feat: API monitoring #43
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds comprehensive API monitoring capabilities to the Fastify-based template service by integrating Prometheus metrics collection and optional Loki logging.
Key Changes:
- Adds fastify-metrics plugin to expose a
/metricsendpoint for Prometheus scraping with default metrics enabled - Integrates pino-loki transport for optional centralized logging to a Loki server
- Introduces optional
LOKI_HOSTenvironment variable for conditional logging configuration
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| yarn.lock | Adds dependency resolutions for fastify-metrics (v12.1.0), pino-loki (v3.0.0), prom-client (v15.1.3), and their transitive dependencies |
| package.json | Adds fastify-metrics and pino-loki as runtime dependencies |
| src/app.ts | Configures metrics endpoint registration and conditional Loki logging transport based on LOKI_HOST environment variable |
| .env.example | Documents the optional LOKI_HOST environment variable with example configuration |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated 8 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
wylited
force-pushed
the
feat/monitoring
branch
from
3e28de8 to
8860921
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 6 changed files in this pull request and generated 10 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if ( | ||
| request.headers.authorization !== `Bearer ${opts.prometheusKey}` | ||
| ) { |
There was a problem hiding this comment.
The authentication check is vulnerable to timing attacks. Consider using a constant-time comparison function to compare the authorization header with the expected value to prevent attackers from determining the correct key through timing analysis.
There was a problem hiding this comment.
This is okay... I guess.
| // MongoDB URI (Optional) | ||
| // mongoUri: string; | ||
| lokiHost?: string; | ||
| prometheusKey?: string; |
There was a problem hiding this comment.
The variable name "prometheusKey" is misleading as it's actually used as an authentication secret/token. Consider renaming to "prometheusAuthToken" or "prometheusSecret" to better reflect its purpose and security implications.
Co-authored-by: Copilot <[email protected]>
How this monitoring system will work is that each API service will expose a fastify-metrics endpoint at /metrics.
this is a Prometheus scrapable endpoint for our monitoring platform.
Furthermore, if provided, it will fastify will log automatically to a Loki logging server using pino-loki.
The rest of the setup for monitoring will be done on the server.