Observability¶
Prometheus Metrics¶
Metrics are exposed by the auth service at http://auth:9090/metrics (Docker-internal only).
| Metric | Type | Description |
|---|---|---|
packyard_auth_requests_total{status="allowed\|denied\|error"} |
Counter | forwardAuth request outcomes |
packyard_auth_duration_seconds |
Histogram | forwardAuth latency |
Traefik metrics are available at http://localhost:8088/metrics (loopback only).
Accessing metrics locally¶
# Auth service metrics (local stack)
curl -s http://localhost:9090/metrics | grep packyard_auth
# Traefik metrics (via loopback admin entrypoint)
curl -s http://localhost:8088/metrics
Accessing metrics in production¶
Expose to an external monitoring stack via SSH tunnel:
Monitoring checklist¶
| Check | Method | Target |
|---|---|---|
| Endpoint availability | HTTP GET https://pkg.example.org/gpg/lts.asc |
99.9% monthly |
| TLS cert expiry | Alert at ≤ 30 days remaining | — |
| Auth service health | Traefik forwardAuth health check | Fail-closed |