fix(config): supporting multiple env variables in a value.

ref #9
feat(k8s): adding kubernetes support
2023-07-10 17:02:56 +02:00 · 2023-07-10 17:02:56 +02:00 · 2023-07-08 12:19:43 -06:00 · 2023-07-08 12:18:38 -06:00 · 2023-07-07 12:22:31 -06:00 · 2023-07-07 10:20:27 -06:00
86 changed files with 2774 additions and 233 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,9 @@
+/admin-key.json
+/config.yml
+/tools
+/out
+/dist
+/data
+/bin
+/.bouncer-token
+/.env
--- a/.gitignore
+++ b/.gitignore
@ -7,4 +7,5 @@
 /admin-key.json
 /.bouncer-token
 /data
-/out
+/out
+.dockerconfigjson
--- a/31
+++ b/31
@ -1,30 +1,49 @@
-FROM golang:1.19 AS BUILD
+FROM golang:1.20 AS BUILD

 RUN apt-get update \
    && apt-get install -y make

+ARG YQ_VERSION=4.34.1
+
+RUN mkdir -p /usr/local/bin \
+    && wget -O /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64 \
+    && chmod +x /usr/local/bin/yq
+
 COPY . /src

 WORKDIR /src

 RUN make GORELEASER_ARGS='build --rm-dist --single-target --snapshot' goreleaser

-FROM busybox:latest AS RUNTIME
+# Patch config
+RUN /src/dist/bouncer_linux_amd64_v1/bouncer -c '' config dump > /src/dist/bouncer_linux_amd64_v1/config.yml \
+    && yq -i '.layers.queue.templateDir = "/usr/share/bouncer/layers/queue/templates"' /src/dist/bouncer_linux_amd64_v1/config.yml \
+    && yq -i '.admin.auth.privateKey = "/etc/bouncer/admin-key.json"' /src/dist/bouncer_linux_amd64_v1/config.yml \
+    && yq -i '.redis.adresses = ["redis:6379"]' /src/dist/bouncer_linux_amd64_v1/config.yml
+
+FROM alpine:3.18 AS RUNTIME

 ARG DUMB_INIT_VERSION=1.2.5

+RUN apk add --no-cache ca-certificates
+
 RUN mkdir -p /usr/local/bin \
    && wget -O /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_x86_64 \
    && chmod +x /usr/local/bin/dumb-init

 ENTRYPOINT ["/usr/local/bin/dumb-init", "--"]

-COPY --from=BUILD /src/dist/bouncer_linux_amd64_v1 /app
-COPY --from=BUILD /src/config.yml /etc/bouncer/config.yml
+RUN mkdir -p /usr/local/bin /usr/share/bouncer/bin /etc/bouncer
+
+COPY --from=BUILD /src/dist/bouncer_linux_amd64_v1/bouncer /usr/share/bouncer/bin/bouncer
+COPY --from=BUILD /src/layers /usr/share/bouncer/layers
+COPY --from=BUILD /src/dist/bouncer_linux_amd64_v1/config.yml /etc/bouncer/config.yml
+
+RUN ln -s /usr/share/bouncer/bin/bouncer /usr/local/bin/bouncer

 EXPOSE 8080
 EXPOSE 8081

-ENTRYPOINT ["/app/bouncer"]
+ENV BOUNCER_CONFIG=/etc/bouncer/config.yml

-CMD ["bouncer", "run", "-c", "/etc/bouncer/config.yml"]
+CMD ["bouncer"]
--- a/27
+++ b/27
@ -29,7 +29,7 @@ pipeline {
            }
        }

