npm - fbi-proxy - Versions diffs - 1.14.0 → 1.15.0 - Mend

fbi-proxy 1.14.0 → 1.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +1 -1
package/package.json +1 -1
package/release/fbi-proxy-linux-arm64 +0 -0
package/release/fbi-proxy-linux-x64 +0 -0
package/release/fbi-proxy-macos-arm64 +0 -0
package/release/fbi-proxy-macos-x64 +0 -0
package/release/fbi-proxy-windows-arm64.exe +0 -0
package/release/fbi-proxy-windows-x64.exe +0 -0
package/rs/fbi-proxy.rs +81 -0
package/rs/lib.rs +3 -8
package/rs/metrics.rs +111 -0

package/README.md CHANGED Viewed

@@ -42,7 +42,7 @@ FBI-Proxy provides easy HTTPS access to your local services with intelligent dom
 - [x] **Custom Domain Wizard polish** — Print the DNS A-records to add (`*.example.dev → <ip>`) and a Caddyfile-with-DNS-01 sample for Cloudflare during `--reconfigure` on a non-fbi.com domain
 - [x] **Hot Reload** — `routes.yaml` is watched; edits reload atomically without a restart (typos keep the previous rules live)
-- [ ] **Metrics** — `/varz`-style counters: requests, 2xx/4xx/5xx, upstream-connect-failures, sessions-issued, sessions-refreshed (Prometheus format)
+- [x] **Metrics** — Set `FBI_PROXY_METRICS_PORT=<port>` to expose Prometheus counters on a separate 127.0.0.1-bound admin endpoint: requests, 2xx/3xx/4xx/5xx, upstream connect failures, upstream timeouts, WebSocket upgrades, host-rejected. (fbi-auth-side session counters still on the to-do.)
 - [ ] **Health Checks** — Active upstream liveness probes, not just per-request failure detection
 - [ ] **Cloudflare Tunnel / ngrok Integration** — Expose `*.your-domain` publicly without owning a static IP

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "fbi-proxy",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "FBI-Proxy provides easy HTTPS access to your local services with intelligent domain routing",
   "keywords": [
     "development-tools",

