From 55a99d53deb51fd9f5c55233a22910541a2037a0 Mon Sep 17 00:00:00 2001 From: Ananth Date: Sat, 4 Jul 2026 08:11:03 +0000 Subject: [PATCH 1/4] docs(metrics): fix certificate metric names --- README.md | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 7c8a0fe..d9bc5c0 100644 --- a/README.md +++ b/README.md @@ -87,34 +87,38 @@ Certificate files must be named after the domain (e.g., `/etc/haproxy/certs/exam ## Metrics -Certificatee exposes Prometheus metrics for monitoring: +Certificator and certificatee expose Prometheus metrics for monitoring: -- `GET /metrics` exposes Prometheus metrics. -- `GET /health` returns `200 OK` when the process can still reach Vault and at least one HAProxy Data Plane API endpoint has completed a recent v3 runtime certificate sync probe. Non-v3 endpoints are skipped and reported via metrics and logs. +- `GET /metrics` exposes Prometheus metrics when `METRICS_LISTEN_ADDRESS` is set. +- `GET /health` returns `200 OK` when the process health check passes. For certificatee, health requires Vault reachability and at least one recent successful HAProxy Data Plane API v3 runtime certificate sync probe. Non-v3 endpoints are skipped and reported via metrics and logs. -### General Metrics +### Shared Metrics | Metric | Type | Labels | Description | |--------|------|--------|-------------| -| `up` | Gauge | service, version, hostname, environment | Indicates if the service is running (1=up, 0=down) | -| `certificatee_certificates_updated_on_disk_total` | Gauge | domain | Certificates updated successfully | -| `certificatee_certificates_update_failures_total` | Counter | domain | Certificate update failures | +| `up` | Gauge | `service`, `version`, `hostname`, `environment` | Indicates if the service is running (`1` = up, `0` = down) | -### HAProxy-Specific Metrics +### Certificator Metrics | Metric | Type | Labels | Description | |--------|------|--------|-------------| -| `certificatee_dataplaneapi_version` | Gauge | endpoint, version | Detected HAProxy Data Plane API version for certificatee endpoints. `version` is `v2` or `v3`; the detected version is set to 1 and the other version is set to 0 | -| `certificatee_certificate_not_after_timestamp_seconds` | Gauge | endpoint, domain | Live certificate expiry reported by the HAProxy Data Plane API runtime endpoint | -| `certificatee_certificate_metadata_lookup_failures_total` | Counter | endpoint, domain | Per-certificate DPAPI runtime metadata lookups that failed | -| `certificatee_haproxy_connections_total` | Counter | endpoint, status | Total connection attempts (status: success/failure) | -| `certificatee_haproxy_connection_retries_total` | Counter | endpoint | Connection retry attempts | -| `certificatee_haproxy_certificates_checked_total` | Counter | endpoint | Certificates checked per endpoint | -| `certificatee_haproxy_certificates_updated_total` | Counter | endpoint, domain | Certificates updated per endpoint/domain | -| `certificatee_haproxy_last_check_timestamp_seconds` | Gauge | endpoint | Unix timestamp of last successful check | -| `certificatee_haproxy_command_duration_seconds` | Histogram | endpoint, command | Duration of HAProxy Data Plane API requests | - -Not an exhaustive list; refer to the source code for all metrics. +| `certificator_certificates_renewed_total` | Counter | `domain` | Certificates renewed successfully | +| `certificator_certificates_renewal_failures_total` | Counter | `domain` | Certificate renewal failures | +| `certificator_certificates_checked_total` | Counter | `domain`, `status` | Certificate checks by result status | + +### Certificatee Metrics + +| Metric | Type | Labels | Description | +|--------|------|--------|-------------| +| `certificatee_certificates_updated_total` | Counter | `endpoint`, `domain` | Certificates updated successfully in HAProxy | +| `certificatee_certificates_update_failures_total` | Counter | `endpoint`, `domain` | Certificate update failures | +| `certificatee_certificates_expiring` | Gauge | `endpoint` | Number of certificates expiring