-        stage('Release') {
+        stage('Release binaries and packages') {
            when {
                anyOf {
                    branch 'master'
@ -50,6 +50,31 @@ pipeline {
                }
            }
        }
+
+        stage('Build and release Docker image') {
+            when {
+                anyOf {
+                    branch 'master'
+                    branch 'develop'
+                }
+            }
+            steps {
+                script {
+                    withCredentials([
+                        usernamePassword([
+                            credentialsId: 'kipp-credentials',
+                            usernameVariable: 'DOCKER_REGISTRY_USERNAME',
+                            passwordVariable: 'DOCKER_REGISTRY_PASSWORD'
+                        ])
+                    ]) {
+                        sh """
+                        echo '${env.DOCKER_REGISTRY_PASSWORD}' | docker login --username '${env.DOCKER_REGISTRY_USERNAME}' --password-stdin reg.cadoles.com
+                        make docker-build docker-release
+                        """
+                    }
+                }
+            }
+        }
    }

    post {
--- a/43
+++ b/43
@ -5,11 +5,11 @@ GITCHLOG_ARGS ?=
 SHELL := /bin/bash

 BOUNCER_VERSION ?= 
-GIT_VERSION := $(shell git describe --always)
+GIT_COMMIT := $(shell git rev-parse --short HEAD)
 DATE_VERSION := $(shell date +%Y.%-m.%-d)
-FULL_VERSION := v$(DATE_VERSION)-$(GIT_VERSION)$(if $(shell git diff --stat),-dirty,)
+FULL_VERSION := v$(DATE_VERSION)-$(GIT_COMMIT)$(if $(shell git diff --stat),-dirty,)

-DOCKER_IMAGE_NAME ?= cadoles/bouncer
+DOCKER_IMAGE_NAME ?= reg.cadoles.com/cadoles/bouncer
 DOCKER_IMAGE_TAG ?= $(FULL_VERSION)

 GOTEST_ARGS ?= -short
@ -25,16 +25,6 @@ test: test-go ## Executing tests
 test-go: deps
 	( set -o allexport && source .env && set +o allexport && go test -v -count=1 $(GOTEST_ARGS) ./... )

-test-install-script: tools/bin/bash_unit
-	tools/bin/bash_unit ./misc/script/test_install.sh
-
-tools/bin/bash_unit:
-	mkdir -p tools/bin
-	cd tools/bin && bash <(curl -s https://raw.githubusercontent.com/pgrange/bash_unit/master/install.sh)	
-
-lint: ## Lint sources code
-	golangci-lint run --enable-all $(LINT_ARGS)
-
 build: build-bouncer ## Build artefacts

 build-bouncer: deps ## Build executable
@ -83,14 +73,13 @@ finish-release:
 	git push --all
 	git push --tags

-install-git-hooks:
-	git config core.hooksPath .githooks
-
 docker-build:
 	docker build -t $(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG) .
+	docker tag $(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG) $(DOCKER_IMAGE_NAME):latest

 docker-release:
 	docker push $(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG)
+	docker push $(DOCKER_IMAGE_NAME):latest

 gitea-release: tools/gitea-release/bin/gitea-release.sh goreleaser
 	mkdir -p .gitea-release
@ -106,12 +95,18 @@ gitea-release: tools/gitea-release/bin/gitea-release.sh goreleaser
 		GITEA_RELEASE_BASE_URL="https://forge.cadoles.com" \
 		GITEA_RELEASE_VERSION="$(FULL_VERSION)" \
 		GITEA_RELEASE_NAME="$(FULL_VERSION)" \
-		GITEA_RELEASE_COMMITISH_TARGET="$(GIT_VERSION)" \
+		GITEA_RELEASE_COMMITISH_TARGET="$(GIT_COMMIT)" \
 		GITEA_RELEASE_IS_DRAFT="false" \
 		GITEA_RELEASE_BODY="" \
 		GITEA_RELEASE_ATTACHMENTS="$$(find .gitea-release/* -type f)" \
 		tools/gitea-release/bin/gitea-release.sh

+grafterm: tools/grafterm/bin/grafterm
+	tools/grafterm/bin/grafterm -c ./misc/grafterm/dashboard.json -v job=bouncer-proxy -r 5s
+
+siege:
+	siege -i -c 100 -f ./misc/siege/urls.txt
+
 tools/gitea-release/bin/gitea-release.sh:
 	mkdir -p tools/gitea-release/bin
 	curl --output tools/gitea-release/bin/gitea-release.sh https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/gitea/gitea-release.sh
@ -121,6 +116,10 @@ tools/modd/bin/modd:
 	mkdir -p tools/modd/bin
 	GOBIN=$(PWD)/tools/modd/bin go install github.com/cortesi/modd/cmd/modd@latest

