From 691ef13cabd18c3f45f57ec6741a994fa62457ee Mon Sep 17 00:00:00 2001
From: Adrien le Maire <1832823+alemairebe@users.noreply.github.com>
Date: Sun, 29 Jan 2023 09:45:52 +0100
Subject: [PATCH 1/2] template metric toggle for mautrix bridges supporting it

---
 roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml | 3 +++
 .../matrix-bridge-mautrix-facebook/templates/config.yaml.j2   | 2 +-
 .../custom/matrix-bridge-mautrix-instagram/defaults/main.yml  | 3 +++
 .../matrix-bridge-mautrix-instagram/templates/config.yaml.j2  | 2 +-
 roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml   | 3 +++
 .../matrix-bridge-mautrix-signal/templates/config.yaml.j2     | 2 +-
 roles/custom/matrix-bridge-mautrix-twitter/defaults/main.yml  | 3 +++
 .../matrix-bridge-mautrix-twitter/templates/config.yaml.j2    | 2 +-
 roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml | 4 ++++
 .../matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2   | 4 ++--
 10 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
index 989720140be..7863270bdf0 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -46,6 +46,9 @@ matrix_mautrix_facebook_homeserver_token: ''
 # If false, created portal rooms will never be federated.
 matrix_mautrix_facebook_federate_rooms: true
 
+# Whether or not metrics endpoint should be enabled.
+matrix_mautrix_facebook_metrics_enabled: false
+
 matrix_mautrix_facebook_bridge_permissions: |
   {{
     {matrix_mautrix_facebook_homeserver_domain: 'user'}
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
index b8e25feebea..ce9aaea340a 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
@@ -62,7 +62,7 @@ appservice:
 
 # Prometheus telemetry config. Requires prometheus-client to be installed.
 metrics:
-    enabled: false
+    enabled: {{ matrix_mautrix_facebook_metrics_enabled }}
     listen_port: 8000
 
 # Bridge config
diff --git a/roles/custom/matrix-bridge-mautrix-instagram/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-instagram/defaults/main.yml
index 0e726aa8026..e9b6991bc8d 100644
--- a/roles/custom/matrix-bridge-mautrix-instagram/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-instagram/defaults/main.yml
@@ -47,6 +47,9 @@ matrix_mautrix_instagram_homeserver_token: ''
 # If false, created portal rooms will never be federated.
 matrix_mautrix_instagram_federate_rooms: true
 
+# Whether or not metrics endpoint should be enabled.
+matrix_mautrix_instagram_metrics_enabled: false
+
 # Database-related configuration fields.
 #
 # To use Postgres:
diff --git a/roles/custom/matrix-bridge-mautrix-instagram/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-instagram/templates/config.yaml.j2
index 039b9bfea58..70065785071 100644
--- a/roles/custom/matrix-bridge-mautrix-instagram/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-instagram/templates/config.yaml.j2
@@ -57,7 +57,7 @@ appservice:
 
 # Prometheus telemetry config. Requires prometheus-client to be installed.
 metrics:
-  enabled: false
+  enabled: {{ matrix_mautrix_instagram_metrics_enabled }}
   listen_port: 8000
 
 instagram:
diff --git a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
index 953d17078c5..fb5e49b138f 100644
--- a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -70,6 +70,9 @@ matrix_mautrix_signal_logging_level: WARNING
 # If false, created portal rooms will never be federated.
 matrix_mautrix_signal_federate_rooms: true
 
+# Whether or not metrics endpoint should be enabled.
+matrix_mautrix_signal_metrics_enabled: false
+
 # Database-related configuration fields
 #
 # This bridge only supports postgres.
diff --git a/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index 796a6e41a66..fbe2f4f3100 100644
--- a/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -67,7 +67,7 @@ appservice:
 
 # Prometheus telemetry config. Requires prometheus-client to be installed.
 metrics:
-    enabled: false
+    enabled: {{ matrix_mautrix_signal_metrics_enabled }}
     listen_port: 8000
 
 # Manhole config.
diff --git a/roles/custom/matrix-bridge-mautrix-twitter/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-twitter/defaults/main.yml
index 22475596ab5..372dd4b61f7 100644
--- a/roles/custom/matrix-bridge-mautrix-twitter/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-twitter/defaults/main.yml
@@ -78,6 +78,9 @@ matrix_mautrix_twitter_appservice_bot_username: twitterbot
 # Specifies the default log level for all bridge loggers.
 matrix_mautrix_twitter_logging_level: WARNING
 
