feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.

debian-package/src/usr/lib/vpn-router/web

@@ -18,8 +18,11 @@ Pages:
   /account the account of the signed-in user: its details, its password and its TOTP
            enrolment (see account())
   /auth    sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
+  /metrics/history
+           the metrics the metrics service keeps, for a view: hour, day, month or year (see
+           metrics_history())
 
-/config, /users, /groups and /account need an HS256 JWT in an Authorization: Bearer header signed
+/config, /metrics/history, /users, /groups and /account need an HS256 JWT in an Authorization: Bearer header signed
 with vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names a user in sub;
 /account serves that user, and the other paths need a member of vpnrouter_users.ADMIN_GROUP. A
 token of vpn-router-token has the admin claim and names no user; it may call every path but
@@ -57,10 +60,10 @@ import collections
 import json
 import os
 import signal
-import subprocess
 import sys
 import threading
 import time
+import urllib.parse
 from html import escape
 from http.server import BaseHTTPRequestHandler
 
@@ -70,9 +73,11 @@ import ldap
 
 import vpnrouter
 import vpnrouter_auth
+import vpnrouter_metrics
 import vpnrouter_net
 import vpnrouter_serve
 import vpnrouter_users
+from vpnrouter_status import established, openvpn_clients, run, swanctl, wireguard_peers
 
 STATE_FILE = '/run/vpn-router/web.json'
 CONFIG_FILE = '/etc/vpn-router/vpn-router.json'
@@ -85,7 +90,6 @@ DEFAULT_PORT = 7081
 
 #: Seconds between two discoveries of where the service should listen.
 DISCOVERY_SECONDS = 30
-COMMAND_TIMEOUT = 5
 CACHE_SECONDS = 2
 
 #: The calls of /auth allowed per client address in AUTH_WINDOW seconds.
@@ -97,8 +101,6 @@ TAILWIND = 'https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4'
 #: Seconds after which the status page in a browser reloads itself.
 REFRESH_SECONDS = 60
 
-OPENVPN_STATUS = '/run/openvpn-server/status-vpn-router.log'
-
 #: The largest request body accepted, in bytes.
 BODY_LIMIT = 4096
 
@@ -138,14 +140,6 @@ def current():
     return dict(read_json(STATE_FILE), key=vpnrouter_auth.key())
 
 
-def run(*args):
-    """The finished process of a command, or None when it cannot be run."""
-    try:
-        return subprocess.run(args, capture_output=True, text=True, timeout=COMMAND_TIMEOUT)
-    except (OSError, subprocess.TimeoutExpired):
-        return None
-
-
 def unit_state(unit):
     result = run('systemctl', 'is-active', unit)
     return result.stdout.strip() if result and result.stdout.strip() else 'unknown'
@@ -169,85 +163,6 @@ def docker_status():
     }
 
 
-def swanctl(command):
-    """The entries of a swanctl list command, or None when swanctl cannot be asked.
-
-    The --pretty output has one item per line: "name {" opens a section, "key = [" a list
-    whose items follow one per line, "}" and "]" close them, and "key = value" is a pair
-    whose value may contain spaces. Every "... event {" section at the top holds one
-    connection or SA; each becomes an entry with its name under "name". The closing
-    "... reply {" section is left out. Values stay strings, as swanctl prints them.
-    Output with more closing than opening lines gives None.
-    """
-    result = run('swanctl', command, '--pretty')
-    if result is None or result.returncode != 0:
-        return None
-    events = []
-    stack = []
-    for line in result.stdout.splitlines():
-        line = line.strip()
-        if not line:
-            continue
-        if line in ('}', ']'):
-            if not stack:
-                return None
-            stack.pop()
-        elif not stack:
-            section = {}
-            if line.endswith(' event {'):
-                events.append(section)
-            stack.append(section)
-        elif isinstance(stack[-1], list):
-            stack[-1].append(line)
-        elif line.endswith(' {'):
-            stack[-1][line[:-2]] = section = {}
-            stack.append(section)
-        elif line.endswith(' = ['):
-            stack[-1][line[:-4]] = items = []
-            stack.append(items)
-        else:
-            key, _, value = line.partition(' = ')
-            stack[-1][key] = value
-    return [dict(body, name=name) for event in events for name, body in event.items()]
-
-
-def established(connection):
-    """The number of established IKE SAs of the connection, or None when swanctl cannot be asked."""
-    sas = swanctl('--list-sas')
-    if sas is None:
-        return None
-    return sum(1 for sa in sas if sa['name'] == connection and sa.get('state') == 'ESTABLISHED')
-
-
-def wireguard_peers():
-    """One entry per WireGuard peer, with its handshake age and traffic, or None when wg0 is down."""
-    result = run('wg', 'show', 'wg0', 'dump')
-    if result is None or result.returncode != 0:
-        return None
-    now = int(time.time())
-    peers = []
-    for line in result.stdout.splitlines()[1:]:
-        fields = line.split('\t')
-        if len(fields) < 7:
-            continue
-        handshake = int(fields[4])
-        peers.append({
-            'handshake_seconds_ago': now - handshake if handshake else None,
-            'received_bytes': int(fields[5]),
-            'sent_bytes': int(fields[6]),
-        })
-    return peers
-
-
-def openvpn_clients():
-    """The number of connected OpenVPN clients, from the server's status file, or None when it cannot be read."""
-    try:
-        with open(OPENVPN_STATUS, encoding='utf-8') as handle:
-            return sum(1 for line in handle if line.startswith('CLIENT_LIST,'))
-    except OSError:
-        return None
-
-
 def postgresql_clusters():
     """The state of each PostgreSQL cluster unit (postgresql@<version>-<name>), or {'postgresql': 'no cluster'} without one.
 