+tools/grafterm/bin/grafterm:
+	mkdir -p tools/grafterm/bin
+	GOBIN=$(PWD)/tools/grafterm/bin go install github.com/slok/grafterm/cmd/grafterm@v0.2.0
+
 full-version:
 	@echo $(FULL_VERSION)

@ -139,4 +138,12 @@ run-redis:
 redis-shell:
 	docker exec -it \
 		bouncer-redis \
-		redis-cli
+		redis-cli
+
+run-prometheus:
+	docker kill bouncer-prometheus || exit 0
+	docker run --rm -t \
+		--name bouncer-prometheus \
+		--network host \
+		-v $(PWD)/misc/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml \
+		prom/prometheus
--- a/doc/README.md
+++ b/doc/README.md
@ -3,17 +3,22 @@
 - [(FR) - Premiers pas](./fr/getting-started.md)
 - [(FR) - Architecture générale](./fr/general-architecture.md)

+## Exemples
+
+- [(FR) - Exemple de déploiement multi-noeuds](../misc/docker-compose/README.md)
 ## Référence

 - [(FR) - Layers](./fr/references/layers/README.md)
- [Fichier de configuration](../misc/packaging/common/config.yml)
+- [(FR) - Fichier de configuration](../misc/packaging/common/config.yml)
+- [(FR) - API d'administration](./fr/references/admin_api.md)

 ## Tutoriels

 ### Utilisation

- [(FR) - Ajouter un calque de type "file d'attente"](./fr/tutorials/add-queue-layer.md)
+- [(FR) - Ajouter un layer de type "file d'attente"](./fr/tutorials/add-queue-layer.md)

