Prometheus metrics

devtls exposes your organization’s latest results in the Prometheus text format at https://devtls.fleeq.net/metrics. It needs a paid plan and an API key.

Metrics

Metric	Labels	Value
devtls_domains_total	—	number of domains in the organization
devtls_domain_score	host, port, grade	latest score, 0–100
devtls_domain_reachable	host, port	1 if the latest scan reached the host, else 0
devtls_domain_cert_expiry_days	host, port	days until the certificate expires

Values change when a domain is scanned, so with daily re-scans a scrape interval of a few minutes is plenty.

Scrape config

scrape_configs:
  - job_name: devtls
    scheme: https
    metrics_path: /metrics
    scrape_interval: 5m
    authorization:
      type: Bearer
      credentials_file: /etc/prometheus/devtls-api-key
    static_configs:
      - targets: ['devtls.fleeq.net']

Example alerts

groups:
  - name: devtls
    rules:
      - alert: TLSCertificateExpiringSoon
        expr: devtls_domain_cert_expiry_days < 14
        labels: { severity: warning }
        annotations:
          summary: '{{ $labels.host }}:{{ $labels.port }} certificate expires in {{ $value }} days'
      - alert: TLSScoreLow
        expr: devtls_domain_score < 80
        for: 1d
        annotations:
          summary: '{{ $labels.host }} scores {{ $value }} (grade {{ $labels.grade }})'
      - alert: TLSHostUnreachable
        expr: devtls_domain_reachable == 0
        for: 1d