Summary
Add an optional HTTP server exposing Prometheus metrics and Kubernetes-friendly health endpoints.
Caddy already provides application/server metrics, but caddy-analyzer can expose security-specific operational metrics that Caddy itself does not provide.
Proposed CLI
caddy-analyze guard --metrics-listen :9090
Possible endpoints:
GET /metrics
GET /healthz
GET /readyz
Proposed Metrics
caddy_analyzer_requests_total
caddy_analyzer_detections_total{
category="sql_injection"
}
caddy_analyzer_guard_blocks_total{
reason="scanner"
}
caddy_analyzer_guard_blocked_ips
caddy_analyzer_suppressed_detections_total{
category="sql_injection"
}
caddy_analyzer_guard_errors_total
caddy_analyzer_rule_matches_total{
rule="SQLI-0042"
}
Health Endpoints
/healthz
Should indicate whether the process is alive.
/readyz
Should validate that required runtime dependencies are operational, for example:
- log source can be read;
- Guard state can be accessed;
- firewall backend is available when Guard is enabled;
- rule configuration is valid.
Security
The metrics endpoint should listen on localhost by default unless explicitly configured otherwise.
Optional support:
--metrics-listen 127.0.0.1:9090
Acceptance Criteria
Summary
Add an optional HTTP server exposing Prometheus metrics and Kubernetes-friendly health endpoints.
Caddy already provides application/server metrics, but caddy-analyzer can expose security-specific operational metrics that Caddy itself does not provide.
Proposed CLI
Possible endpoints:
Proposed Metrics
Health Endpoints
/healthzShould indicate whether the process is alive.
/readyzShould validate that required runtime dependencies are operational, for example:
Security
The metrics endpoint should listen on localhost by default unless explicitly configured otherwise.
Optional support:
Acceptance Criteria
/metricsexposes Prometheus-compatible metrics./healthzreturns process health./readyzperforms basic readiness checks.