Prometheus metrics on their own listener, as the "Metrics endpoint" section of SPEC.md (#9) describes, including the requests the country lists refuse, by country, which sneak asked to have in metrics (#8 (comment)). Until then milestone 2 counts those refusals in the request log.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Prometheus metrics on their own listener, as the "Metrics endpoint" section of `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describes, including the requests the country lists refuse, by country, which sneak asked to have in metrics (https://git.eeqj.de/sneak/smallwebwaf/issues/8#issuecomment-102697). Until then milestone 2 counts those refusals in the request log.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts the metrics endpoint in the first stage after milestone 2, so it is built after the state files (#17 and #68), as "Metrics endpoint" and "Admin endpoints" describe, with the metrics for what exists by then. Metrics for later features (rule files, the Core Rule Set, reputation, alerts, remote logging, AS numbers) come with those features.
GET /_smallwebwaf/metrics in the Prometheus text format, through the widely used Prometheus Go client. SWWAF_METRICS_TOKEN (unset by default, which switches the metrics off; one shorter than 32 characters stops the start) and SWWAF_METRICS_TOP_N (default 50).
As "Admin endpoints" says: the request goes through every check other requests go through and is answered where it would be forwarded; a missing or wrong token gets 401; while the token is unset the path answers 404, as does any other path under /_smallwebwaf/ that smallwebwaf does not answer. Such requests no longer reach the app.
Metrics: requests and bytes in and out by status class and action; request and upstream duration histograms; requests in flight; limit hits by window; size and time limit hits by limit; offences by kind; bans made by cause, permanent bans, active bans; requests refused by the country lists, by country, and requests and bytes by country, both limited to the SWWAF_METRICS_TOP_N busiest with the rest as other; GeoJS requests and failures and clients counted unknown because it did not answer in time; tracked clients; state file writes, write failures, last successful write time and size per file, files read again after an edit and edits set aside; the standard Go runtime and process metrics. No metric carries a client address.
README.md documents both settings and the metrics.
Definition of done: tests show the endpoint off by default, 401 and 404 as above, a short token stopping the start, each metric family moving when its event happens, the other folding at SWWAF_METRICS_TOP_N, and that a banned client stays refused at the endpoint; make check green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts the metrics endpoint in the first stage after milestone 2, so it is built after the state files (https://git.eeqj.de/sneak/smallwebwaf/issues/17 and https://git.eeqj.de/sneak/smallwebwaf/issues/68), as "Metrics endpoint" and "Admin endpoints" describe, with the metrics for what exists by then. Metrics for later features (rule files, the Core Rule Set, reputation, alerts, remote logging, AS numbers) come with those features.
- `GET /_smallwebwaf/metrics` in the Prometheus text format, through the widely used Prometheus Go client. `SWWAF_METRICS_TOKEN` (unset by default, which switches the metrics off; one shorter than 32 characters stops the start) and `SWWAF_METRICS_TOP_N` (default `50`).
- As "Admin endpoints" says: the request goes through every check other requests go through and is answered where it would be forwarded; a missing or wrong token gets `401`; while the token is unset the path answers `404`, as does any other path under `/_smallwebwaf/` that `smallwebwaf` does not answer. Such requests no longer reach the app.
- Metrics: requests and bytes in and out by status class and `action`; request and upstream duration histograms; requests in flight; limit hits by window; size and time limit hits by limit; offences by kind; bans made by cause, permanent bans, active bans; requests refused by the country lists, by country, and requests and bytes by country, both limited to the `SWWAF_METRICS_TOP_N` busiest with the rest as `other`; GeoJS requests and failures and clients counted unknown because it did not answer in time; tracked clients; state file writes, write failures, last successful write time and size per file, files read again after an edit and edits set aside; the standard Go runtime and process metrics. No metric carries a client address.
- `README.md` documents both settings and the metrics.
Definition of done: tests show the endpoint off by default, `401` and `404` as above, a short token stopping the start, each metric family moving when its event happens, the `other` folding at `SWWAF_METRICS_TOP_N`, and that a banned client stays refused at the endpoint; `make check` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
self-assigned this 2026-10-06 05:32:41 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Prometheus metrics on their own listener, as the "Metrics endpoint" section of
SPEC.md(#9) describes, including the requests the country lists refuse, by country, which sneak asked to have in metrics (#8 (comment)). Until then milestone 2 counts those refusals in the request log.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs the metrics endpoint in the first stage after milestone 2, so it is built after the state files (#17 and #68), as "Metrics endpoint" and "Admin endpoints" describe, with the metrics for what exists by then. Metrics for later features (rule files, the Core Rule Set, reputation, alerts, remote logging, AS numbers) come with those features.GET /_smallwebwaf/metricsin the Prometheus text format, through the widely used Prometheus Go client.SWWAF_METRICS_TOKEN(unset by default, which switches the metrics off; one shorter than 32 characters stops the start) andSWWAF_METRICS_TOP_N(default50).401; while the token is unset the path answers404, as does any other path under/_smallwebwaf/thatsmallwebwafdoes not answer. Such requests no longer reach the app.action; request and upstream duration histograms; requests in flight; limit hits by window; size and time limit hits by limit; offences by kind; bans made by cause, permanent bans, active bans; requests refused by the country lists, by country, and requests and bytes by country, both limited to theSWWAF_METRICS_TOP_Nbusiest with the rest asother; GeoJS requests and failures and clients counted unknown because it did not answer in time; tracked clients; state file writes, write failures, last successful write time and size per file, files read again after an edit and edits set aside; the standard Go runtime and process metrics. No metric carries a client address.README.mddocuments both settings and the metrics.Definition of done: tests show the endpoint off by default,
401and404as above, a short token stopping the start, each metric family moving when its event happens, theotherfolding atSWWAF_METRICS_TOP_N, and that a banned client stays refused at the endpoint;make checkgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Built in #76. Model: opus-5-5
clawbot referenced this issue2026-10-06 11:40:45 +02:00