 ### Développement

+- [(FR) - Démarrer avec les sources](./fr/tutorials/getting-started-with-sources.md)
 - [(FR) - Créer son propre layer](./fr/tutorials/create-custom-layer.md)
--- a/doc/fr/references/admin_api.md
+++ b/doc/fr/references/admin_api.md
@ -0,0 +1,182 @@
+# API d'administration
+
+## Authentification
+
+L'ensemble des appels aux APIs HTTP du service `bouncer-admin` sont authentifiées via l'utilisation d'un jeton [JWT](https://datatracker.ietf.org/doc/html/rfc7519) signé par la clé privée du serveur.
+
+Le jeton d'accès doit être transmis avec l'ensemble des appels aux points d'entrée via l'entête HTTP `Authorization` en respectant la forme suivante:
+
+```
+Authorization: Bearer <jwt>
+```
+
+### Génération d'un jeton d'authentification
+
+La génération d'un jeton d'authentification s'effectue via la commande suivante:
+
+```shell
+bouncer auth create-token --subject "<subject>" --role "<role>"
+```
+
+Où:
+
+- `"<subject>"` est une chaîne de caractère arbitraire ayant pour objectif d'identifier de manière unique l'utilisateur associé au jeton;
+- `"<role>"` peut prendre une des deux valeurs `reader` ou `writer` correspondant aux droits suivants respectifs:
+    - droit en lecture sur l'ensemble des entités (proxy, layer);
+    - droit en lecture ET en écriture sur l'ensemble des entités.
+
+
+## Points d'entrée
+
+### `POST /api/v1/proxies`
+
+Créer un nouveau proxy
+
+#### Exemple de corps de requête
+
+```json5
+{
+  "name": "myproxy",                // OBLIGATOIRE - Nom du proxy
+  "to": "https://www.cadoles.com",  // OBLIGATOIRE - Site distant ciblé par le proxy
+  "from": ["*"]                     // OPTIONNEL - Liste de patrons de filtrage associés au proxy
+}
+```
+
+#### Exemple de résultat
+
+```json5
+{
+    "data": {
+        "proxy": {
+            "name": "myproxy",
+            "weight": 0,
+            "enabled": false,
+            "to": "https://www.cadoles.com",
+            "from": ["*"],
+            "createdAt": "2018-12-10T13:45:00.000Z",
+            "updatedAt": "2018-12-10T13:45:00.000Z"
+        }
+    }
+}
+```
+
+#### Source
+
+Voir [`internal/admin/proxy_route.go#createProxy()`](../../../internal/admin/proxy_route.go#createProxy)
+
+### `GET /api/v1/proxies/{proxyName}`
+
+Récupérer les informations complètes sur un proxy
+
+#### Paramètres
+
+- `{proxyName}` - Nom du proxy
+
+#### Exemple de résultat
+
+```json5
+{
+    "data": {
+        "proxy": {
+            "name": "myproxy",
+            "weight": 0,
+            "enabled": false,
+            "to": "https://www.cadoles.com",
+            "from": ["*"],
+            "createdAt": "2018-12-10T13:45:00.000Z",
+            "updatedAt": "2018-12-10T13:45:00.000Z"
+        }
+    }
+}
+```
+
+#### Source
+
+Voir [`internal/admin/proxy_route.go#getProxy()`](../../../internal/admin/proxy_route.go#getProxy)
+
+### `PUT /api/v1/proxies/{proxyName}`
+
+Modifier un proxy
+
+#### Exemple de corps de requête
+
+```json5
+{
+  "to": "https://www.cadoles.com",  // OPTIONNEL - Site distant ciblé par le proxy
+  "from": ["mylocalproxydomain:*"], // OPTIONNEL - Liste de patrons de filtrage associés au proxy
+  "weight": 100,                    // OPTIONNEL - Poids à associer au proxy
+  "enabled": true,                  // OPTIONNEL - Activer/désactiver le proxy
+}
+```
+
+#### Exemple de résultat
+
+```json5
+{
+    "data": {
+        "proxy": {
+            "name": "myproxy",
+            "weight": 100,
+            "enabled": true,
+            "to": "https://www.cadoles.com",
+            "from": ["mylocalproxydomain:*"],
+            "createdAt": "2018-12-10T13:45:00.000Z",
+            "updatedAt": "2020-10-02T15:09:00.000Z"
+        }
+    }
+}
+```
+
+#### Source
+
+Voir [`internal/admin/proxy_route.go#updateProxy()`](../../../internal/admin/proxy_route.go#updateProxy)
+
+### `GET /api/v1/proxies?names={name1,name2,...}`
+
+Lister les proxies existants
+
+#### Paramètres
+
+- `{names}` - Optionnel - Liste des noms de proxy à appliquer en tant que filtre
+
+#### Exemple de résultat
+
+```json5
+{
+    "data": {
+        "proxies": [
+            {
+                "name": "myproxy",
+                "weight": 0,
+                "enabled": false,
+            }
+        ]
+    }
+}
+```
+
+#### Source
+
+Voir [`internal/admin/proxy_route.go#queryProxy()`](../../../internal/admin/proxy_route.go#queryProxy)
+
+## `DELETE /api/v1/proxies/{proxyName}`
+
+Supprimer le proxy
+
+#### Paramètres
+
+- `{proxyName}` - Nom du proxy
+
+#### Exemple de résultat
+
+```json5
+{
+    "data": {
+        "proxyName": "myproxy"
+    }
+}
+```
+
+#### Source
+
+Voir [`internal/admin/proxy_route.go#deleteProxy()`](../../../internal/admin/proxy_route.go#deleteProxy)
--- a/doc/fr/references/layers/README.md
+++ b/doc/fr/references/layers/README.md
@ -2,4 +2,5 @@

 Vous trouverez ci-dessous la liste des entités "Layer" activables sur vos entité "Proxy":

