v3.0.0

3.0.0 (2026-07-23)

⚠ BREAKING CHANGES

• zenarmor,syslog: close username-only auth bypass, bound receiver resources
• zenarmor: the receiver no longer ships records describing its own ingest connection. Set --logs.zenarmor.drop-self-traffic=false to restore the old behaviour.
• logship: opnsense_exporter_logs_parse_errors_total and opnsense_exporter_logs_rejected_total gain a source label. Aggregations such as sum by (stage) / sum by (reason) are unaffected; only exact full-label-set matches need updating.
• pyroscope: --pyroscope.enable-mutex-block (default off) is replaced by --pyroscope.disable-mutex-block (default off = contention profiling ON), following the repo disable-* convention for default-on features. Env var is now OPNSENSE_EXPORTER_PYROSCOPE_DISABLE_MUTEX_BLOCK.
• logship: --logs.diaglog.enabled DEFAULTED TO TRUE, so this is not a quiet opt-in removal -- every existing log-shipping user loses the config-change/gateway/CARP/portal audit trail until they configure a syslog target on the firewall pointing at the exporter. --logs.firewall.enabled and --logs.scopes are removed with it.

Features

• collector: add StatusTracker + RunCollector for web UI (33e4976), closes #302
• collector: decouple serving from collection via internal poll scheduler (#336 phase 1) (ac86cb9)
• collector: derive bounded counters from Zenarmor records (a632f14), closes #276
• collector: flow volume metrics, flags, docs and dashboard (280dcb5), closes #346
• collector: per-collector poll tiers + interval config (#336 phase 2) (165d400)
• collector: poll-observability metrics + interval in status snapshot (#336 phase 3) (8edea9c)
• flow: bounded top-N rollup with monotone other folding (c266b48), closes #346
• flow: correlator + DNS answer cache (#346 phase 3 seam) (8e35af9)
• flow: DNS-domain enrichment, §9 metrics, Zenarmor conn attrs in place (#353) (8c1be6c)
• flow: interface topology and the NetFlow ifIndex map (b303514)
• flow: NetFlow pipeline, metrics, flags, docs and dashboard (20d5684)
• flow: NetFlow v5/v9 decoder and hardened UDP receiver (d56d1c6)
• flow: normalized flow.Record seam and community-id join key (0f14ede), closes #346
• flow: OTLP flow-log emission path (#346 phase 3) (c00e524)
• flow: VLAN de-dup, WAN egress correction and direction inference (06701db)
• flow: wire correlator -> OTLP flow logs, phase-4 dashboard + rules (#346) (c974d21)
• grafana: comprehensive coverage — Zenarmor tab, mixed Prometheus+Loki panels, curated alerts/recording rules (8818c03), closes #301
• grafana: overhaul OPNsense dashboard (659c98a), closes #303
• logship: add debug-capture mode for unmodelled receiver signals (f973082), closes #330
• logship: add opnsense.action, a binary pass/block resource attribute (19d407b), closes #276
• logship: add the Zenarmor Elasticsearch receiver (02edcdc), closes #276
• logship: align syslog log attributes with OTel semantic conventions (f461953), closes #266
• logship: map every lane's disposition onto opnsense.action (1060108), closes #276
• logship: per-record source override for transport-agnostic sources (47c4476)
• logship: replace the firewall and diaglog poll lanes with the syslog receiver (6f98b35), closes #238 #248
• logship: source-label the receiver self-metrics (c990cc7), closes #276
• logship: syslog receiver with OPNsense API log enrichment (174212d), closes #248
• metricsnap: passive last-scrape family recorder (7b815cc), closes #302
• opnsense: CacheSnapshot accessor for web UI freshness card (39d9323), closes #302
• options: add --logs.zenarmor.transport selector (elasticsearch|syslog) (cf87f79)
• options: require the syslog receiver for zenarmor transport=syslog (f6610a5)
• options: web UI flags + redacted EffectiveConfig (53081ff), closes #302
• options: wire the Zenarmor receiver behind --logs.zenarmor.* (6d0cbae), closes #276
• pyroscope: collect all profile types by default incl. goroutine-leak (f5ab4d8), closes #269
• syslog: add optional ProgramProcessor delegation hook (4d27493)
• syslog: derive metrics from received logs, sample raw lines, and add TLS transport (18c2024), closes #258 #259
• syslog: enrich every record, not just filterlog (+ parser registry) (310dd28), closes [#261...

