feat(admin): add config and upstream health admin endpoints

Admin API endpoints:
- GET /admin/config - dump current running configuration (JSON)
- GET /admin/upstreams - show upstream health status with targets

Graceful reload improvements:
- Wire SIGHUP to trigger ConfigManager::reload()
- Add SignalManager for thread-to-async signal bridging
- Validate configs before applying (reject invalid, keep current)
- Add auto_reload config option for file watching

Trace ID improvements:
- Add TinyFlake format (11-char Base58, operator-friendly)
- Configurable via trace-id-format in server config
- Default to TinyFlake, fallback to UUID

Default config now includes 5 admin routes on port 9090:
- /health, /healthz, /ready (health check)
- /metrics (Prometheus)
- /admin/config, /config (config dump)
- /admin/upstreams, /upstreams (upstream health)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: raffaelschneider

config/sentinel.kdl

@@ -471,11 +471,31 @@ observability {
         format "json"  // "json" or "pretty"
         timestamps #true
 
+        // Access log - all HTTP requests with trace_id for correlation
         access-log {
             enabled #true
             file "/var/log/sentinel/access.log"
-            format "combined"
+            format "json"  // "json" or "combined"
             buffer-size 8192
+            include-trace-id #true
+        }
+
+        // Error log - warnings and errors
+        error-log {
+            enabled #true
+            file "/var/log/sentinel/error.log"
+            level "warn"  // minimum level: "warn" or "error"
+            buffer-size 8192
+        }
+
+        // Audit log - security events (blocked requests, agent decisions, WAF)
+        audit-log {
+            enabled #true
+            file "/var/log/sentinel/audit.log"
+            buffer-size 8192
+            log-blocked #true
+            log-agent-decisions #true
+            log-waf-events #true
         }
     }
 

crates/common/src/lib.rs

@@ -26,7 +26,7 @@ pub use errors::{SentinelError, SentinelResult};
 pub use limits::{Limits, RateLimiter};
 
 // Re-export common types
-pub use types::{CorrelationId, RequestId};
+pub use types::{CorrelationId, RequestId, TraceIdFormat};
 
 // Re-export circuit breaker
 pub use circuit_breaker::CircuitBreaker;

crates/common/src/types.rs

@@ -207,6 +207,57 @@ pub enum TlsVersion {
     Tls13,
 }
 
+/// Trace ID format selection
+///
+/// Controls how trace IDs are generated for request tracing.
+///
+/// # Formats
+///
+/// - **TinyFlake** (default): 11-character Base58 encoded ID with time prefix.
+///   Operator-friendly format designed for easy copying and log correlation.
+///   Example: `k7BxR3nVp2Ym`
+///
+/// - **UUID**: Standard 36-character UUID v4 format with dashes.
+///   Guaranteed unique, widely compatible.
+///   Example: `550e8400-e29b-41d4-a716-446655440000`
+///
+/// # Configuration
+///
+/// ```kdl
+/// server {
+///     trace-id-format "tinyflake"  // or "uuid"
+/// }
+/// ```
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum TraceIdFormat {
+    /// TinyFlake format: 11-char Base58, time-prefixed (default)
+    #[default]
+    TinyFlake,
+
+    /// UUID v4 format: 36-char with dashes
+    Uuid,
+}
+
+impl TraceIdFormat {
+    /// Parse format from string (case-insensitive)
+    pub fn from_str_loose(s: &str) -> Self {
+        match s.to_lowercase().as_str() {
+            "uuid" | "uuid4" | "uuidv4" => TraceIdFormat::Uuid,
+            _ => TraceIdFormat::TinyFlake, // Default to TinyFlake
+        }
+    }
+}
+
+impl fmt::Display for TraceIdFormat {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            TraceIdFormat::TinyFlake => write!(f, "tinyflake"),
+            TraceIdFormat::Uuid => write!(f, "uuid"),
+        }
+    }
+}
+
 impl fmt::Display for TlsVersion {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {

crates/config/src/defaults.rs

@@ -73,6 +73,28 @@ routes {
         service-type "builtin"
         builtin-handler "metrics"
     }
+
+    // Config dump endpoint on admin port
+    route "config" {
+        priority "high"
+        matches {
+            path "/admin/config"
+            path "/config"
+        }
+        service-type "builtin"
+        builtin-handler "config"
+    }
+
+    // Upstream health status endpoint on admin port
+    route "upstreams" {
+        priority "high"
+        matches {
+            path "/admin/upstreams"
+            path "/upstreams"
+        }
+        service-type "builtin"
+        builtin-handler "upstreams"
+    }
 }
 
