Add optional Prometheus metrics endpoint

.golangci.yml

@@ -29,6 +29,7 @@ linters:
             - github.com/libp2p/go-libp2p
             - github.com/miekg/pkcs11
             - github.com/aws/aws-sdk-go-v2
+            - github.com/prometheus/client_golang
             - github.com/spf13/cobra
             - github.com/stretchr/testify
             - github.com/decred/dcrd/dcrec/secp256k1

README.md

@@ -440,6 +440,17 @@ CometBFT are Ed25519, so no extra setup is needed.
 
 ---
 
+## Metrics
+
+kms can serve Prometheus metrics (an optional `metrics:` config block; the
+standard Go and process collectors plus signer metrics: connection state,
+requests and results including double-sign refusals, sign latency, the
+persisted double-sign state, backend latency and errors, and build/key
+metadata). See [docs/metrics.md](docs/metrics.md) for the full reference and
+starter alerts.
+
+---
+
 ## Testing
 
 ```sh

cmd/kms/main.go

@@ -3,6 +3,7 @@ package main
 
 import (
 	"fmt"
+	"net/http"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -15,6 +16,7 @@ import (
 	"github.com/cosmos/kms/config"
 	"github.com/cosmos/kms/internal/app"
 	"github.com/cosmos/kms/internal/identity"
+	"github.com/cosmos/kms/internal/metrics"
 	"github.com/cosmos/kms/internal/signer"
 	"github.com/cosmos/kms/internal/version"
 )
@@ -148,6 +150,23 @@ func startCmd() *cobra.Command {
 				defer srv.Close()
 			}
 
+			if cfg.Metrics != nil {
+				if cfg.Metrics.Listen == "" {
+					return fmt.Errorf("config: metrics block requires listen")
+				}
+				ms, merr := metrics.NewServer(cfg.Metrics.Listen)
+				if merr != nil {
+					return fmt.Errorf("metrics listen %q: %w", cfg.Metrics.Listen, merr)
+				}
+				go func() {
+					if serr := ms.Serve(); serr != nil && serr != http.ErrServerClosed {
+						logger.Error("metrics server failed", "err", serr)
+					}
+				}()
+				defer ms.Close()
+				logger.Info("serving metrics", "listen", cfg.Metrics.Listen, "path", "/metrics")
+			}
+
 			logger.Info("kms started; press Ctrl-C to stop")
 			sig := make(chan os.Signal, 1)
 			signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)

config/config.go

@@ -23,6 +23,14 @@ type Config struct {
 	Validators []Validator `yaml:"validators"`
 	Keys       []Key       `yaml:"keys"`
 	GRPC       *GRPCConfig `yaml:"grpc"`
+
+	Metrics *MetricsConfig `yaml:"metrics"`
+}
+
+// MetricsConfig enables the optional Prometheus endpoint. The listener
+// carries no authentication; restrict access by network policy.
+type MetricsConfig struct {
+	Listen string `yaml:"listen"` // host:port for GET /metrics
 }
 
 // Chain declares a chain and its double-sign state file.

config/default.yaml

@@ -61,3 +61,10 @@ keys:
 #       algorithm: ed25519       # optional; default "ed25519" for awskms
 #       key_id: alias/attestor   # KMS id, ARN, or alias/<name>
 #       region: us-east-1        # optional; AWS default chain otherwise
+
+# Optional Prometheus endpoint. Serves GET /metrics with the kms signer
+# metrics plus the standard Go and process collectors. The listener carries
+# NO authentication; restrict access with network controls.
+#
+# metrics:
+#   listen: 0.0.0.0:8545