- [Queue](./queue.md) - File d'attente dynamique
+- [Queue](./queue.md) - File d'attente dynamique
+- [Circuit Breaker](./circuitbreaker.md) - Coupure d'accès à un site ou une sous section de celui ci
--- a/doc/fr/references/layers/circuitbreaker.md
+++ b/doc/fr/references/layers/circuitbreaker.md
@ -0,0 +1,37 @@
+# Layer "Circuit Breaker"
+
+## Description
+
+Ce layer permet de bloquer l'accès à un site (ou une section de celui ci) ciblé par un proxy.
+
+## Type
+
+`circuitbreaker`
+
+## Options
+
+### `authorizedCIDRs`
+
+- **Type:** `[]string`
+- **Valeur par défaut:** `[]`
+- **Description:** Autoriser les adresses distantes contenues dans un des masques réseau (en notation ["CIDR"](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) définis à contourner la restriction d'accès.
+
+### `matchURLs`
+
+- **Type:** `[]string`
+- **Valeur par défaut:** `["*"]`
+- **Description:** Limiter l'action du layer à cette liste de patrons d'URLs. 
+
+    Par exemple, si vous souhaitez limiter votre restriction d'accès à l'ensemble d'une section "`/blog`" d'un site, vous pouvez déclarer la valeur `["*/blog*"]`. Les autres URLs du site ne seront pas affectées par la restriction.
+
+### `templateBlock`
+
+- **Type:** `string`
+- **Valeur par défaut:** `"default"`
+- **Description:** Bloc du template HTML pour effectuer le rendu de la page indiquant la restriction d'accès.
+
+    Voir le [fichier de configuration de référence](../../../../misc/packaging/common/config.yml), section `layers.circuitbreaker` pour voir les options permettant de personnaliser le chemin du répertoire contenant les templates.
+
+### Schéma
+
+Voir le [schéma JSON](../../../../internal/proxy/director/layer/circuitbreaker/layer-options.json).
--- a/doc/fr/references/layers/queue.md
+++ b/doc/fr/references/layers/queue.md
@ -22,6 +22,14 @@ Ce layer permet d'ajouter un mécanisme de file d'attente dynamique au proxy ass
 - **Valeur par défaut:** `1m`
 - **Description:** Durée de vie d'une session dans la file d'attente sans activité avant expiration.

+### `matchURLs`
+
+- **Type:** `[]string`
+- **Valeur par défaut:** `["*"]`
+- **Description:** Limiter l'action de la file d'attente à cette liste de patrons d'URLs. 
+
+    Par exemple, si vous souhaitez limiter votre file à l'ensemble d'une section "`/blog`" d'un site, vous pouvez déclarer la valeur `["*/blog*"]`. Les autres URLs du site ne seront pas affectées par cette file d'attente.
+
 ### Schéma

-Voir le [schéma JSON](../../../../internal/queue/schema/layer-options.json).
+Voir le [schéma JSON](../../../../internal/proxy/director/layer/queue/schema/layer-options.json).
--- a/doc/fr/tutorials/add-queue-layer.md
+++ b/doc/fr/tutorials/add-queue-layer.md
@ -2,7 +2,7 @@

 ## Étapes

-1. Sur le serveur hébergeant les services Bouncer, utiliser le CLI pour créer un nouveau calque ("layer") pour votre proxy. Dans l'exemple, nous utiliserons le proxy `cadoles` créé dans le cadre du tutoriels ["Premiers pas"](../getting-started.md).
+1. Sur le serveur hébergeant les services Bouncer, utiliser le CLI pour créer un nouveau layer pour votre proxy. Dans l'exemple, nous utiliserons le proxy `cadoles` créé dans le cadre du tutoriels ["Premiers pas"](../getting-started.md).

    ```bash
    # Création d'un calque nommé 'my-queue' pour le proxy 'cadoles' de type 'queue'
@ -19,7 +19,7 @@
    +----------+-------+---------+--------+---------+-------------------------+-------------------------+
    ```

-2. À ce stade, le calque est encore inactif. Définir la capacité de la file d'attente à 1 et activer le calque en utilisant le CLI
+2. À ce stade, le layer est encore inactif. Définir la capacité de la file d'attente à 1 et activer le layer en utilisant le CLI:

    ```bash
    bouncer admin layer update --proxy-name cadoles --layer-name my-queue --layer-enabled=true --layer-options '{"capacity": 1}'
--- a/doc/fr/tutorials/create-custom-layer.md
+++ b/doc/fr/tutorials/create-custom-layer.md
@ -1,64 +1,11 @@
 # Créer son propre layer

-Dans ce tutoriel, nous allons voir comme implémenter un layer personnalisé qui permettra d'ajouter une authentification de type [`Basic Auth](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication) à un proxy.
+Dans ce tutoriel, nous verrons comment implémenter un layer personnalisé qui permettra d'ajouter une authentification de type [`Basic Auth](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication) à un proxy.

