feat(monitors): public heartbeat ping endpoints, header token, log masking and sweeper

server/cmd/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"os"
@@ -23,6 +24,7 @@ import (
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/db"
 	grpcserver "gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/grpc"
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/mcp"
+	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/metricsched"
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/models"
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/monitorsched"
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/patchsched"
@@ -259,6 +261,7 @@ func serve() {
 		services.StartAuditSweeper(jobCtx)
 		services.StartReaper(jobCtx)
 		monitorsched.Start(jobCtx)
+		metricsched.Start(jobCtx)
 		workflowsched.Start(jobCtx, workflowsched.Deps{
 			TriggerWorkflow: services.TriggerWorkflow,
 			LogEvent:        services.LogEvent,
@@ -305,7 +308,16 @@ func serve() {
 		log.Fatalf("trusted proxies: %v", err)
 	}
 	r.Use(gin.Recovery())
-	r.Use(gin.LoggerWithConfig(gin.LoggerConfig{SkipPaths: []string{"/api/console/tunnel"}}))
+	r.Use(gin.LoggerWithConfig(gin.LoggerConfig{
+		SkipPaths: []string{"/api/console/tunnel"},
+		// Heartbeat URLs carry a credential; the request log must not.
+		Formatter: func(p gin.LogFormatterParams) string {
+			return fmt.Sprintf("[GIN] %v | %3d | %13v | %15s | %-7s %#v\n%s",
+				p.TimeStamp.Format("2006/01/02 - 15:04:05"),
+				p.StatusCode, p.Latency, p.ClientIP, p.Method,
+				api.MaskLogPath(p.Path), p.ErrorMessage)
+		},
+	}))
 	r.Use(corsMiddleware())
 	services.SetStatusRedis(auth.Redis())