v2.2.1

2.2.1 (2026-07-13)

CI/CD

• release: repin shared binaries workflow, grant attestations: write (9fb6409)

---

This PR was generated with Release Please. See documentation.

v2.2.0

2.2.0 (2026-07-13)

Features

• otlp: emit synthetic up series in OTLP push mode (#240) (80049a6)

Bug Fixes

• grafana: set targetDatasourceUID on recording-rule manifests (514d0ca)

v2.1.0

2.1.0 (2026-07-13)

Features

• apidrift: live schema canary binary for the devel box (4c73097)
• apidrift: subtree-prefix exemptions and the cross-version compat ledger (e207e3f), closes #236
• auth: local user / group / API-key security-posture counts (97c4ac5), closes #222
• captiveportal: voucher inventory by state (fdec957), closes #207
• clamav: engine version and signature database freshness (e22020e), closes #204
• client: cache slow-moving API responses; cache firmware for 12h (9ec1801), closes #193
• core: config backup freshness + ZFS boot environment inventory (96174f0), closes #220
• crowdsec: hub component health (tainted/outdated) + engine version (8d7fca5), closes #205
• firewall: GeoIP database freshness + optional NAT rule inventory (c9b55c9), closes #221
• frr: BGP neighbor detail, OSPF/OSPFv3 interface parity, route volumes (c846f42), closes #197 #198 #199
• haproxy: stick-table occupancy + show-stat latency/health/capacity (77d94bf), closes #201
• hardware: DMI system identity (dmidecode) + Deciso PSU status (dechw) (27c3509), closes #217
• hostdiscovery: discovered-host inventory counts (0a22773), closes #223
• ids: Suricata service status, alert activity, ruleset and rule inventory (1be18bf), closes #203
• interfaces: LAGG member state, SFP/DOM optics, bridge membership (e62ddb8), closes #214
• ipsec: kernel SAD/SPD tables, per-lease detail, pending-config flag (6c7c946), closes #213
• kea: lease state/type breakdown, PD pool capacity, pool utilization (b68eadb), closes #208
• lldpd: LLDP neighbor table collector (8fa19ab), closes #216
• logship: crowdsec source — alert/decision records (opt-in) (402cc29), closes #232
• logship: firewall log source — digest-cursor tailing with rule labels (bacc16e), closes #229
• logship: generic diagnostics-log source — audit, gateway, CARP, portal, configd (0d4314a), closes #230
• logship: IDS source — full Suricata EVE alert records (opt-in) (0c6dcea), closes #231
• logship: log-shipping foundation — internal/logship pipeline (opt-in) (0a27446), closes #228
• logship: unbound source — per-query DNS log (opt-in, accepted loss) (55a49ab), closes #233
• metrics: cache hit/miss self-metrics for the response cache (884a849), closes #196
• metrics: minor extension candidates — ntpd GPS, siproxd, shaper last-match (3f29b3d), closes #224
• metrics: struct extensions from new 26.1.11/26.7 payload keys (f80174f), closes #237
• monit: per-check resource telemetry (a44ef75), closes #219
• netbird: management/signal connectivity, relays, per-peer telemetry (06c02f6), closes #211
• nginx: cache zones, latency counters, cache-status, reload timestamp + bans (555f59e), closes #200
• openvpn: per-session traffic counters and connected-since (5f6a9ce), closes #212
• relayd: virtual server / table / host health via status/sum (2b81bf9), closes #202
• schema: capture request bodies for every POST endpoint (5a7d74d)
• schema: committed golden schemas + make schemas staleness gate (dfc36d6)
• schema: endpoint→response-struct registry covering the full 107-endpoint manifest (2601327)
• schema: live-payload structural validator (93967a4)
• schema: reflection walker deriving structure-only schemas from response structs (aae08d2)
• system: export all system-status subsystems from the health payload (7ea8cb9), closes #218
• tor: circuit and stream telemetry from the control port (opt-in) (18da737), closes #206
• unbound: DNSBL query-stats totals and blocklist size (opt-in) (0289a3d), closes #209
• vnstat: persistent per-interface traffic accounting (opt-in) ([8...