 ## Prérequis

-Les éléments suivants doivent être installés sur votre machine:
-
- [Golang > 1.20](https://go.dev/)
- [Docker](https://www.docker.com/)
- [Git](https://git-scm.com/)
- [GNU Make](https://www.gnu.org/software/make/)
-
+Avoir un environnement de développement local fonctionnel. Voir tutoriel ["Démarrer avec les sources"](./getting-started-with-sources.md).
 ## Étapes
-
-### Préparer son environnement de développement
-
-1. Cloner le dépôt des sources du projet Bouncer
-
-    ```
-    git clone https://forge.cadoles.com/Cadoles/bouncer
-    ```
-
-2. Se positionner dans le répertoire du projet
-
-    ```
-    cd bouncer
-    ```
-
-3. Lancer le projet en mode "développement"
-
-    ```
-    make watch
-    ```
-
-Si toutes les dépendances sont correctement installées et configurées sur votre machine, la console devrait afficher une série de messages pour ensuite s'arrêter sur quelque chose ressemblant à:
-
-```
-14:47:06: daemon: make run BOUNCER_CMD="--config config.yml server admin run"
-2023-06-23 20:47:06.095 [INFO]	<./internal/command/server/admin/run.go:42>	RunCommand.func1	listening	{"url": "http://127.0.0.1:8081"}
-2023-06-23 20:47:06.095 [INFO]	<./internal/admin/server.go:126>	(*Server).run	http server listening
-14:47:06: daemon: make run-redis
-bouncer-redis
-docker run --rm -t \
-	--name bouncer-redis \
-	-v /home/wpetit/workspace/bouncer/data/redis:/data \
-	-p 6379:6379 \
-	redis:alpine3.17 \
-	redis-server --save 60 1 --loglevel warning
-1:C 23 Jun 2023 20:47:06.754 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
-1:C 23 Jun 2023 20:47:06.754 # Redis version=7.0.11, bits=64, commit=00000000, modified=0, pid=1, just started
-1:C 23 Jun 2023 20:47:06.754 # Configuration loaded
-1:M 23 Jun 2023 20:47:06.759 # Warning: Could not create server TCP listening socket ::*:6379: unable to bind socket, errno: 97
-1:M 23 Jun 2023 20:47:06.760 # Server initialized
-1:M 23 Jun 2023 20:47:06.760 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect
-```
-
-À ce stade, le serveur `bouncer-admin` écoute sur http://127.0.0.1:8081 et le serveur `bouncer-proxy` sur http://127.0.0.1:8080.
-
-L'outil [`modd`](https://github.com/cortesi/modd) est utilisé pour surveiller les modifications sur les sources et relancer automatiquement la compilation et les services en cas de changement.
-
 ### Préparer la structure de base du nouveau layer

