header("Content-Type", "text/plain")
@@ -469,6 +500,8 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     target_host,
                     original_uri
                 );
+                self.metrics.upstream_timeouts_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                self.metrics.record_status(502);
                 Ok(Response::builder()
                     .status(StatusCode::BAD_GATEWAY)
                     .header("Content-Type", "text/plain")
@@ -616,16 +649,178 @@ fn load_routes(yaml_src: &str, source_label: &str) -> Vec<CompiledRoute> {
     }
 }
+/// Run a tiny HTTP server on 127.0.0.1:{port} that responds to
+/// `GET /metrics` with the current counters in Prometheus text format.
+/// All other paths return 404. The endpoint binds loopback-only so
+/// metrics aren't exposed via the user-facing proxy port.
+async fn serve_metrics(
+    metrics: Arc<Metrics>,
+    port: u16,
+) -> Result<(), BoxError> {
+    let addr: SocketAddr = format!("127.0.0.1:{}", port).parse()?;
+    let listener = TcpListener::bind(addr).await?;
+    info!("[metrics] listening on http://{}/metrics", addr);
+    println!("[metrics] listening on http://{}/metrics", addr);
+    loop {
+        let (stream, _) = listener.accept().await?;
+        let metrics = Arc::clone(&metrics);
+        let io = TokioIo::new(stream);
+        tokio::spawn(async move {
+            let service = service_fn(move |req: Request<Incoming>| {
+                let metrics = Arc::clone(&metrics);
+                async move {
+                    let resp = if req.uri().path() == "/metrics" {
+                        let body = metrics.render_prometheus();
+                        Response::builder()
+                            .status(StatusCode::OK)
+                            .header("Content-Type", "text/plain; version=0.0.4")
+                            .body(Full::new(Bytes::from(body)).map_err(|e| match e {}).boxed())
+                            .unwrap()
+                    } else {
+                        Response::builder()
+                            .status(StatusCode::NOT_FOUND)
+                            .body(Full::new(Bytes::from("not found")).map_err(|e| match e {}).boxed())
+                            .unwrap()
+                    };
+                    Ok::<_, Infallible>(resp)
+                }
+            });
+            if let Err(e) = http1::Builder::new().serve_connection(io, service).await {
+                error!("[metrics] connection error: {}", e);
+            }
+        });
+    }
+}
+/// Parse + compile a routes file without panicking. Returns Err with a
+/// human-readable message on any failure. Used by the hot-reload path
+/// where we want to log + keep current rules rather than crash.
+fn try_reload_routes(path: &str) -> Result<Vec<CompiledRoute>, String> {
+    let yaml = std::fs::read_to_string(path)
+        .map_err(|e| format!("read {}: {}", path, e))?;
+    let parsed = routes::parse_yaml(&yaml)
+        .map_err(|e| format!("parse {}: {}", path, e))?;
+    routes::compile(parsed.routes)
+        .map_err(|e| format!("compile {}: {}", path, e))
+}
+/// Watch a routes file and atomically swap in new rules on change.
+/// Debounces flurries of FS events (some editors save by truncate+
+/// rewrite which can fire multiple notifications in ~ms). On parse or
+/// compile failure, log a warning and leave the existing rules in
+/// place — the running proxy continues to work with whatever last
+/// loaded successfully.
+fn spawn_routes_watcher(
+    path: String,
+    handle: Arc<ArcSwap<Vec<CompiledRoute>>>,
+) {
+    use notify::{RecursiveMode, Watcher};
+    use std::sync::mpsc;
+    std::thread::spawn(move || {
+        let (tx, rx) = mpsc::channel();
+        let mut watcher = match notify::recommended_watcher(move |res| {
+            // Best-effort forward; if the receiver is gone the watcher
+            // thread is shutting down anyway.
+            let _ = tx.send(res);
+        }) {
+            Ok(w) => w,
+            Err(e) => {
+                error!("[routes hot-reload] failed to create watcher: {}", e);
+                return;
+            }
+        };
+        if let Err(e) = watcher.watch(
+            std::path::Path::new(&path),
+            RecursiveMode::NonRecursive,
+        ) {
+            error!("[routes hot-reload] failed to watch {}: {}", path, e);
+            return;
+        }
+        info!("[routes hot-reload] watching {}", path);
+        // Debounce window — wait this long for the burst to subside
+        // before reloading.
+        const DEBOUNCE: Duration = Duration::from_millis(150);
+        loop {
+            // Block for the next event.