@@ -453,7 +368,7 @@ def users(state, method, path, body):
 
       GET    /users                   the users
       POST   /users                   add a user: {"name", "password", "first_name", "last_name", "email"};
-                                      without the last three a Manager-only account
+                                      without the names a Manager-only account
       PUT    /users/<name>            change any of {"first_name", "last_name", "email"}
       PUT    /users/<name>/password   set the password: {"password": ...}
       POST   /users/<name>/disable    lock the user out of OpenVPN
@@ -593,6 +508,22 @@ def account(name, method, path, body):
     return 200, document
 
 
+def metrics_history(view):
+    """Answer GET /metrics/history?range=<view> with vpnrouter_metrics.history: the HTTP status and the JSON document.
+
+    view is hour, the default, day, month or year (vpnrouter_metrics.RANGES).
+    """
+    if view not in vpnrouter_metrics.RANGES:
+        return 400, {'error': f'range must be one of {", ".join(vpnrouter_metrics.RANGES)}'}
+    try:
+        with vpnrouter_metrics.database(vpnrouter.load_config()) as connection:
+            return 200, vpnrouter_metrics.history(connection, view)
+    except vpnrouter_metrics.DatabaseError as exc:
+        return 500, {'error': str(exc)}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+
+
 def changes_admins(connection, method, parts, body):
     """Whether a /users or /groups request creates, renames to, changes or removes ADMIN_GROUP, or removes a member of it."""
     admins = vpnrouter_users.ADMIN_GROUP
@@ -638,6 +569,9 @@ def auth(path, body):
         cfg = vpnrouter.load_config()
         if path == '/auth':
             vpnrouter_users.login(body.get('name'), body.get('password'), body.get('code'))
+            with vpnrouter_users.session() as connection:
+                if vpnrouter_users.service(vpnrouter_users.entry(connection, body['name'])):
+                    raise vpnrouter_users.Failure('the name, the password or the code is wrong', 5)
             return 200, vpnrouter_auth.issue(cfg, body['name'])
         name = vpnrouter_auth.take(cfg, body.get('refresh_token'))
         if path == '/auth/logout':
@@ -714,7 +648,7 @@ class Handler(BaseHTTPRequestHandler):
         if self.command not in ('GET', 'HEAD'):
             self.close_connection = True
         directory = next((name for name in ('users', 'groups', 'account') if path == f'/{name}' or path.startswith(f'/{name}/')), None)
-        protected = path == '/config' or directory is not None
+        protected = path in ('/config', '/metrics/history') or directory is not None
         signing = path in ('/auth', '/auth/refresh', '/auth/logout')
         state = current() if protected or signing else {}
         claims = self.claims(state['key']) if protected and state['key'] else None
@@ -741,10 +675,14 @@ class Handler(BaseHTTPRequestHandler):
             body = json.dumps({'error': refused[1]}, indent=2).encode() + b'\n'
         elif path == '/config' and self.command in ('GET', 'HEAD'):
             body, kind, code = json.dumps(details(state), indent=2).encode() + b'\n', 'application/json', 200
+        elif path == '/metrics/history' and self.command in ('GET', 'HEAD'):
+            query = urllib.parse.parse_qs(urllib.parse.urlsplit(self.path).query)
+            code, document = metrics_history(query.get('range', ['hour'])[0])
+            body, kind = json.dumps(document).encode() + b'\n', 'application/json'
         elif directory == 'account':
             code, document = account(claims['sub'], self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
-        elif protected and path != '/config':
+        elif directory is not None:
             code, document = (users if directory == 'users' else groups)(state, self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif self.command not in ('GET', 'HEAD'):