---
# Core metrics collection configuration
logic:
  metrics:
    histograms:
      active: true
      rtt:
        active: true
        bucketBounds: [0.001, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0, 25.0, 50.0, 100.0, 250.0, 500.0, 1000.0]
    gauges:
      active: true
      rtt: { active: true }
      cwnd: { active: true }
      deliveryRate: { active: true }
    counters:
      active: true
      dataSegsIn: { active: true }
      dataSegsOut: { active: true }
  
  compression:
    labelFolding: "raw_endpoint"  # or "pid_condensed"
  
  selection:
    # [Optional] filtering rules
    process:
      pids: [1000, 2000]  # Specific process IDs
      cmds: ["nginx", "apache2"]  # Process names
    peering:
      addresses: ["8.8.8.8", "1.1.1.1"]  # Specific IPs
      networks: ["10.0.0.0/8", "192.168.0.0/16"]  # CIDR networks
      hosts: ["example.com"]  # Hostnames
    portRanges:
      - lower: 80
        upper: 443
      - lower: 8000
        upper: 9000

# raw_endpoint: flow="(SRC#192.168.10.58|39366)(DST#104.19.199.151|443)"
# pid_condensed: flow="(20005)(DST#104.19.199.151|443)"

process:
  pids: [1000, 2000, 3000]  # Monitor flows from specific process IDs
  cmds: ["nginx", "apache2"] # Monitor flows from specific command names

peering:
  addresses: ["8.8.8.8", "1.1.1.1"]  # Specific IP addresses
  networks: ["10.0.0.0/8", "192.168.0.0/16"]  # CIDR networks (IPv4 only)
  hosts: ["api.example.com", "db.internal"]  # Hostnames

portRanges:
  - lower: 80    # Port 80
    upper: 443   # Up to port 443
  - lower: 8000  # Port 8000
    upper: 9000  # Up to port 9000

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
    counters:
      active: true

---
logic:
  metrics:
    gauges:
      active: false
      rtt: { active: false }
      cwnd: { active: false }
      deliveryRate: { active: false }
    histograms:
      active: false
      rtt: { active: false, bucketBounds: [] }
    counters:
      active: false
      dataSegsIn: { active: false }
      dataSegsOut: { active: false }
  compression:
    labelFolding: "raw_endpoint"
  selection:
    process:
      pids: []
      cmds: []
    peering:
      addresses: []
      networks: []
      hosts: []
    portRanges: []

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
      deliveryRate: { active: true }
    histograms:
      latency:
        active: true
        bucket_bounds: [0.1, 0.5, 1, 5, 10, 50, 100, 200]
  selection:
    process:
      cmds: ["nginx", "apache2", "httpd"]
    portranges:
      - lower: 80
        upper: 443

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }           # Enable only RTT gauge
      cwnd: { active: false }        # Disable other gauges
      deliveryRate: { active: false }
    histograms:
      active: true
      rtt: { 
        active: true, 
        bucketBounds: [0.1, 0.5, 1, 5, 10, 50, 100, 200] 
      }
    counters:
      active: false                   # Disable all counters
      dataSegsIn: { active: false }
      dataSegsOut: { active: false }

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
    histograms:
      latency:
        active: true
        bucket_bounds: [1, 5, 10, 50, 100, 500]
  compression:
    labelFolding: "raw_endpoint"  # or "pid_condensed"
  selection:
    peering:
      networks: ["10.0.0.0/8", "192.168.0.0/16"]

version: '3.8'
services:
  prometheus_ss_exporter:
    image: ghcr.io/cherusk/prometheus_ss_exporter:2.1.1
    container_name: prometheus_ss_exporter
    privileged: true
    network_mode: host
    pid: host
    restart: unless-stopped
    ports:
      - "8020:8020"
    command: ["./prometheus_ss_exporter", "--port=8020", "--config=/config.yml"]
    volumes:
      - ./config.yml:/config.yml:ro
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8020/health"]
      interval: 30s
      timeout: 10s
      retries: 3