+            match rx.recv() {
+                Ok(Ok(_event)) => {}
+                Ok(Err(e)) => {
+                    warn!("[routes hot-reload] watcher error: {}", e);
+                    continue;
+                }
+                Err(_) => break, // sender dropped — proxy shutting down
+            }
+            // Drain any additional events that arrive during the debounce
+            // window, so a single save that fires 3 events triggers
+            // exactly one reload.
+            loop {
+                match rx.recv_timeout(DEBOUNCE) {
+                    Ok(_) => continue,
+                    Err(_) => break,
+                }
+            }
+            match try_reload_routes(&path) {
+                Ok(new_routes) => {
+                    let n = new_routes.len();
+                    handle.store(Arc::new(new_routes));
+                    info!("[routes hot-reload] reloaded {} rule(s) from {}", n, path);
+                }
+                Err(reason) => {
+                    warn!(
+                        "[routes hot-reload] reload failed, keeping previous rules: {}",
+                        reason
+                    );
+                }
+            }
+        }
+    });
+}
 pub async fn start_proxy_server(
     host: Option<&str>,
     port: u16,
     domain_filter: Option<String>,
     compiled_routes: Vec<CompiledRoute>,
+    watch_path: Option<String>,
 ) -> Result<(), BoxError> {
     let host = host.unwrap_or("127.0.0.1");
     let addr: SocketAddr = format!("{}:{}", host, port).parse()?;
     let proxy = Arc::new(FBIProxy::new(domain_filter.clone(), compiled_routes));
+    // Hot-reload: when the user pointed us at a routes file with
+    // --routes, spawn a background watcher that re-parses + swaps in
+    // new rules on file change. Failures leave the current rules in
+    // place — never crash the running proxy because of a typo in YAML.
+    if let Some(path) = watch_path {
+        spawn_routes_watcher(path, proxy.routes_handle());
+    }
+    // Metrics: when FBI_PROXY_METRICS_PORT is set, expose a 127.0.0.1-bound
+    // Prometheus-text endpoint at /metrics on that port. Off by default —
+    // never exposed on the proxy's user-traffic port.
+    if let Ok(metrics_port_str) = std::env::var("FBI_PROXY_METRICS_PORT") {
+        if let Ok(metrics_port) = metrics_port_str.parse::<u16>() {
+            let metrics = proxy.metrics_handle();
+            tokio::spawn(async move {
+                if let Err(e) = serve_metrics(metrics, metrics_port).await {
+                    error!("[metrics] server exited: {}", e);
+                }
+            });
+        } else {
+            warn!(
+                "[metrics] FBI_PROXY_METRICS_PORT='{}' is not a valid port number; metrics disabled",
+                metrics_port_str
+            );
+        }
+    }
     let listener = TcpListener::bind(addr).await?;
     info!("FBI Proxy server running on http://{}", addr);
@@ -783,8 +978,10 @@ TRY RUN:
     };
     // Load routes: either from --routes <path> or the bundled default.
-    let compiled_routes = if routes_path.is_empty() {
-        load_routes(BUNDLED_ROUTES_YAML, "bundled routes.yaml")
+    // The bundled YAML is baked into the binary and can't change at
+    // runtime, so hot reload only applies to the --routes path.
+    let (compiled_routes, watch_path) = if routes_path.is_empty() {
+        (load_routes(BUNDLED_ROUTES_YAML, "bundled routes.yaml"), None)
     } else {
         let src = match std::fs::read_to_string(routes_path) {
             Ok(s) => s,
@@ -793,7 +990,10 @@ TRY RUN:
                 std::process::exit(2);
             }
         };
-        load_routes(&src, &format!("routes file '{}'", routes_path))
+        (
+            load_routes(&src, &format!("routes file '{}'", routes_path)),
+            Some(routes_path.clone()),
+        )
     };
     let rt = tokio::runtime::Runtime::new().unwrap();
@@ -802,7 +1002,15 @@ TRY RUN:
             "Starting FBI-Proxy on {}:{} with domain filter: {:?}",
             host, port, domain_filter
         );
-        if let Err(e) = start_proxy_server(Some(host), port, domain_filter, compiled_routes).await {
+        if let Err(e) = start_proxy_server(
+            Some(host),
+            port,
+            domain_filter,
+            compiled_routes,
+            watch_path,
+        )
+        .await
+        {
             error!("Failed to start proxy server: {}", e);
         }
     });

package/rs/lib.rs CHANGED Viewed

@@ -1,12 +1,7 @@
 //! Library entry point for `fbi-proxy`.
 //!
-//! This file exists primarily so that internal modules (like `routes`)
-//! can be unit-tested via `cargo test --lib` without coupling them to
-//! the binary's runtime concerns.
-//!