package/release/fbi-proxy-linux-arm64 CHANGED Viewed

Binary file

package/release/fbi-proxy-linux-x64 CHANGED Viewed

Binary file

package/release/fbi-proxy-macos-arm64 CHANGED Viewed

Binary file

package/release/fbi-proxy-macos-x64 CHANGED Viewed

Binary file

package/release/fbi-proxy-windows-arm64.exe CHANGED Viewed

Binary file

package/release/fbi-proxy-windows-x64.exe CHANGED Viewed

Binary file

package/rs/fbi-proxy.rs CHANGED Viewed

@@ -1,4 +1,5 @@
 use clap::{Arg, Command};
+use fbi_proxy::metrics::Metrics;
 use fbi_proxy::routes::{self, CompiledRoute, RouteHit};
 use futures_util::{SinkExt, StreamExt};
 use http_body_util::{BodyExt, Full};
@@ -38,6 +39,7 @@ pub struct FBIProxy {
     /// atomically at runtime (hot reload from `--routes`). Reads use
     /// `.load()` and never block; writes are atomic Arc swaps.
     compiled_routes: Arc<ArcSwap<Vec<CompiledRoute>>>,
+    metrics: Arc<Metrics>,
 }
 /*
@@ -90,6 +92,7 @@ impl FBIProxy {
             number_regex: Regex::new(r"^\d+$").unwrap(),
             domain_filter,
             compiled_routes: Arc::new(ArcSwap::from_pointee(compiled_routes)),
+            metrics: Metrics::new(),
         }
     }
@@ -100,6 +103,12 @@ impl FBIProxy {
         Arc::clone(&self.compiled_routes)
     }
+    /// Return a handle to the live metrics counters so the metrics
+    /// admin endpoint can read them.
+    pub fn metrics_handle(&self) -> Arc<Metrics> {
+        Arc::clone(&self.metrics)
+    }
     fn landing_page_html() -> String {
         r#"<!DOCTYPE html>
 <html lang="en">
@@ -266,6 +275,8 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     host_header,
                     uri
                 );
+                self.metrics.host_rejected_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                self.metrics.record_status(502);
                 return Ok(Response::builder()
                     .status(StatusCode::BAD_GATEWAY)
                     .body(Full::new(Bytes::from("Bad Gateway: Host not allowed")).map_err(|e| match e {}).boxed())?);
@@ -275,6 +286,7 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
         // Serve landing page for root domain access
         if target_host == "@LANDING" {
             info!("GET {} => LANDING 200", host_header);
+            self.metrics.record_status(200);
             return Ok(Response::builder()
                 .status(StatusCode::OK)
                 .header("Content-Type", "text/html; charset=utf-8")
@@ -408,6 +420,7 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
         // Handle WebSocket upgrade requests
         if hyper_tungstenite::is_upgrade_request(&req) {
+            self.metrics.websocket_upgrades_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
             return self
                 .handle_websocket_upgrade(req, &target_host, &new_host)
                 .await;
@@ -457,6 +470,7 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     original_uri,
                     status.as_u16()
                 );
+                self.metrics.record_status(status.as_u16());
                 // Convert the response body back to BoxBody
                 let (parts, body) = response.into_parts();
                 let boxed_body = body.map_err(|e| e).boxed();
@@ -471,6 +485,8 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     original_uri,
                     e
                 );
+                self.metrics.upstream_connect_failures_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                self.metrics.record_status(502);
                 Ok(Response::builder()
                     .status(StatusCode::BAD_GATEWAY)
                     .header("Content-Type", "text/plain")
@@ -484,6 +500,8 @@ npx fbi-proxy -d fbi.example.com  # Only accept *.fbi.example.com</pre>
                     target_host,
                     original_uri
                 );
+                self.metrics.upstream_timeouts_total.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                self.metrics.record_status(502);
                 Ok(Response::builder()
                     .status(StatusCode::BAD_GATEWAY)
                     .header("Content-Type", "text/plain")
@@ -631,6 +649,50 @@ fn load_routes(yaml_src: &str, source_label: &str) -> Vec<CompiledRoute> {
     }
 }
+/// Run a tiny HTTP server on 127.0.0.1:{port} that responds to
+/// `GET /metrics` with the current counters in Prometheus text format.
+/// All other paths return 404. The endpoint binds loopback-only so
+/// metrics aren't exposed via the user-facing proxy port.
+async fn serve_metrics(
+    metrics: Arc<Metrics>,
+    port: u16,
+) -> Result<(), BoxError> {
+    let addr: SocketAddr = format!("127.0.0.1:{}", port).parse()?;
+    let listener = TcpListener::bind(addr).await?;
+    info!("[metrics] listening on http://{}/metrics", addr);
+    println!("[metrics] listening on http://{}/metrics", addr);
+    loop {
+        let (stream, _) = listener.accept().await?;
+        let metrics = Arc::clone(&metrics);
+        let io = TokioIo::new(stream);
+        tokio::spawn(async move {
+            let service = service_fn(move |req: Request<Incoming>| {
+                let metrics = Arc::clone(&metrics);
+                async move {
+                    let resp = if req.uri().path() == "/metrics" {
+                        let body = metrics.render_prometheus();
+                        Response::builder()
+                            .status(StatusCode::OK)
+                            .header("Content-Type", "text/plain; version=0.0.4")
+                            .body(Full::new(Bytes::from(body)).map_err(|e| match e {}).boxed())
+                            .unwrap()
+                    } else {
+                        Response::builder()
+                            .status(StatusCode::NOT_FOUND)
+                            .body(Full::new(Bytes::from("not found")).map_err(|e| match e {}).boxed())
+                            .unwrap()
+                    };
+                    Ok::<_, Infallible>(resp)
+                }
+            });
+            if let Err(e) = http1::Builder::new().serve_connection(io, service).await {
+                error!("[metrics] connection error: {}", e);
+            }
+        });
+    }
+}
 /// Parse + compile a routes file without panicking. Returns Err with a
 /// human-readable message on any failure. Used by the hot-reload path
 /// where we want to log + keep current rules rather than crash.
@@ -740,6 +802,25 @@ pub async fn start_proxy_server(
         spawn_routes_watcher(path, proxy.routes_handle());
     }
+    // Metrics: when FBI_PROXY_METRICS_PORT is set, expose a 127.0.0.1-bound
+    // Prometheus-text endpoint at /metrics on that port. Off by default —
+    // never exposed on the proxy's user-traffic port.
+    if let Ok(metrics_port_str) = std::env::var("FBI_PROXY_METRICS_PORT") {
+        if let Ok(metrics_port) = metrics_port_str.parse::<u16>() {
+            let metrics = proxy.metrics_handle();
+            tokio::spawn(async move {
+                if let Err(e) = serve_metrics(metrics, metrics_port).await {
+                    error!("[metrics] server exited: {}", e);
+                }
+            });
+        } else {
+            warn!(
+                "[metrics] FBI_PROXY_METRICS_PORT='{}' is not a valid port number; metrics disabled",
+                metrics_port_str
+            );
+        }
+    }
     let listener = TcpListener::bind(addr).await?;
     info!("FBI Proxy server running on http://{}", addr);