+# Whether or not metrics endpoint should be enabled.
+matrix_mautrix_twitter_metrics_enabled: false
+
 # Default configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.
 #
diff --git a/roles/custom/matrix-bridge-mautrix-twitter/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-twitter/templates/config.yaml.j2
index da823d1ebfd..5b79a073ec1 100644
--- a/roles/custom/matrix-bridge-mautrix-twitter/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-twitter/templates/config.yaml.j2
@@ -65,7 +65,7 @@ appservice:
 
 # Prometheus telemetry config. Requires prometheus-client to be installed.
 metrics:
-    enabled: false
+    enabled: {{ matrix_mautrix_twitter_metrics_enabled }}
     listen_port: 8000
 
 # Bridge config
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml
index 449ace05fb5..91e27dc016d 100644
--- a/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml
@@ -47,6 +47,10 @@ matrix_mautrix_whatsapp_logging_level: 'warn'
 # If false, created portal rooms will never be federated.
 matrix_mautrix_whatsapp_federate_rooms: true
 
+# Whether or not metrics endpoint should be enabled.
+matrix_mautrix_whatsapp_metrics_enabled: false
+
+
 # Database-related configuration fields.
 #
 # To use SQLite, stick to these defaults.
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2
index 0962ac4dd82..1c6b59d4d43 100644
--- a/roles/custom/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2
@@ -67,9 +67,9 @@ segment_key: null
 # Prometheus config.
 metrics:
     # Enable prometheus metrics?
-    enabled: false
+    enabled: {{ matrix_mautrix_whatsapp_metrics_enabled }}
     # IP and port where the metrics listener should be. The path is always /metrics
-    listen: 127.0.0.1:8001
+    listen: 0.0.0.0:8001
 
 # Config for things that are directly sent to WhatsApp.
 whatsapp:

From 9eaf6944e3c6d8ea8f1094dc515713053e190573 Mon Sep 17 00:00:00 2001
From: Adrien le Maire <1832823+alemairebe@users.noreply.github.com>
Date: Sun, 29 Jan 2023 15:13:42 +0100
Subject: [PATCH 2/2] add nginx proxy connfig for mautrix metrics

---
 .../tasks/inject_into_nginx_proxy.yml         | 25 ++++++++++++++
 .../tasks/inject_into_nginx_proxy.yml         | 33 +++++++++++++++++++
 .../tasks/main.yml                            |  9 +++++
 .../tasks/inject_into_nginx_proxy.yml         | 33 +++++++++++++++++++
 .../tasks/main.yml                            |  9 +++++
 .../tasks/inject_into_nginx_proxy.yml         | 33 +++++++++++++++++++
 .../tasks/main.yml                            |  9 +++++
 .../defaults/main.yml                         |  1 -
 .../tasks/inject_into_nginx_proxy.yml         | 33 +++++++++++++++++++
 .../tasks/main.yml                            |  9 +++++
 10 files changed, 193 insertions(+), 1 deletion(-)
 create mode 100644 roles/custom/matrix-bridge-mautrix-instagram/tasks/inject_into_nginx_proxy.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-signal/tasks/inject_into_nginx_proxy.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-twitter/tasks/inject_into_nginx_proxy.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-whatsapp/tasks/inject_into_nginx_proxy.yml

diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
index b9f95cb7d7a..db4d906f068 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
@@ -42,3 +42,28 @@
       URL endpoint to the matrix-mautrix-facebook container.
       You can expose the container's port using the `matrix_mautrix_facebook_container_http_host_bind_port` variable.
   when: "not matrix_nginx_proxy_enabled | default(False) | bool"
+
+- name: Generate mautrix-facebook metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook)
+  ansible.builtin.set_fact:
+    matrix_mautrix_facebook_nginx_metrics_configuration_block: |
+      location /metrics/mautrix-facebook {
+        {% if matrix_nginx_proxy_enabled | default(False) %}
+          {# Use the embedded DNS resolver in Docker containers to discover the service #}
+          resolver 127.0.0.11 valid=5s;
+          set $backend "matrix-mautrix-facebook:8000";
+          proxy_pass http://$backend/metrics;
+        {% else %}
+          return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
+        {% endif %}
+      }
+  when: matrix_mautrix_facebook_metrics_enabled | bool
+
+- name: Register mautrix-facebook metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook)
+  ansible.builtin.set_fact:
+    matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
+      {{
+        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+        +
+        [matrix_mautrix_facebook_nginx_metrics_configuration_block]
+      }}
+  when: matrix_mautrix_facebook_metrics_enabled | bool
diff --git a/roles/custom/matrix-bridge-mautrix-instagram/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-instagram/tasks/inject_into_nginx_proxy.yml
new file mode 100644
index 00000000000..90d91c6d447
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-instagram/tasks/inject_into_nginx_proxy.yml
@@ -0,0 +1,33 @@
+---
+
+- name: Fail if matrix-nginx-proxy role already executed
+  ansible.builtin.fail:
+    msg: >-
+      Trying to append mautrix-whatapp-metrics's reverse-proxying configuration to matrix-nginx-proxy,
+      but it's pointless since the matrix-nginx-proxy role had already executed.
+      To fix this, please change the order of roles in your playbook,
+      so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-instagram role.
+  when: matrix_nginx_proxy_role_executed | default(False) | bool
+
+- name: Generate mautrix-instagram metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-instagram)
+  ansible.builtin.set_fact:
+    matrix_mautrix_instagram_nginx_metrics_configuration_block: |
+      location /metrics/mautrix-instagram {
+        {% if matrix_nginx_proxy_enabled | default(False) %}
+          {# Use the embedded DNS resolver in Docker containers to discover the service #}
+          resolver 127.0.0.11 valid=5s;
+          set $backend "matrix-mautrix-instagram:8000";
+          proxy_pass http://$backend/metrics;
+        {% else %}
+          return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
+        {% endif %}
+      }
+
+- name: Register mautrix-instagram metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-instagram)
+  ansible.builtin.set_fact:
+    matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
+      {{
+        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+        +
+        [matrix_mautrix_instagram_nginx_metrics_configuration_block]
+      }}
diff --git a/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml
index 2bd0417eed5..0b3a722df7b 100644
--- a/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-instagram/tasks/main.yml
@@ -1,5 +1,14 @@
 ---
 
+- block:
+    - when: matrix_mautrix_instagram_enabled | bool and matrix_mautrix_instagram_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
+  tags:
+    - setup-all
+    - setup-nginx-proxy
+    - install-all
+    - install-nginx-proxy
+
 - block:
     - when: matrix_mautrix_instagram_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
diff --git a/roles/custom/matrix-bridge-mautrix-signal/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-signal/tasks/inject_into_nginx_proxy.yml
new file mode 100644
index 00000000000..4bb6f6bd2eb
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-signal/tasks/inject_into_nginx_proxy.yml
@@ -0,0 +1,33 @@
+---
+
+- name: Fail if matrix-nginx-proxy role already executed
+  ansible.builtin.fail:
+    msg: >-
+      Trying to append mautrix-whatapp-metrics's reverse-proxying configuration to matrix-nginx-proxy,
+      but it's pointless since the matrix-nginx-proxy role had already executed.
+      To fix this, please change the order of roles in your playbook,
+      so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-signal role.
+  when: matrix_nginx_proxy_role_executed | default(False) | bool
+
+- name: Generate mautrix-signal metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-signal)
+  ansible.builtin.set_fact:
+    matrix_mautrix_signal_nginx_metrics_configuration_block: |
+      location /metrics/mautrix-signal {
+        {% if matrix_nginx_proxy_enabled | default(False) %}
+          {# Use the embedded DNS resolver in Docker containers to discover the service #}
+          resolver 127.0.0.11 valid=5s;
+          set $backend "matrix-mautrix-signal:8000";
+          proxy_pass http://$backend/metrics;
+        {% else %}
+          return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
+        {% endif %}
+      }
+
+- name: Register mautrix-signal metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-signal)
+  ansible.builtin.set_fact:
+    matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
+      {{
+        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+        +
+        [matrix_mautrix_signal_nginx_metrics_configuration_block]
+      }}
diff --git a/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml
index 0c0a1239f40..9473344b96b 100644
--- a/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-signal/tasks/main.yml
@@ -1,5 +1,14 @@
 ---
 