v2.0.2

2.0.2 (2026-07-05)

Miscellaneous

• deps: update anthropics/claude-code-action action to v1.0.165 (#174) (d8c75d9)

Documentation

• upgrading: add v2.0 breaking-changes section and fix instance-label note (#176) (22dcb32)

v2.0.1

2.0.1 (2026-07-04)

Bug Fixes

• grafana: emit valid alert noDataState "Ok" (was "OK", rejected by the API) (d75d02c)

Miscellaneous

• deps: update anthropics/claude-code-action action to v1.0.164 (#172) (345f0e1)

v2.0.0

2.0.0 (2026-07-04)

⚠ BREAKING CHANGES

• smart: the SMART collector is now off by default. Set --exporter.enable-smart (env OPNSENSE_EXPORTER_ENABLE_SMART=true) to restore the opnsense_smart_* metrics.
• arp,ndp: opnsense_arp_table_entries and opnsense_ndp_entries per-entry series are no longer emitted by default. Set --exporter.enable-arp-details / --exporter.enable-ndp-details to restore them; otherwise use the new opnsense_arp_table_entries_total / opnsense_ndp_entries_total aggregates.
• interfaces: distinguish unknown link state from down so PPPoE WANs aren't reported down
• when --exporter.instance-label is unset, the instance label now defaults to the configured OPNsense address rather than the API hostname. Set --exporter.instance-use-hostname to keep hostname-derived labels, or set --exporter.instance-label explicitly.
• firewall: opnsense_firewall_interface_hits_total is renamed to opnsense_firewall_interface_log_entries_recent and changed from counter to gauge. Any user dashboards/alerts using rate()/increase() on the old name must switch to plotting the new gauge directly. The shipped dashboard is updated.
• grafana: grafana/alerts/opnsense.rules.yaml is removed. Users loading that file into Prometheus/Mimir/the Grafana Cloud ruler should migrate to the Grafana-managed manifests under grafana/alerts/grafana-managed/ (gcx resources push).

Features

• apicapture: resolve OPS_API_KEY_FILE/OPS_API_SECRET_FILE like the exporter (428353b), closes #157
• arp,ndp: gate per-entry metrics behind opt-in details flags (2ac1221), closes #125
• collector: add disable switches for interfaces, protocol, services (ef94751), closes #143
• config: make OPNsense API timeout and retry count configurable (045571f), closes #140
• docs: align docs site with m7kni.io brand + server-side SEO/LLM metadata (9bca073), closes #70
• grafana: drop portable Prometheus rules format, ship Grafana-managed alerting only (2af458a), closes #76 #95
• metrics: add per-endpoint API request count and duration self-metrics (802c53a), closes #126
• security: warn at startup when --opnsense.insecure disables TLS verification (2d3914d), closes #159
• smart: make SMART collector opt-in (--exporter.enable-smart, default-off) (4c8af5c), closes #139