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: prometheus-ss-exporter
  labels:
    app: prometheus-ss-exporter
spec:
  selector:
    matchLabels:
      app: prometheus-ss-exporter
  template:
    metadata:
      labels:
        app: prometheus-ss-exporter
    spec:
      hostNetwork: true
      hostPID: true
      containers:
      - name: exporter
        image: ghcr.io/cherusk/prometheus_ss_exporter:2.1.1
        securityContext:
          privileged: true
        ports:
        - containerPort: 8020
          hostPort: 8020
          protocol: TCP
        command: ["./prometheus_ss_exporter", "--port=8020", "--config=/config.yml"]
        volumeMounts:
        - name: config
          mountPath: /config.yml
          readOnly: true
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
      volumes:
      - name: config
        configMap:
          name: ss-exporter-config

scrape_configs:
  - job_name: 'socket-stats'
    static_configs:
      - targets: ['localhost:8020']
    scrape_interval: 15s
    metrics_path: /metrics
    # Optional: Relabel to add instance information
    relabel_configs:
      - source_labels: [__address__]
        target_label: instance
        replacement: 'socket-exporter'

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
      cwnd: { active: true }
      deliveryRate: { active: true }
    histograms:
      latency:
        active: true
        bucket_bounds: [0.1, 0.5, 1, 5, 10, 50, 100, 200]
    counters:
      active: true
      dataSegsIn: { active: true }
      dataSegsOut: { active: true }
  selection:
    process:
      cmds: ["nginx", "apache2", "httpd"]
    portranges:
      - lower: 80
        upper: 443

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
      deliveryRate: { active: true }
    histograms:
      latency:
        active: true
        bucket_bounds: [0.5, 1, 2, 5, 10, 25, 50, 100]
  compression:
    labelFolding: "raw_endpoint"  # or "pid_condensed"
  selection:
    process:
      cmds: ["postgres", "mysqld", "mongod", "oracle"]
    portranges:
      - lower: 3306   # MySQL
        upper: 3306
      - lower: 5432   # PostgreSQL
        upper: 5432
      - lower: 27017  # MongoDB
        upper: 27017

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
    histograms:
      latency:
        active: true
        bucket_bounds: [0.01, 0.05, 0.1, 0.5, 1, 5, 10]
  compression:
    labelFolding: "raw_endpoint"  # or "pid_condensed"
  selection:
    peering:
      networks: ["10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12"]
    portranges:
      - lower: 8000
        upper: 9999
      - lower: 3000
        upper: 3999

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
    histograms:
      latency:
        active: true
        bucket_bounds: [1, 5, 10, 25, 50, 100, 250]
  compression:
    labelFolding: "raw_endpoint"  # or "pid_condensed"
  selection:
    # Monitor only external traffic (skip internal networks)
    peering:
      networks:
        exclude: ["10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12"]
    portranges:
      - lower: 80
        upper: 443
      - lower: 8080
        upper: 8080

---
logic:
  metrics:
    gauges:
      active: true
      rtt: { active: true }
    counters:
      active: false
    histograms:
      active: false
  selection:
    process:
      cmds: ["node", "python", "java", "go"]
    portranges:
      - lower: 3000
        upper: 9000

# Alert on high latency
- alert: HighSocketLatency
  expr: histogram_quantile(0.95, tcp_rtt_hist_ms_bucket) > 100
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: "High socket latency detected"
    description: "95th percentile latency is {{ $value }}ms"

# Alert on connection count
- alert: TooManyConnections
  expr: count(tcp_rtt) > 10000
  for: 10m
  labels:
    severity: critical
  annotations:
    summary: "Excessive number of TCP connections"
    description: "{{ $value }} TCP connections detected"

# Alert on delivery rate issues
- alert: LowDeliveryRate
  expr: avg(tcp_delivery_rate) < 1000
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: "Low TCP delivery rate"
    description: "Average delivery rate is {{ $value }} bytes/sec"