Observability and control plane

Logs and metrics

admin:
  enabled: true
  address: "127.0.0.1:9090"

observability:
  metrics: { enabled: true, address: "127.0.0.1:9091" }
  access_log: { enabled: true }
  log_level: "info,omlb_proxy=info"
  log_format: journald

webui:
  enabled: true
  address: "127.0.0.1:9095"
  token_file: /run/secrets/omlb-webui-token
  capture_logs: true
  log_buffer: 2000
  sample_interval: 2s
  series_len: 300

access_log.enabled controls request logging. log_format supports pretty, newline-delimited json, and journald; journald falls back to pretty when its socket is unavailable. The process log filter is the observability.log_level tracing directive.

Metrics are Prometheus text exposition at /metrics. The dedicated metrics listener and the admin API both expose that path. They accept only loopback bind addresses at runtime, so use a local Prometheus agent or a protected tunnel rather than exposing them publicly.

Admin API

# Local health and live topology
curl http://127.0.0.1:9090/healthz
curl http://127.0.0.1:9090/status

# Prometheus text exposition (also available from the admin listener)
curl http://127.0.0.1:9091/metrics
curl http://127.0.0.1:9090/metrics

# A safe operational action for one known static backend
curl -X POST http://127.0.0.1:9090/pools/api/backends/10.0.0.11:8080/drain

The local, unauthenticated admin API provides /healthz, /status, /metrics, /plugins, /reload, and backend drain/undrain operations. /status shows the current pools, backend readiness/ejection state, routes, plugins, and configured listener addresses. It is a control plane: never publish it through a public route.

Optional Web UI

The Web UI is disabled by default and listens separately. It shows telemetry, configuration, pools, routes, and optionally a bounded in-memory log ring. capture_logs: true adds work on the request logging path; leave it off unless a live log view is needed. The Web UI’s configuration writes use a YAML overlay and observe the same validation and hot-reload restrictions as a file reload.

A non-loopback Web UI requires an absolute bearer-token file. On loopback, add a token anyway when more than one local principal can reach the port. Its API is distinct from the unauthenticated admin API.