v1.0.0

1.0.0 (2026-06-28)

⚠ BREAKING CHANGES

• health: opnsense_up no longer flips to 0 for a reachable box that OPNsense self-reports as degraded (e.g. a leftover crash report). Such a box now triggers the warning-level OPNsenseCrashReports / OPNsenseFirewallUnhealthy alerts instead of the critical OPNsenseExporterDown. Users of the bundled alert rules should expect that severity change.
• readme: thin README — hard-fork notice replaces upstream changelog, docs site is canonical
• collectors: opnsense_openvpn_sessions is no longer emitted by default (set --exporter.enable-openvpn-details to restore it), and IPsec phase2 metrics no longer carry spi_in/spi_out labels.

Features

• alias: firewall alias table size collector with opt-in pf counters (763adc7)
• apcupsd: APC UPS metrics collector (plugin-gated) (6040ba1)
• apicontract: API contract diff tool (fb12ea0)
• bpf: BPF listener statistics collector (b4983ab)
• build: docs/docs-check make targets and install-hooks pre-commit gate (a94de13)
• captiveportal: captive portal zone and session collector (bc6dc5a)
• certificates: CA certificate expiry metrics (19c634b)
• chrony: chrony tracking/source metrics collector (plugin-gated) (9ba2f75)
• client: register interfaces overview and unbound dumpinfra endpoints (b141b10)
• collector: export SubsystemDisplayNames and AllCollectors for docgen (70431b5)
• collectors: freeze stream-C seams (endpoints, subsystem consts) (c8bb99b)
• collectors: freeze stream-D phase-1 seams (endpoints, subsystem consts) (8b2d1ab)
• collectors: freeze stream-D phase-2 seams (endpoints, subsystem consts) (c432ec7)
• collectors: freeze stream-D phase-3 seams (endpoints, subsystem consts) (c8c997e)
• collectors: opt-in OpenVPN session details, drop IPsec SPI labels, gateways disable flag (bb60966)
• collectors: wire CrowdSec, NUT, apcupsd and captive portal collectors (phase 2 plugin-gated set) (a1610bd)
• collectors: wire HAProxy, nginx, FRR and Monit collectors (phase 1 plugin-gated set) (da0cd05)
• collectors: wire syslog, qfeeds, tailscale, alias collectors and regenerate docs (9cf501c)
• collectors: wire traffic shaper, HA sync, chrony, DHCPv6 and BPF collectors (phase 3 set) (de88e48)
• contract: add response-shape canary for payload drift at unchanged endpoints (2522b21)
• crowdsec: CrowdSec alert/decision/bouncer/machine collector (plugin-gated) (87280a4)
• dhcp: pool-size metrics for kea and dnsmasq, kea service status (d37f733)
• dhcpv6: ISC DHCPv6 lease and delegated-prefix collector (plugin-gated) (6309da8)
• docgen: doclint token validation and Describe() registry verification gate (69b75a1)
• docgen: marker-region injection and stat-rule engines (4c47cfa)
• docgen: render grouped flag tables from the kingpin model (db2f6c6)
• docs: generate configuration.md flag tables in-place; wire doclint, registry gate and -check mode into docgen (4f839c5)
• firewall-rules: configured-rule inventory gauge in details mode (5c277b6)
• firmware: opt-in package_update_available and plugin_installed metrics (e19cafd)
• frr: FRR routing collector — BGP, OSPF and BFD (plugin-gated) (5cfa890)
• grafana: emit dashboard-stats.json for docs count injection (2b274d9)
• grafana: gateway status values 4-6, firmware package detail panels (ad27d5e)
• grafana: panels for SMART attributes/NVMe, interface identity, unbound infra, rule inventory (952300f)
• grafana: per-collector scrape duration and success panels (b54df15)
• grafana: syslog, qfeeds, tailscale and alias tabs; DHCP pool and CA expiry panels (0203029)
• haproxy: HAProxy statistics collector (plugin-gated) (69c4266)
• hasync: opt-in HA sync status collector (e1fa4f0)
• interfaces: admin_up and info enrichment from interfaces overview (18df78e)
• ipsec: mode-cfg pool utilization metrics (cc1ce8f)
• monit: Monit service check collector (ab2cd92)
• nginx: nginx VTS statistics collector (plugin-gated) (fc0ab05)
• nut: NUT UPS metrics collector (plugin-gated) (3ecb8b0)
• openvpn: real_address label on opt-in session details (upstream #97) (b3ef0e8)
• opnsense: add FetchServiceStatusOptional with 404-as-absent semantics (bbc9ca9)
• opnsense: endpoint contract manifest with HTTP verbs (664923a)
• opnsense: register core/firmware/info endpoint (e78c1ce)
• opnsense: request-scoped context support via Client.WithContext (7247845)
• options: --exporter.enable-firmware-package-details flag and wiring (699efbf)
• options: CollectorFlags metadata + RegisterAllFlags for docgen; fix flag help typos (8e221d7)
• otlp: add OpenTelemetry OTLP metrics export with Prometheus parity (2e8dda9)
• qfeeds: Q-Feeds threat-intel collector (plugin-gated) (7e149bb)
• server: /-/healthy and /-/ready endpoints, collect[]/exclude[] filtering, scrape-timeout deadline handler (5e323d3)
• server: wire health endpoints, filtered metrics handler and scrape deadline into main (31fc19f)
• smart: per-attribute SATA table and NVMe health-log metrics (3feff7f)
• syslog: syslog-ng statistics collector (09c21f9)
• tailscale: node-local Tailscale collector, complementary to tailscale2otel (5cb6512)
• tools: OPNsense API endpoint extractor shim (2751521)
• trafficshaper: pipe/queue/rule statistics collector (bdcfa5b)
• unbound: opt-in infra cache RTT/RTO metrics (--exporter.enable-unbound-infra) (91ddf9f)

