feat: API monitoring

[wylited]

How this monitoring system will work is that each API service will expose a fastify-metrics endpoint at /metrics.
this is a Prometheus scrapable endpoint for our monitoring platform.

Furthermore, if provided, it will fastify will log automatically to a Loki logging server using pino-loki.

The rest of the setup for monitoring will be done on the server.

[Copilot]

Pull request overview

This PR adds comprehensive API monitoring capabilities to the Fastify-based template service by integrating Prometheus metrics collection and optional Loki logging.

Key Changes:

• Adds fastify-metrics plugin to expose a /metrics endpoint for Prometheus scraping with default metrics enabled
• Integrates pino-loki transport for optional centralized logging to a Loki server
• Introduces optional LOKI_HOST environment variable for conditional logging configuration

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

File	Description
yarn.lock	Adds dependency resolutions for fastify-metrics (v12.1.0), pino-loki (v3.0.0), prom-client (v15.1.3), and their transitive dependencies
package.json	Adds fastify-metrics and pino-loki as runtime dependencies
src/app.ts	Configures metrics endpoint registration and conditional Loki logging transport based on LOKI_HOST environment variable
.env.example	Documents the optional LOKI_HOST environment variable with example configuration

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The use of CommonJS require with createRequire is inconsistent with the codebase's ES module pattern. The codebase consistently uses ES6 import statements (see imports in src/plugins/sensible.ts, src/plugins/auth.ts). Consider checking if fastify-metrics supports ES6 imports, or if it doesn't, document why the require pattern is necessary here.

Suggested change

	import { createRequire } from "module";
	import * as path from "path";
	import { fileURLToPath } from "url";
	const require = createRequire(import.meta.url);
	const fastifyMetrics = require("fastify-metrics");
	import fastifyMetrics from "fastify-metrics";
	import * as path from "path";
	import { fileURLToPath } from "url";

[Copilot]

The application label is "template-service" but the package name is "template-api" (see package.json line 3). This naming inconsistency could cause confusion when monitoring multiple services. Consider using the package name for consistency, or establish a clear convention for service naming in monitoring labels.

Suggested change

	labels: { application: "template-service" },
	labels: { application: packageJson.name },

[Copilot]

The metrics endpoint is exposed without any authentication or access control. This could expose sensitive operational metrics to unauthorized users. Consider adding authentication to the /metrics endpoint or documenting that it should be protected at the infrastructure level (e.g., via firewall rules or network policies).

[FlandiaYingman]

This should be a concern. I plan to reverse proxy this endpoint with some authentication, probably something similar to the web test endpoint (use GitHub auth). Can you also check it?

[Copilot]

If options.logger is already set elsewhere in the application (for example, passed via CLI or environment variables), this configuration will overwrite it without warning. Consider using a merge strategy or checking if logger is already configured before overwriting it.

[Copilot]

The pino-loki transport configuration uses an interval of 5, but doesn't specify the unit. According to pino-loki documentation, the interval is in seconds. Consider adding a comment to clarify this is 5 seconds, or use a more self-documenting value like a constant (e.g., LOKI_BATCH_INTERVAL_SECONDS = 5) to improve code clarity.