+- block:
+    - when: matrix_mautrix_signal_enabled | bool and matrix_mautrix_signal_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
+  tags:
+    - setup-all
+    - setup-nginx-proxy
+    - install-all
+    - install-nginx-proxy
+
 - block:
     - when: matrix_mautrix_signal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
diff --git a/roles/custom/matrix-bridge-mautrix-twitter/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-twitter/tasks/inject_into_nginx_proxy.yml
new file mode 100644
index 00000000000..df296dc674c
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-twitter/tasks/inject_into_nginx_proxy.yml
@@ -0,0 +1,33 @@
+---
+
+- name: Fail if matrix-nginx-proxy role already executed
+  ansible.builtin.fail:
+    msg: >-
+      Trying to append mautrix-whatapp-metrics's reverse-proxying configuration to matrix-nginx-proxy,
+      but it's pointless since the matrix-nginx-proxy role had already executed.
+      To fix this, please change the order of roles in your playbook,
+      so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-twitter role.
+  when: matrix_nginx_proxy_role_executed | default(False) | bool
+
+- name: Generate mautrix-twitter metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-twitter)
+  ansible.builtin.set_fact:
+    matrix_mautrix_twitter_nginx_metrics_configuration_block: |
+      location /metrics/mautrix-twitter {
+        {% if matrix_nginx_proxy_enabled | default(False) %}
+          {# Use the embedded DNS resolver in Docker containers to discover the service #}
+          resolver 127.0.0.11 valid=5s;
+          set $backend "matrix-mautrix-twitter:8000";
+          proxy_pass http://$backend/metrics;
+        {% else %}
+          return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
+        {% endif %}
+      }
+
+- name: Register mautrix-twitter metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-twitter)
+  ansible.builtin.set_fact:
+    matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
+      {{
+        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+        +
+        [matrix_mautrix_twitter_nginx_metrics_configuration_block]
+      }}
diff --git a/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml
index f8dbc28be15..9eb444a7673 100644
--- a/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-twitter/tasks/main.yml
@@ -1,5 +1,14 @@
 ---
 
+- block:
+    - when: matrix_mautrix_twitter_enabled | bool and matrix_mautrix_twitter_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
+  tags:
+    - setup-all
+    - setup-nginx-proxy
+    - install-all
+    - install-nginx-proxy
+
 - block:
     - when: matrix_mautrix_twitter_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml
index 91e27dc016d..6e85599ae60 100644
--- a/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/defaults/main.yml
@@ -50,7 +50,6 @@ matrix_mautrix_whatsapp_federate_rooms: true
 # Whether or not metrics endpoint should be enabled.
 matrix_mautrix_whatsapp_metrics_enabled: false
 
-
 # Database-related configuration fields.
 #
 # To use SQLite, stick to these defaults.
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/inject_into_nginx_proxy.yml
new file mode 100644
index 00000000000..e3fc3d16240
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/inject_into_nginx_proxy.yml
@@ -0,0 +1,33 @@
+---
+
+- name: Fail if matrix-nginx-proxy role already executed
+  ansible.builtin.fail:
+    msg: >-
+      Trying to append mautrix-whatapp-metrics's reverse-proxying configuration to matrix-nginx-proxy,
+      but it's pointless since the matrix-nginx-proxy role had already executed.
+      To fix this, please change the order of roles in your playbook,
+      so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-whatsapp role.
+  when: matrix_nginx_proxy_role_executed | default(False) | bool
+
+- name: Generate mautrix-whatsapp metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-whatsapp)
+  ansible.builtin.set_fact:
+    matrix_mautrix_whatsapp_nginx_metrics_configuration_block: |
+      location /metrics/mautrix-whatsapp {
+        {% if matrix_nginx_proxy_enabled | default(False) %}
+          {# Use the embedded DNS resolver in Docker containers to discover the service #}
+          resolver 127.0.0.11 valid=5s;
+          set $backend "matrix-mautrix-whatsapp:8001";
+          proxy_pass http://$backend/metrics;
+        {% else %}
+          return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
+        {% endif %}
+      }
+
+- name: Register mautrix-whatsapp metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-whatsapp)
+  ansible.builtin.set_fact:
+    matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
+      {{
+        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+        +
+        [matrix_mautrix_whatsapp_nginx_metrics_configuration_block]
+      }}
diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml
index fdb654315b3..b49a13003db 100644
--- a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/main.yml
@@ -1,5 +1,14 @@
 ---
 
+- block:
+    - when: matrix_mautrix_whatsapp_enabled | bool and matrix_mautrix_whatsapp_metrics_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
+  tags:
+    - setup-all
+    - setup-nginx-proxy
+    - install-all
+    - install-nginx-proxy
+
 - block:
     - when: matrix_mautrix_whatsapp_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"