Observability & Production Rust: Structured Logging, Metrics, Health Checks, Config, and Supply-Chain Auditing

[dependencies]
tracing        = "0.1"           # the instrumentation API
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
# tracing-subscriber is the "backend" that formats and outputs spans/events
# env-filter lets you change log level at runtime via RUST_LOG env var
# json outputs machine-readable JSON lines instead of pretty text

use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt, EnvFilter};

fn main() {
    // Read log level from RUST_LOG env var, default to "info"
    // RUST_LOG=debug cargo run  →  shows debug + info + warn + error
    // RUST_LOG=my_crate=trace   →  trace only for your crate
    tracing_subscriber::registry()
        .with(EnvFilter::try_from_default_env()
            .unwrap_or_else(|_| EnvFilter::new("info")))
        .with(tracing_subscriber::fmt::layer()
            .json()                 // structured JSON — use .pretty() for dev
            .with_target(true)      // include module path in every event
            .with_thread_ids(true)) // include OS thread id
        .init();

    tracing::info!("Service started");
    run_server();
}

[dependencies]
metrics                  = "0.23"
metrics-exporter-prometheus = "0.15"  # exposes /metrics endpoint for Prometheus

use metrics::{counter, gauge, histogram};
use metrics_exporter_prometheus::PrometheusBuilder;
use std::time::Instant;

fn init_metrics() {
    PrometheusBuilder::new()
        .with_http_listener(([0, 0, 0, 0], 9000)) // /metrics on port 9000
        .install()
        .expect("failed to install Prometheus exporter");
}

async fn handle_request(req: Request, db: &Database) -> Response {
    let start = Instant::now();

    // Increment total request counter with a label
    counter!("http_requests_total", "method" => req.method.clone());

    let response = process(req, db).await;

    // Record latency as histogram in seconds
    let elapsed = start.elapsed().as_secs_f64();
    histogram!("http_request_duration_seconds",
               "status" => response.status.to_string(),
               elapsed);

    if response.is_error() {
        counter!("http_errors_total", "status" => response.status.to_string());
    }

    response
}

fn update_active_connections(count: i64) {
    gauge!("active_connections", count as f64);
}

# HELP http_requests_total Total HTTP requests received
# TYPE http_requests_total counter
http_requests_total{method="GET"} 1043
http_requests_total{method="POST"} 217

# HELP http_request_duration_seconds Request latency distribution
# TYPE http_request_duration_seconds histogram
http_request_duration_seconds_bucket{status="200",le="0.005"} 890
http_request_duration_seconds_bucket{status="200",le="0.01"}  970
http_request_duration_seconds_bucket{status="200",le="0.025"} 1041

# HELP active_connections Current open connections
# TYPE active_connections gauge
active_connections 47

use axum::{
    routing::get, Router, Json, extract::State, http::StatusCode,
};
use serde::Serialize;
use std::sync::Arc;
use tokio::sync::RwLock;

#[derive(Clone)]
struct AppState {
    db: Arc<DbPool>,
    ready: Arc<RwLock<bool>>,
}

#[derive(Serialize)]
struct HealthResponse {
    status: &'static str,
    version: &'static str,
}

// Liveness — just confirm the process loop is alive
async fn healthz() -> (StatusCode, Json<HealthResponse>) {
    (StatusCode::OK, Json(HealthResponse {
        status: "ok",
        version: env!("CARGO_PKG_VERSION"),
    }))
}

// Readiness — check DB reachability
async fn readyz(State(state): State<AppState>) -> StatusCode {
    if !*state.ready.read().await {
        return StatusCode::SERVICE_UNAVAILABLE;
    }
    match state.db.ping().await {
        Ok(_) => StatusCode::OK,
        Err(e) => {
            tracing::warn!(error = %e, "DB ping failed in readyz");
            StatusCode::SERVICE_UNAVAILABLE
        }
    }
}

fn router(state: AppState) -> Router {
    Router::new()
        .route("/healthz", get(healthz))
        .route("/readyz",  get(readyz))
        .route("/metrics", get(prometheus_handler)) // see Part 3
        .with_state(state)
}

cargo install cargo-deny

# Generate a starter deny.toml at the project root
cargo deny init

# Run all checks
cargo deny check

# Run only the security advisory check
cargo deny check advisories

[advisories]
# Fail on any unpatched vulnerability unless explicitly ignored
ignore = []           # list specific advisory IDs here to suppress

[licenses]
# Only allow these licenses in the dependency tree
allow = ["MIT", "Apache-2.0", "BSD-3-Clause", "Unicode-DFS-2016"]
# How to handle crates whose license is unclear
unlicensed = "deny"
copyleft = "deny"   # reject GPL/LGPL

[bans]
multiple-versions = "warn"  # warn on duplicate crate versions
# Ban specific crates by name
deny = [
    { name = "openssl" },  # we standardise on rustls
]
# Allow specific duplicates you cannot resolve yet
skip = [
    { name = "windows-sys" }, # common transitive version conflict
]

[sources]
# Only allow crates from crates.io and specific git repos
unknown-registry = "deny"
unknown-git      = "deny"