README

Prometheus metrics endpoint for Flarum 2.0 (flarum/core: ^2.0.0-rc.8).

Exposes GET /api/metrics in the Prometheus text format, protected by a bearer token. The route lives on the API frontend, so sycho/flarum-private-facade (which only guards forum routes) does not redirect it.

Metrics

All metrics are gauges.

Metric	Labels	Description
`flarum_info`	`version`	Flarum core version (value is always 1)
`flarum_users`	`email_confirmed`	Registered users
`flarum_users_online`		Users seen in the last 5 minutes
`flarum_discussions`		Visible discussions
`flarum_posts`		Visible comment posts
`flarum_queue_jobs`		Jobs waiting in the default queue (always 0 with the sync driver; meaningful with `fof/redis`)
`flarum_extension_info`	`id`, `version`	Enabled extensions (value is always 1)
`flarum_uploads`		Files uploaded via `fof/upload` (only when enabled)
`flarum_uploads_bytes`		Total size of `fof/upload` files (only when enabled)

Installation

composer require lukastrkan/flarum-prometheus
php flarum extension:enable lukastrkan-prometheus

Configuration

The token is read from the FLARUM_PROMETHEUS_TOKEN environment variable. If it is missing or empty, the endpoint always responds with 403.

Generate a token:

openssl rand -hex 32

Make it visible to the PHP process:

Docker / compose

environment:
  FLARUM_PROMETHEUS_TOKEN: ${FLARUM_PROMETHEUS_TOKEN}

php-fpm (pool config). The default clear_env = yes drops the shell environment, so set it in the pool and restart php-fpm:
```
env[FLARUM_PROMETHEUS_TOKEN] = <token>
```
Apache mod_php
```
SetEnv FLARUM_PROMETHEUS_TOKEN <token>
```

Flarum does not load .env files on its own.

Prometheus

scrape_configs:
  - job_name: flarum
    metrics_path: /api/metrics
    scheme: https
    authorization:
      type: Bearer
      credentials_file: /etc/prometheus/flarum.token
    static_configs:
      - targets: [forum.example.com]

Verify

curl -i -H "Authorization: Bearer $FLARUM_PROMETHEUS_TOKEN" https://forum.example.com/api/metrics  # 200
curl -i https://forum.example.com/api/metrics                                                      # 403

A 302 redirect to /login on the second request would mean a middleware is guarding API routes.

lukastrkan / flarum-prometheus

Package info

Security

Statistics