package/rs/lib.rs CHANGED Viewed

@@ -1,12 +1,7 @@
 //! Library entry point for `fbi-proxy`.
 //!
-//! This file exists primarily so that internal modules (like `routes`)
-//! can be unit-tested via `cargo test --lib` without coupling them to
-//! the binary's runtime concerns.
-//!
-//! The binary in `rs/fbi-proxy.rs` does not currently depend on this
-//! library — the routing engine is intentionally not wired into the
-//! live request path yet (see `docs/routing.md` for the migration
-//! plan).
+//! Exposes internal modules so they can be unit-tested via
+//! `cargo test --lib` and reused by the binary in `rs/fbi-proxy.rs`.
+pub mod metrics;
 pub mod routes;

package/rs/metrics.rs ADDED Viewed

@@ -0,0 +1,111 @@
+//! Simple Prometheus-text metrics for fbi-proxy.
+//!
+//! Tiny counter set, no external prom_client dep — `fmt::Write` is
+//! enough. The counters are atomic so they can be incremented from any
+//! request task without locks; the renderer reads them with `Ordering::
+//! Relaxed` (monotonic counters, dirty reads are fine).
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Arc;
+#[derive(Default)]
+pub struct Metrics {
+    pub requests_total: AtomicU64,
+    pub status_2xx_total: AtomicU64,
+    pub status_3xx_total: AtomicU64,
+    pub status_4xx_total: AtomicU64,
+    pub status_5xx_total: AtomicU64,
+    pub upstream_connect_failures_total: AtomicU64,
+    pub upstream_timeouts_total: AtomicU64,
+    pub websocket_upgrades_total: AtomicU64,
+    pub host_rejected_total: AtomicU64,
+}
+impl Metrics {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self::default())
+    }
+    pub fn record_status(&self, status: u16) {
+        self.requests_total.fetch_add(1, Ordering::Relaxed);
+        let bucket = match status {
+            200..=299 => &self.status_2xx_total,
+            300..=399 => &self.status_3xx_total,
+            400..=499 => &self.status_4xx_total,
+            500..=599 => &self.status_5xx_total,
+            _ => return, // other status codes (1xx, etc.) — ignore for now
+        };
+        bucket.fetch_add(1, Ordering::Relaxed);
+    }
+    pub fn render_prometheus(&self) -> String {
+        let mut out = String::with_capacity(1024);
+        emit_counter(&mut out, "fbi_proxy_requests_total",
+            "Total HTTP requests handled by fbi-proxy.",
+            self.requests_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_2xx_total",
+            "HTTP responses with status 2xx.",
+            self.status_2xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_3xx_total",
+            "HTTP responses with status 3xx.",
+            self.status_3xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_4xx_total",
+            "HTTP responses with status 4xx.",
+            self.status_4xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_status_5xx_total",
+            "HTTP responses with status 5xx.",
+            self.status_5xx_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_upstream_connect_failures_total",
+            "Failed TCP/TLS connects to upstream.",
+            self.upstream_connect_failures_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_upstream_timeouts_total",
+            "Upstream requests that exceeded the request timeout.",
+            self.upstream_timeouts_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_websocket_upgrades_total",
+            "WebSocket upgrade requests handled.",
+            self.websocket_upgrades_total.load(Ordering::Relaxed));
+        emit_counter(&mut out, "fbi_proxy_host_rejected_total",
+            "Requests rejected because the Host header didn't match the domain filter or any route.",
+            self.host_rejected_total.load(Ordering::Relaxed));
+        out
+    }
+}
+fn emit_counter(out: &mut String, name: &str, help: &str, value: u64) {
+    use std::fmt::Write;
+    let _ = writeln!(out, "# HELP {} {}", name, help);
+    let _ = writeln!(out, "# TYPE {} counter", name);
+    let _ = writeln!(out, "{} {}", name, value);
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn record_status_routes_to_correct_bucket() {
+        let m = Metrics::new();
+        m.record_status(200);
+        m.record_status(204);
+        m.record_status(302);
+        m.record_status(404);
+        m.record_status(502);
+        m.record_status(502);
+        assert_eq!(m.requests_total.load(Ordering::Relaxed), 6);
+        assert_eq!(m.status_2xx_total.load(Ordering::Relaxed), 2);
+        assert_eq!(m.status_3xx_total.load(Ordering::Relaxed), 1);
+        assert_eq!(m.status_4xx_total.load(Ordering::Relaxed), 1);
+        assert_eq!(m.status_5xx_total.load(Ordering::Relaxed), 2);
+    }
+    #[test]
+    fn render_includes_help_and_type_lines() {
+        let m = Metrics::new();
+        m.record_status(200);
+        let out = m.render_prometheus();
+        assert!(out.contains("# HELP fbi_proxy_requests_total"));
+        assert!(out.contains("# TYPE fbi_proxy_requests_total counter"));
+        assert!(out.contains("fbi_proxy_requests_total 1\n"));
+        assert!(out.contains("fbi_proxy_status_2xx_total 1\n"));
+    }
+}