feat: add metricsServer for health checks, metrics and pprof (#5578)

Add a separate HTTP listener for observability, configured through metricsServer in both frps and frpc. It serves /healthz and, when pprofEnable is set, the pprof handlers except /debug/pprof/cmdline. It never serves the dashboard, static assets or the admin API, and it does not touch the global assets filesystem. frps also serves /metrics on this listener with both runtime and business metrics, enabled by metricsServer.port alone. The in-memory collector still starts only with the dashboard, and the Prometheus collector starts either with metricsServer or with enablePrometheus plus webServer, so a configuration that collected nothing before still collects nothing. The /healthz, /metrics and pprof endpoints on webServer, and enablePrometheus, keep working but are deprecated and log a hint at startup. frpc does not serve /metrics yet.
2026-10-19 20:08:39 +08:00
parent 00e4fc4dd3
commit f13fdd58d4
20 changed files with 858 additions and 27 deletions
@@ -0,0 +1,54 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http
+
+import (
+	"net/http"
+	"net/http/pprof"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+)
+
+// NewMetricsServer creates a listener with only health, optional metrics, and
+// opt-in profiling endpoints. A zero port disables it and returns a nil server.
+func NewMetricsServer(cfg v1.MetricsServerConfig, metricsHandler http.Handler) (*Server, error) {
+	if cfg.Port == 0 {
+		return nil, nil
+	}
+	s, err := newServer(cfg.Addr, cfg.Port, cfg.User, cfg.Password, cfg.TLS)
+	if err != nil {
+		return nil, err
+	}
+	s.router.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	authed := s.router.NewRoute().Subrouter()
+	authed.Use(s.authMiddleware)
+	if metricsHandler != nil {
+		authed.Handle("/metrics", metricsHandler)
+	}
+	if cfg.PprofEnable {
+		// Use exact routes rather than a prefix so cmdline and unknown endpoints
+		// cannot reach pprof.Index's fallback dispatch.
+		authed.HandleFunc("/debug/pprof/", pprof.Index)
+		authed.HandleFunc("/debug/pprof/profile", pprof.Profile)
+		authed.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+		authed.HandleFunc("/debug/pprof/trace", pprof.Trace)
+		for _, name := range []string{"allocs", "block", "goroutine", "heap", "mutex", "threadcreate"} {
+			authed.Handle("/debug/pprof/"+name, pprof.Handler(name))
+		}
+	}
+	return s, nil
+}
@@ -0,0 +1,111 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http
+
+import (
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/assets"
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+)
+
+func newTestMetricsServer(t *testing.T, pprofEnabled bool, handler http.Handler) *Server {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	port := ln.Addr().(*net.TCPAddr).Port
+	require.NoError(t, ln.Close())
+	s, err := NewMetricsServer(v1.MetricsServerConfig{
+		Addr: "127.0.0.1", Port: port, User: "monitor", Password: "secret", PprofEnable: pprofEnabled,
+	}, handler)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, s.Close()) })
+	return s
+}
+
+func TestMetricsServerRoutes(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		name := "pprof disabled"
+		if enabled {
+			name = "pprof enabled"
+		}
+		t.Run(name, func(t *testing.T) {
+			calls := 0
+			s := newTestMetricsServer(t, enabled, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				calls++
+				_, _ = w.Write([]byte("business metrics"))
+			}))
+			for _, authed := range []bool{false, true} {
+				for _, path := range []string{
+					"/healthz", "/metrics", "/debug/pprof/", "/debug/pprof/goroutine",
+					"/debug/pprof/cmdline", "/debug/pprof/unknown", "/", "/static/app.js", "/api/serverinfo", "/api/config",
+				} {
+					req := httptest.NewRequest(http.MethodGet, path, nil)
+					if authed {
+						req.SetBasicAuth("monitor", "secret")
+					}
+					resp := httptest.NewRecorder()
+					s.router.ServeHTTP(resp, req)
+					expected := http.StatusNotFound
+					switch path {
+					case "/healthz":
+						expected = http.StatusOK
+						require.Empty(t, resp.Body.String())
+					case "/metrics":
+						expected = http.StatusUnauthorized
+						if authed {
+							expected = http.StatusOK
+							require.Equal(t, "business metrics", resp.Body.String())
+						}
+					case "/debug/pprof/", "/debug/pprof/goroutine":
+						if enabled {
+							expected = http.StatusUnauthorized
+							if authed {
+								expected = http.StatusOK
+							}
+						}
+					}
+					require.Equal(t, expected, resp.Code, "path=%s authenticated=%v", path, authed)
+				}
+			}
+			require.Equal(t, 1, calls, "unauthenticated requests must not reach the metrics handler")
+		})
+	}
+}
+
+func TestMetricsServerWithoutMetricsPreservesAssets(t *testing.T) {
+	assets.Load(t.TempDir())
+	before := assets.FileSystem
+	t.Cleanup(func() { assets.Load("") })
+	s := newTestMetricsServer(t, false, nil)
+	// assets.Load uses http.Dir for local assets, a value rather than a pointer.
+	require.Equal(t, before, assets.FileSystem)
+	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	req.SetBasicAuth("monitor", "secret")
+	resp := httptest.NewRecorder()
+	s.router.ServeHTTP(resp, req)
+	require.Equal(t, http.StatusNotFound, resp.Code)
+}
+
+func TestMetricsServerDisabled(t *testing.T) {
+	s, err := NewMetricsServer(v1.MetricsServerConfig{TLS: &v1.TLSConfig{CertFile: "nonexistent"}}, nil)
+	require.NoError(t, err)
+	require.Nil(t, s)
+}
@@ -48,7 +48,18 @@ type Server struct {
 func NewServer(cfg v1.WebServerConfig) (*Server, error) {
 	assets.Load(cfg.AssetsDir)

-	addr := net.JoinHostPort(cfg.Addr, strconv.Itoa(cfg.Port))
+	s, err := newServer(cfg.Addr, cfg.Port, cfg.User, cfg.Password, cfg.TLS)
+	if err != nil {
+		return nil, err
+	}
+	if cfg.PprofEnable {
+		s.registerPprofHandlers()
+	}
+	return s, nil
+}
+
+func newServer(bindAddr string, port int, user, password string, tlsConfig *v1.TLSConfig) (*Server, error) {
+	addr := net.JoinHostPort(bindAddr, strconv.Itoa(port))
 	if addr == ":" {
 		addr = ":http"
 	}
@@ -65,11 +76,8 @@ func NewServer(cfg v1.WebServerConfig) (*Server, error) {
 		hs:     hs,
 		router: router,
 	}
-	if cfg.PprofEnable {
-		s.registerPprofHandlers()
-	}
-	if cfg.TLS != nil {
-		cert, err := tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile)
+	if tlsConfig != nil {
+		cert, err := tls.LoadX509KeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)
 		if err != nil {
 			return nil, err
 		}
@@ -77,7 +85,7 @@ func NewServer(cfg v1.WebServerConfig) (*Server, error) {
 			Certificates: []tls.Certificate{cert},
 		}
 	}
-	s.authMiddleware = netpkg.NewHTTPAuthMiddleware(cfg.User, cfg.Password).SetAuthFailDelay(200 * time.Millisecond).Middleware
+	s.authMiddleware = netpkg.NewHTTPAuthMiddleware(user, password).SetAuthFailDelay(200 * time.Millisecond).Middleware

 	// Bind only after all fallible preparation so an error cannot leak the listener.
 	ln, err := net.Listen("tcp", addr)