-//! The binary in `rs/fbi-proxy.rs` does not currently depend on this
-//! library — the routing engine is intentionally not wired into the
-//! live request path yet (see `docs/routing.md` for the migration
-//! plan).
+//! Exposes internal modules so they can be unit-tested via
+//! `cargo test --lib` and reused by the binary in `rs/fbi-proxy.rs`.
+pub mod metrics;
 pub mod routes;

package/rs/metrics.rs ADDED Viewed

@@ -0,0 +1,111 @@
+//! Simple Prometheus-text metrics for fbi-proxy.
+//!
+//! Tiny counter set, no external prom_client dep — `fmt::Write` is
+//! enough. The counters are atomic so they can be incremented from any
+//! request task without locks; the renderer reads them with `Ordering::
+//! Relaxed` (monotonic counters, dirty reads are fine).
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Arc;
+#[derive(Default)]
+pub struct Metrics {
+    pub requests_total: AtomicU64,
+    pub status_2xx_total: AtomicU64,
+    pub status_3xx_total: AtomicU64,
+    pub status_4xx_total: AtomicU64,
+    pub status_5xx_total: AtomicU64,
+    pub upstream_connect_failures_total: AtomicU64,
+    pub upstream_timeouts_total: AtomicU64,
+    pub websocket_upgrades_total: AtomicU64,
+    pub host_rejected_total: AtomicU64,
+}
+impl Metrics {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self::default())
+    }
+    pub fn record_status(&self, status: u16) {
+        self.requests_total.fetch_add(1, Ordering::Relaxed);
+        let bucket = match status {
+            200..=299 => &self.status_2xx_total,
+            300..=399 => &self.status_3xx_total,
+            400..=499 => &self.status_4xx_total,
+            500..=599 => &self.status_5xx_total,
+            _ => return, // other status codes (1xx, etc.) — ignore for now
+        };
+        bucket.fetch_add(1, Ordering::Relaxed);
+    }
+    pub fn render_prometheus(&self) -> String {
+        let mut out = String::with_capacity(1024);
+        emit_counter(&mut out, "fbi_proxy_requests_total",
+            "Total HTTP requests handled by fbi-proxy.",
+            self.requests_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_2xx_total",
+            "HTTP responses with status 2xx.",
+            self.status_2xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_3xx_total",
+            "HTTP responses with status 3xx.",
+            self.status_3xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_4xx_total",
+            "HTTP responses with status 4xx.",
+            self.status_4xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_5xx_total",
+            "HTTP responses with status 5xx.",
+            self.status_5xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_upstream_connect_failures_total",
+            "Failed TCP/TLS connects to upstream.",
+            self.upstream_connect_failures_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_upstream_timeouts_total",
+            "Upstream requests that exceeded the request timeout.",
+            self.upstream_timeouts_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_websocket_upgrades_total",
+            "WebSocket upgrade requests handled.",
+            self.websocket_upgrades_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_host_rejected_total",
+            "Requests rejected because the Host header didn't match the domain filter or any route.",
+            self.host_rejected_total.load(Ordering::Relaxed));
+        out
+    }
+}
+fn emit_counter(out: &mut String, name: &str, help: &str, value: u64) {
+    use std::fmt::Write;
+    let _ = writeln!(out, "# HELP {} {}", name, help);
+    let _ = writeln!(out, "# TYPE {} counter", name);
+    let _ = writeln!(out, "{} {}", name, value);
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn record_status_routes_to_correct_bucket() {
+        let m = Metrics::new();
+        m.record_status(200);
+        m.record_status(204);
+        m.record_status(302);
+        m.record_status(404);
+        m.record_status(502);
+        m.record_status(502);
+        assert_eq!(m.requests_total.load(Ordering::Relaxed), 6);
+        assert_eq!(m.status_2xx_total.load(Ordering::Relaxed), 2);
+        assert_eq!(m.status_3xx_total.load(Ordering::Relaxed), 1);
+        assert_eq!(m.status_4xx_total.load(Ordering::Relaxed), 1);
+        assert_eq!(m.status_5xx_total.load(Ordering::Relaxed), 2);
+    }
+    #[test]
+    fn render_includes_help_and_type_lines() {
+        let m = Metrics::new();
+        m.record_status(200);
+        let out = m.render_prometheus();
+        assert!(out.contains("# HELP fbi_proxy_requests_total"));
+        assert!(out.contains("# TYPE fbi_proxy_requests_total counter"));
+        assert!(out.contains("fbi_proxy_requests_total 1\n"));
+        assert!(out.contains("fbi_proxy_status_2xx_total 1\n"));
+    }
+}