From 8f73f70050dc38f718e623f06048c455258fa30b Mon Sep 17 00:00:00 2001
From: Vincent Bernat <vincent@bernat.ch>
Date: Mon, 11 Aug 2025 08:49:37 +0200
Subject: [PATCH] docker: add metrics for Traefik in Prometheus

---
 docker/docker-compose.yml |  6 ++++++
 docker/prometheus.yml     | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 9bd46f66..6229f3ba 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -233,6 +233,9 @@ services:
     environment:
       TRAEFIK_API: "true"
       TRAEFIK_API_BASEPATH: "/traefik"
+      TRAEFIK_METRICS_PROMETHEUS: "true"
+      TRAEFIK_METRICS_PROMETHEUS_MANUALROUTING: "true"
+      TRAEFIK_METRICS_PROMETHEUS_ADDROUTERSLABELS: "true"
       TRAEFIK_PROVIDERS_DOCKER: "true"
       TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: "false"
       TRAEFIK_ENTRYPOINTS_private_ADDRESS: ":8080" # all services
@@ -242,6 +245,9 @@ services:
       - traefik.enable=true
       - "traefik.http.routers.traefik.rule=PathPrefix(`/traefik`) && !PathPrefix(`/traefik/debug`)"
       - traefik.http.routers.traefik.service=api@internal
+      - traefik.http.routers.traefik-metrics.rule=PathPrefix(`/traefik/metrics`)
+      - traefik.http.routers.traefik-metrics.priority=200
+      - traefik.http.routers.traefik-metrics.service=prometheus@internal
     ports:
       # Port 8080 is considered private as it exposes sensible unauthenticated
       # services (ClickHouse, configuration, ...). Therefore, it is only exposed
diff --git a/docker/prometheus.yml b/docker/prometheus.yml
index 75c46b00..4356816d 100644
--- a/docker/prometheus.yml
+++ b/docker/prometheus.yml
@@ -90,3 +90,16 @@ scrape_configs:
         target_label: service
         regex: akvorado-(.*)
         replacement: $1
+  - job_name: traefik
+    metrics_path: /traefik/metrics
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 30s
+        filters:
+          - name: label
+            values:
+              - com.docker.compose.project=akvorado
+              - com.docker.compose.service=traefik
+      - source_labels: [__meta_docker_port_private]
+        regex: 80
+        replacement: 8080