 limits {
@@ -107,6 +129,8 @@ pub fn create_default_config() -> Config {
             user: None,
             group: None,
             working_directory: None,
+            trace_id_format: Default::default(),
+            auto_reload: false,
         },
         listeners: vec![
             ListenerConfig {
@@ -183,6 +207,44 @@ pub fn create_default_config() -> Config {
                 api_schema: None,
                 error_pages: None,
             },
+            RouteConfig {
+                id: "config".to_string(),
+                priority: Priority::High,
+                matches: vec![
+                    MatchCondition::Path("/admin/config".to_string()),
+                    MatchCondition::Path("/config".to_string()),
+                ],
+                upstream: None,
+                service_type: ServiceType::Builtin,
+                policies: RoutePolicies::default(),
+                filters: vec![],
+                builtin_handler: Some(BuiltinHandler::Config),
+                waf_enabled: false,
+                circuit_breaker: None,
+                retry_policy: None,
+                static_files: None,
+                api_schema: None,
+                error_pages: None,
+            },
+            RouteConfig {
+                id: "upstreams".to_string(),
+                priority: Priority::High,
+                matches: vec![
+                    MatchCondition::Path("/admin/upstreams".to_string()),
+                    MatchCondition::Path("/upstreams".to_string()),
+                ],
+                upstream: None,
+                service_type: ServiceType::Builtin,
+                policies: RoutePolicies::default(),
+                filters: vec![],
+                builtin_handler: Some(BuiltinHandler::Upstreams),
+                waf_enabled: false,
+                circuit_breaker: None,
+                retry_policy: None,
+                static_files: None,
+                api_schema: None,
+                error_pages: None,
+            },
         ],
         upstreams: HashMap::new(),
         filters: HashMap::new(),
@@ -209,8 +271,10 @@ mod tests {
     fn test_create_default_config() {
         let config = create_default_config();
         assert_eq!(config.listeners.len(), 2);
-        assert_eq!(config.routes.len(), 3);
+        assert_eq!(config.routes.len(), 5);
         assert!(config.routes.iter().any(|r| r.id == "status"));
         assert!(config.routes.iter().any(|r| r.id == "health"));
+        assert!(config.routes.iter().any(|r| r.id == "config"));
+        assert!(config.routes.iter().any(|r| r.id == "upstreams"));
     }
 }

crates/config/src/kdl_parser.rs

@@ -8,7 +8,7 @@ use std::collections::HashMap;
 use std::path::PathBuf;
 
 use sentinel_common::limits::Limits;
-use sentinel_common::types::LoadBalancingAlgorithm;
+use sentinel_common::types::{LoadBalancingAlgorithm, TraceIdFormat};
 
 use crate::filters::*;
 use crate::observability::ObservabilityConfig;
@@ -173,6 +173,10 @@ pub fn parse_kdl_document(doc: kdl::KdlDocument) -> Result<Config> {
 
 /// Parse server configuration block
 pub fn parse_server_config(node: &kdl::KdlNode) -> Result<ServerConfig> {
+    let trace_id_format = get_string_entry(node, "trace-id-format")
+        .map(|s| TraceIdFormat::from_str_loose(&s))
+        .unwrap_or_default();
+
     Ok(ServerConfig {
         worker_threads: get_int_entry(node, "worker-threads")
             .map(|v| v as usize)
@@ -188,6 +192,8 @@ pub fn parse_server_config(node: &kdl::KdlNode) -> Result<ServerConfig> {
         user: get_string_entry(node, "user"),
         group: get_string_entry(node, "group"),
         working_directory: get_string_entry(node, "working-directory").map(PathBuf::from),
+        trace_id_format,
+        auto_reload: get_bool_entry(node, "auto-reload").unwrap_or(false),
     })
 }
 
@@ -291,6 +297,8 @@ pub fn parse_routes(node: &kdl::KdlNode) -> Result<Vec<RouteConfig>> {
                         "health" => Some(BuiltinHandler::Health),
                         "metrics" => Some(BuiltinHandler::Metrics),
                         "not-found" | "not_found" => Some(BuiltinHandler::NotFound),
+                        "config" => Some(BuiltinHandler::Config),
+                        "upstreams" => Some(BuiltinHandler::Upstreams),
                         _ => None,
                     }
                 });

crates/config/src/lib.rs

@@ -63,8 +63,8 @@ pub use multi_file::{ConfigDirectory, MultiFileLoader};
 
 // Observability
 pub use observability::{
-    AccessLogConfig, LoggingConfig, MetricsConfig, ObservabilityConfig, TracingBackend,
-    TracingConfig,
+    AccessLogConfig, AuditLogConfig, ErrorLogConfig, LoggingConfig, MetricsConfig,
+    ObservabilityConfig, TracingBackend, TracingConfig,
 };
 
 // Routes
@@ -77,6 +77,9 @@ pub use routes::{
 // Server
 pub use server::{ListenerConfig, ListenerProtocol, ServerConfig, TlsConfig};
 
+// Re-export TraceIdFormat from common for convenience
+pub use sentinel_common::TraceIdFormat;
+
 // Upstreams
 pub use upstreams::{
     ConnectionPoolConfig, HealthCheck, UpstreamConfig, UpstreamPeer, UpstreamTarget,
@@ -387,6 +390,8 @@ impl Config {
                 user: None,
                 group: None,
                 working_directory: None,
+                trace_id_format: Default::default(),
+                auto_reload: false,
             },
             listeners: vec![ListenerConfig {
                 id: "http".to_string(),

crates/config/src/multi_file.rs

@@ -11,6 +11,8 @@ use std::fs;
 use std::path::{Path, PathBuf};
 use tracing::{debug, info, warn};
 
+use sentinel_common::TraceIdFormat;
+
 use crate::{
     AgentConfig, Config, Limits, ListenerConfig, ObservabilityConfig, RouteConfig, ServerConfig,
     UpstreamConfig, WafConfig,
@@ -497,6 +499,10 @@ fn parse_server(node: &KdlNode) -> Result<ServerConfig> {
         user: get_string_entry(node, "user"),
         group: get_string_entry(node, "group"),
         working_directory: get_string_entry(node, "working-directory").map(PathBuf::from),
+        trace_id_format: get_string_entry(node, "trace-id-format")
+            .map(|s| TraceIdFormat::from_str_loose(&s))
+            .unwrap_or_default(),
+        auto_reload: get_bool_entry(node, "auto-reload").unwrap_or(false),
     })
 }