Bug Fixes

• activity: parse thread states independently so zombie/stopped states don't zero metrics (73ba3f8), closes #82
• alerts: make OPNsenseEndpointErrors for:15m require sustained errors (586563a), closes #94
• apicontract: filter abstract-controller phantom endpoints from the manifest (9ab2ee9), closes #146
• apicontract: isolate per-controller parse failures in extract.py (fca0054), closes #111
• captiveportal: decode zones map serialized as a JSON array (27fef5b), closes #73
• carp: source VIP label from the subnet field and dedupe multi-address vhids (30641c1), closes #166
• certificates: omit valid_from/valid_to for pending CSRs instead of epoch 0 (b80a1da), closes #167
• chrony: skip sources metrics on sub-fetch failure instead of false zero (4aed2cf), closes #163
• ci: match drift issue by label+title, not the broken bot-login filter (5944a81), closes #83
• ci: surface api-contract verb-drift warnings instead of burying them (e8cfff8), closes #93
• collector: bound no-deadline collections to stop a stalled box blackout (4baabb8), closes #128
• collector: dedupe services/wireguard/ntp label tuples to prevent scrape-wide 500s (45e3403), closes #85
• collector: distinguish deadline-expired skipped scrapes from completed ones (6664350), closes #122
• collector: emit cumulative counters as CounterValue in firewall/ipsec/protocol (5621823), closes #106
• collector: keep dhcpv4/acme/smart/dyndns silent when their plugin is absent (52a72d8), closes #87
• collector: skip scalar metrics whose backing sub-call failed in pf-stats/system (47145c2), closes #91
• collector: surface interfaces-overview fetch failures via success/errors (14d9190), closes #123
• collector: use panic: sentinel on endpoint-errors label, not subsystem slug (86326fc), closes #120
• config: consistent env-var surface — telemetry-path envar + prefixed *_FILE aliases (6a4d64e), closes #141
• config: empty OPS_API_KEY_FILE/OPS_API_SECRET_FILE falls back to flag (9e56123), closes #109
• config: reject empty/invalid --web.telemetry-path instead of panicking (945cfb4), closes #108
• config: validate Pyroscope server-address scheme at startup (e328a7c), closes #142
• crowdsec: mark bouncers/machines absent on row decode failure instead of false zero (75c758f), closes #104
• dashboard: add...

v1.0.1

1.0.1 (2026-06-29)

Bug Fixes

• resolve review findings in gateway collector, client, and registration (8f1ba70)

Miscellaneous

• deps: update golangci/golangci-lint-action action to v9.3.0 (#59) (7d46c39)
• deps: update goreleaser/goreleaser-action action to v7.2.3 (#57) (763504e)
• renovate: group lockstep dependency families (cbef9d7)

CI/CD

• add Snyk -> Snyk Cloud monitor (SCA/SAST/IaC/container) (2109b7e)
• build release binaries via shared binaries reusable (35396fc)
• codacy: align exclude_paths convention; use project token for coverage (df73e81)
• open the release-please PR under a PAT so CI runs without manual approval (8471e9c)
• pin shared rknightion reusables to v1.0.0 (3d3d6e9)
• publish image via shared container-publish reusable (a0a680b)
• sign release binaries + emit archive SBOMs (supply-chain parity) (ece4d2b)

v1.0.0

1.0.0 (2026-06-28)

⚠ BREAKING CHANGES

• health: opnsense_up no longer flips to 0 for a reachable box that OPNsense self-reports as degraded (e.g. a leftover crash report). Such a box now triggers the warning-level OPNsenseCrashReports / OPNsenseFirewallUnhealthy alerts instead of the critical OPNsenseExporterDown. Users of the bundled alert rules should expect that severity change.
• readme: thin README — hard-fork notice replaces upstream changelog, docs site is canonical
• collectors: opnsense_openvpn_sessions is no longer emitted by default (set --exporter.enable-openvpn-details to restore it), and IPsec phase2 metrics no longer carry spi_in/spi_out labels.

