$ show nginx/nginx-prometheus-exporter
The NGINX Prometheus Exporter is a production-grade Go service that bridges NGINX and NGINX Plus metrics into Prometheus. In operation, Prometheus scrapes the exporter's HTTP endpoint (default :9113/metrics) and on each scrape the exporter fetches live metrics from either the NGINX stub_status page or the NGINX Plus REST API, converts them into typed Prometheus metrics (gauge/counter), and serves them alongside an nginx_up/nginxplus_up health gauge. The binary supports multiple concurrent scrape targets, TLS client auth against NGINX, unix domain sockets, PROXY protocol v2 outbound connections, and the full exporter-toolkit web configuration surface (TLS termination, basic auth, systemd socket activation). Architecturally it is a compact, idiomatic Go application with three layers: the main package owns CLI flags (kingpin), TLS setup, transport construction, and HTTP server lifecycle; the client package is a minimal self-contained stub_status HTTP client; the collector package implements prometheus.Collector in two variants — NginxCollector for OSS (7 metrics) and NginxPlusCollector for Plus (roughly 300 metrics spanning server zones, upstreams, stream zones, zone sync, resolvers, limit zones, cache, workers, and license state). The Plus collector is the dominant subsystem; its notable design feature is a LabelUpdater interface backed by RWMutex-protected maps that allows an external system (NGINX Ingress Controller) to dynamically inject additional label names and values into upstream/server-zone/cache metrics between scrapes. The release and quality engineering around the code is exceptional: GoReleaser multi-arch builds (10 OSes, 12 architectures), cosign-signed artifacts, SBOM/provenance attestations, multi-registry Docker publishing (DockerHub, GHCR, ECR, Quay), Homebrew/Scoop/Nix distribution, OpenSSF Scorecards, CodeQL, anchore image scanning, and a 60-linter golangci-lint configuration. A retract directive in go.mod cleanly handles a broken v1.5.2 release, indicating disciplined release management. Dependencies are current (Go 1.25, prometheus client_golang v1.24, exporter-toolkit v0.17). The main weakness is that the Plus collector is a single ~3000-line monolith with heavy repetition in metric emission and only minimal unit-test coverage for its most complex paths.
The LLM identified 3 files worth highlighting for reuse:
The LabelUpdater interface and VariableLabelNames struct form a genuinely reusable pattern for any Prometheus exporter that must support runtime enrichment of metric dimensions from external configuration. Label names and label values are maintained in separate RWMutex-protected maps, updated by an external controller (e.g. NGINX Ingress Controller) between scrapes, with graceful degradation to empty labels plus a structured warning when value count mismatches are detected. The mix of fixed labels (upstream, server, zone) and variable labels with correct cardinality handling is non-obvious and demonstrably engineered for concurrent scrape and update paths.
A compact, dependency-free client that scrapes the NGINX stub_status page and parses its fixed text format using fmt.Fscanf against a format template. Demonstrates clean idiomatic Go: context cancellation on requests, chainable error wrapping with %w, streaming body reads, and a zero-coupling design that could be vendored into any Go project needing stub_status metrics. The parse function is pure (io.Reader in, struct out), making it trivially unit-testable — which the repository does.
Contains the most non-obvious network engineering in the repo: PROXY protocol v2 header construction for outbound scrape connections, correctly selecting TCPv4, TCPv6, or UnixStream transport protocols based on the resolved connection type, with LOCAL vs PROXY command semantics. It also demonstrates a clean pattern for converting flags to environment variables (addMissingEnvironmentFlags/convertFlagToEnvar) that transparently adds envar support to any kingpin flag with a 'web.' prefix, plus careful TLS configuration with custom CA pools and mutual TLS client certificates.