within the renewal threshold | +| `certificatee_certificates_total` | Gauge | `endpoint` | Total number of certificates managed per endpoint | +| `certificatee_certificates_wildcard_total` | Gauge | `endpoint` | Number of certificates with wildcard storage filenames | +| `certificatee_certificate_not_after_timestamp_seconds` | Gauge | `endpoint`, `domain` | Live certificate expiry reported by the HAProxy Data Plane API runtime endpoint | +| `certificatee_certificate_metadata_lookup_failures_total` | Counter | `endpoint`, `domain` | Per-certificate Data Plane API runtime metadata lookups that failed | +| `certificatee_dataplaneapi_version` | Gauge | `endpoint`, `version` | Detected HAProxy Data Plane API version for certificatee endpoints (`1` = detected version) | +| `certificatee_last_sync_timestamp_seconds` | Gauge | `endpoint` | Unix timestamp of the last successful endpoint sync | ## Development From a17ba9e15cb03ff6bf45734aa74a158e7aa0232f Mon Sep 17 00:00:00 2001 From: Ananth Date: Sat, 4 Jul 2026 08:31:18 +0000 Subject: [PATCH 2/4] ci(test): remove local binary build --- .github/workflows/test.yml | 3 --- README.md | 9 ++------- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0e31a2a..09b5d51 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -66,6 +66,3 @@ jobs: ``` - - - name: Build Binaries - run: nix develop --command build diff --git a/README.md b/README.md index d9bc5c0..459773b 100644 --- a/README.md +++ b/README.md @@ -132,20 +132,15 @@ nix develop Or use [direnv](https://direnv.net/) for automatic shell activation. -You can also just go build stuff without Nix. - ### Running Tests ```bash go test ./... ``` -### Building +### Release Builds -```bash -go build ./cmd/certificatee -go build ./cmd/certificator -``` +Release binaries are built by [`rpcpool/Binaries-ci`](https://github.com/rpcpool/Binaries-ci). The tag workflow in this repository dispatches `build-release.yml` in Binaries-ci; this repository does not build release artifacts directly. ## Architecture From f12c11cf8dca269f05765b15c6f92c8d58ee240e Mon Sep 17 00:00:00 2001 From: Ananth Date: Sat, 4 Jul 2026 08:33:45 +0000 Subject: [PATCH 3/4] ci(test): restore binary build check --- .github/workflows/test.yml | 3 +++ README.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 09b5d51..0e31a2a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -66,3 +66,6 @@ jobs: ``` + + - name: Build Binaries + run: nix develop --command build diff --git a/README.md b/README.md index 459773b..4d7a062 100644 --- a/README.md +++ b/README.md @@ -140,7 +140,7 @@ go test ./... ### Release Builds -Release binaries are built by [`rpcpool/Binaries-ci`](https://github.com/rpcpool/Binaries-ci). The tag workflow in this repository dispatches `build-release.yml` in Binaries-ci; this repository does not build release artifacts directly. +Release binaries are built by [`rpcpool/Binaries-ci`](https://github.com/rpcpool/Binaries-ci). The tag workflow in this repository dispatches `build-release.yml` in Binaries-ci; this repository does not publish release artifacts directly. CI still runs `nix develop --command build` as a compile check. ## Architecture From 054adc5bc2127b4d39ee9ce33622c969f437c18a Mon Sep 17 00:00:00 2001 From: Ananth Date: Sat, 4 Jul 2026 08:38:35 +0000 Subject: [PATCH 4/4] docs(readme): remove internal build note --- README.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4d7a062..020d346 100644 --- a/README.md +++ b/README.md @@ -138,9 +138,14 @@ Or use [direnv](https://direnv.net/) for automatic shell activation. go test ./... ``` -### Release Builds +You can also just go build stuff without Nix. -Release binaries are built by [`rpcpool/Binaries-ci`](https://github.com/rpcpool/Binaries-ci). The tag workflow in this repository dispatches `build-release.yml` in Binaries-ci; this repository does not publish release artifacts directly. CI still runs `nix develop --command build` as a compile check. +### Building + +```bash +go build ./cmd/certificatee +go build ./cmd/certificator +``` ## Architecture