Features

• alias: firewall alias table size collector with opt-in pf counters (763adc7)
• apcupsd: APC UPS metrics collector (plugin-gated) (6040ba1)
• apicontract: API contract diff tool (fb12ea0)
• bpf: BPF listener statistics collector (b4983ab)
• build: docs/docs-check make targets and install-hooks pre-commit gate (a94de13)
• captiveportal: captive portal zone and session collector (bc6dc5a)
• certificates: CA certificate expiry metrics (19c634b)
• chrony: chrony tracking/source metrics collector (plugin-gated) (9ba2f75)
• client: register interfaces overview and unbound dumpinfra endpoints (b141b10)
• collector: export SubsystemDisplayNames and AllCollectors for docgen (70431b5)
• collectors: freeze stream-C seams (endpoints, subsystem consts) (c8bb99b)
• collectors: freeze stream-D phase-1 seams (endpoints, subsystem consts) (8b2d1ab)
• collectors: freeze stream-D phase-2 seams (endpoints, subsystem consts) (c432ec7)
• collectors: freeze stream-D phase-3 seams (endpoints, subsystem consts) (c8c997e)
• collectors: opt-in OpenVPN session details, drop IPsec SPI labels, gateways disable flag (bb60966)
• collectors: wire CrowdSec, NUT, apcupsd and captive portal collectors (phase 2 plugin-gated set) (a1610bd)
• collectors: wire HAProxy, nginx, FRR and Monit collectors (phase 1 plugin-gated set) (da0cd05)
• collectors: wire syslog, qfeeds, tailscale, alias collectors and regenerate docs (9cf501c)
• collectors: wire traffic shaper, HA sync, chrony, DHCPv6 and BPF collectors (phase 3 set) (de88e48)
• contract: add response-shape canary for payload drift at unchanged endpoints (2522b21)
• crowdsec: CrowdSec alert/decision/bouncer/machine collector (plugin-gated) (87280a4)
• dhcp: pool-size metrics for kea and dnsmasq, kea service status (d37f733)
• dhcpv6: ISC DHCPv6 lease and delegated-prefix collector (plugin-gated) (6309da8)
• docgen: doclint token validation and Describe() registry verification gate (69b75a1)
• docgen: marker-region injection and stat-rule engines (4c47cfa)
• docgen: render grouped flag tables from the kingpin model (db2f6c6)
• docs: generate configuration.md flag tables in-place; wire doclint, registry gate and -check mode into docgen (4f839c5)
• firewall-rules: configured-rule inventory gauge in details mode (5c277b6)
• firmware: opt-in package_update_available and plugin_installed metrics (e19cafd)
• frr: FRR routing collector — BGP, OSPF and BFD (plugin-gated) (5cfa890)
• grafana: emit dashboard-stats.json for docs count injection (2b274d9)
• grafana: gateway status values 4-6, firmware package detail panels (ad27d5e)
• grafana: panels for SMART attributes/NVMe, interface identity, unbound infra, rule inventory (952300f)
• grafana: per-collector scrape duration and success panels (b54df15)
• grafana: syslog, qfeeds, tailscale and alias tabs; DHCP pool and CA expiry panels (0203029)
• haproxy: HAProxy statistics collector (plugin-gated) (69c4266)
• hasync: opt-in HA sync status collector (e1fa4f0)
• interfaces: admin_up and info enrichment from interfaces overview (18df78e)
• ipsec: mode-cfg pool utilization metrics (cc1ce8f)
• monit: Monit service check collector (ab2cd92)
• nginx: nginx VTS statistics collector (plugin-gated) (fc0ab05)
• nut: NUT UPS metrics collector (plugin-gated) (3ecb8b0)
• openvpn: real_address label on opt-in session details (upstream #97) (b3ef0e8)
• opnsense: add FetchServiceStatusOptional with 404-as-absent semantics (bbc9ca9)
• opnsense: endpoint contract manifest with HTTP verbs (664923a)
• opnsense: register core/firmware/info endpoint (e78c1ce)
• opnsense: request-scoped context support via Client.WithContext (7247845)
• options: --exporter.enable-firmware-package-details flag and wiring (699efbf)
• options: CollectorFlags metadata + RegisterAllFlags for docgen; fix flag help typos (8e221d7)
• otlp: add OpenTelemetry OTLP metrics export with Prometheus parity (2e8dda9)
• qfeeds: Q-Feeds threat-intel collector (plugin-gated) ([7e149bb](https://github.com/rknightion/opnsense-exporter/...

v0.4.0

0.4.0 (2026-06-09)

Features

• options: add pyroscope profiling configuration (061d893)
• profiling: add pyroscope SDK integration package (df888e5)
• push profiles to pyroscope and drop unauthenticated pprof endpoints (99577df)

Documentation

• document pyroscope profiling and pprof removal (16e6f84)
• remove stale pprof references from architecture and index (a047bd6)

Build & Infrastructure

• tidy vendor after pyroscope integration (78486ef)