Bug Fixes

• apicontract: exempt kea leases4/6 (inherited-controller parser blind spot) (049487a)
• ci: gate image publish on docs job; doclint also scans CLAUDE.md (790db7d)
• deps: bump golang.org/x/crypto to v0.52.0 and Go to 1.26.4 (bafaf29)
• deps: update module github.com/prometheus/common to v0.69.0 (#47) (3dfa4dd)
• firmware: use last_check for validity (upstream #101), parse UnixDate timestamps, add FetchFirmwareInfo (03afc7c)
• gateways: document status enum 4-6, skip rtt/rttd/loss when probe data unavailable (4995f0f)
• gateways: parse Packetloss/Latency/forced-offline statuses, '~' probe values, null force_down (upstream #103, #106) (b249ada)
• harden API drift enrichment workflow (f892fe9)
• harden API drift enrichment workflow (740f445)
• health: parse OPNsense 26.1 status shape; opnsense_up is reachability-only (6443052)
• kea: tolerate string-typed expire values across OPNsense API variants (e095d76)
• opnsense: align captive portal service-status endpoint name with frozen seam (654813f)
• opnsense: migrate string-to-int parsing to int64 for 32-bit safety (upstream #81, extended) (7f58a29)
• security: harden HTTP server, API client, and CI workflows (27bfc19)
• security: redact CA private keys (prv/prv_payload) in error log excerpts (6129acb)
• security: redact credentials in error log excerpts, pin GoReleaser, drop CDN JavaScript (7b49f2f)
• security: set TLS 1.2 minimum and run container as non-root (d19fdd7)

Refactoring

• collector: thread context through CollectorInstance.Update, add per-collector scrape metrics and ScrapeView filtering (1814ef5)
• docgen: source flag and display-name metadata from code via kingpin model (5ced3ce)
• opnsense: extract defaultEndpoints() for contract tooling (ca0a84c)

Miscellaneous

• codacy: exclude fixtures/scratch from analysis and drop unused import (0c7fc40)
• deps: pin rknightion/.github action to 8629ccb (#54) (0074388)
• deps: update actions/checkout action to v6.0.3 (#50) (88b7eb7)
• deps: update anthropics/claude-code-action action to v1.0.158 (#49) (d402091)
• deps: update anthropics/claude-code-action action to v1.0.159 (#52) (e6a7117)
• deps: update gcr.io/distroless/static-debian13:nonroot docker digest to 963fa6c (#53) (287c936)
• deps: update github actions (#46) (11b8436)
• deps: update github actions (#48) (11922e8)
• deps: update github actions (#51) (05ea078)
• deps: update rknightion/.github digest to 0e80ff5 (#56) (a77b9c2)
• deps: update rknightion/.github digest to 17626c1 (#55) (daa4910)
• gitignore local roadmap.md (7ec2842)
• renovate: slim to repo-specific overrides (1dcb6a3)
• resolve Codacy quality findings and tune doc linting (9793e91)
• security: add Snyk policy excluding vendor + offline dev tooling (e35a9c0)

Documentation

• codacy: note that path excludes also gate default-on tools (a7b53d2)
• dev: document generated-docs workflow, drop fork-changelog convention (9eff6d4)
• note contract manifest step when adding a collector (540c501)
• pin metric/collector/dashboard counts via docgen stat rules (305/30/16) (6673cea)
• readme: thin README — hard-fork notice replaces upstream changelog, docs site is canonical (56aec9c)
• regenerate for gateway status enum 4-6 and firmware package details flag (9c18429)
• regenerate for per-collector scrape metrics and scrape-timeout-offset flag (1c0baba)
• regenerate for stream E collector enhancements (0803709)
• site: add troubleshooting and upgrading pages, promote security in nav, custom-CA example (033068b)

Tests

• dhcp: pool helper unit tests (7905998)

CI/CD

• add Claude issue-triage workflow (42e64c7)
• add hadolint + trivy Docker security scans (bcda939)
• adopt shared rknightion/.github reusable security workflows (6c309b3)
• auto-assign maintainer on new issues (notify by email) (0f8197c)
• fail the build when generated docs drift from code (e73c073)
• fix Renovate automerge stall + add required ci-success gate (a94ed62)
• harden GitHub Actions workflows (zizmor) (1349dc4)
• hybrid issue-triage (no-tools AI analysis + deterministic apply) (93cba4a)
• OPNsense API contract canary + Claude enrichment workflows (689cd4f)
• reference rknightion/.github reusables @main (unpin from digest) (f2c44d4)
• report coverage to Codacy and ship SBOMs + third-party notices (7ea83cb)
• resolve actionlint/shellcheck + zizmor workflow findings (ceab80f)
• security: drop unused id-token: write from issue-triage (65deb99)
• security: replace LLM issue-triage with deterministic labeler (48acd41)