 Une implémetation d'un layer se compose majoritairement de 3 éléments:
--- a/doc/fr/tutorials/getting-started-with-sources.md
+++ b/doc/fr/tutorials/getting-started-with-sources.md
@ -0,0 +1,132 @@
+# Démarrer avec les sources
+
+Dans ce tutoriel, nous verrons comment lancer un environnement de développement en local sur notre machine afin de travailler sur les sources de Bouncer.
+
+## Prérequis
+
+Les éléments suivants doivent être installés sur votre machine:
+
+- [Golang > 1.20](https://go.dev/)
+- [Docker](https://www.docker.com/)
+- [Git](https://git-scm.com/)
+- [GNU Make](https://www.gnu.org/software/make/)
+
+Les ports suivants doivent être disponibles sur votre machine:
+
+- `8080`
+- `8081`
+
+## Étapes
+
+1. Cloner le dépôt des sources du projet Bouncer
+
+    ```
+    git clone https://forge.cadoles.com/Cadoles/bouncer
+    ```
+
+2. Se positionner dans le répertoire du projet
+
+    ```
+    cd bouncer
+    ```
+
+3. Lancer le projet en mode "développement"
+
+    ```
+    make watch
+    ```
+
+Si toutes les dépendances sont correctement installées et configurées sur votre machine, la console devrait afficher une série de messages pour ensuite s'arrêter sur quelque chose ressemblant à:
+
+```
+14:47:06: daemon: make run BOUNCER_CMD="--config config.yml server admin run"
+2023-06-23 20:47:06.095 [INFO]	<./internal/command/server/admin/run.go:42>	RunCommand.func1	listening	{"url": "http://127.0.0.1:8081"}
+2023-06-23 20:47:06.095 [INFO]	<./internal/admin/server.go:126>	(*Server).run	http server listening
+14:47:06: daemon: make run-redis
+bouncer-redis
+docker run --rm -t \
+	--name bouncer-redis \
+	-v /home/wpetit/workspace/bouncer/data/redis:/data \
+	-p 6379:6379 \
+	redis:alpine3.17 \
+	redis-server --save 60 1 --loglevel warning
+1:C 23 Jun 2023 20:47:06.754 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
+1:C 23 Jun 2023 20:47:06.754 # Redis version=7.0.11, bits=64, commit=00000000, modified=0, pid=1, just started
+1:C 23 Jun 2023 20:47:06.754 # Configuration loaded
+1:M 23 Jun 2023 20:47:06.759 # Warning: Could not create server TCP listening socket ::*:6379: unable to bind socket, errno: 97
+1:M 23 Jun 2023 20:47:06.760 # Server initialized
+1:M 23 Jun 2023 20:47:06.760 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. Being disabled, it can can also cause failures without low memory condition, see https://github.com/jemalloc/jemalloc/issues/1328. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect
+```
+
+À ce stade, le serveur `bouncer-admin` écoute sur http://127.0.0.1:8081 et le serveur `bouncer-proxy` sur http://127.0.0.1:8080.
+
+> **Note**
+> 
+> L'outil [`modd`](https://github.com/cortesi/modd) est utilisé pour surveiller les modifications sur les sources et relancer automatiquement la compilation et les services en cas de changement.
+
+## Commandes `make` utiles
+
+### `make watch`
+
+Surveiller les sources, compiler celles ci en cas de modifications et lancer les services `bouncer-proxy` et `bouncer-admin`.
+
+### `make test`
+
+Exécuter les tests unitaires/d'intégration du projet.
+
+### `make build`
+
+Compiler une version de développement du binaire `bouncer`.
+
+### `make docker-build`
+
+Construire une image Docker pour Bouncer.
+
+Vous pouvez ensuite lancer l'image localement avec la commande:
+
+```
+docker run \
+    -it --rm \
+    reg.cadoles.com/cadoles/bouncer:<tag> \
+    -p 8080:8080 \
+    bouncer server proxy run
+```
+
+### `make grafterm`
+
+Afficher un tableau de bord [`grafterm`](https://github.com/slok/grafterm) branché sur l'instance Prometheus locale.
+
+### `make siege`
+
+Lancer une session de test [`siege`](https://github.com/JoeDog/siege) sur l'instance `bouncer-proxy` locale.
+## Arborescence du projet
+
+```bash
+.
+├── bin             # Répertoire de destination des binaires Go de développement
+├── cmd             # Package principal (main) du binaire Bouncer
+├── data            # Répertoire des données de développement (Redis)
+├── dist            # Répertoire de destination des archives/paquets pour la publication
+├── doc             # Répertoire de documentation du projet
+├── internal        # Source Go du projet
+│   ├── admin
+│   ├── auth
+│   ├── chi
+│   ├── client
+│   ├── command
+│   ├── config
+│   ├── format
+│   ├── imports
+│   ├── jwk
+│   ├── proxy
+│   ├── schema
+│   ├── setup
+│   └── store
+├── layers          # Fichiers annexes liés aux layers (templates HTML)
+│   └── queue
+├── misc            # Fichiers annexes
+│   ├── jenkins     # Fichiers liés au pipeline d'intégration continue Jenkins
+│   ├── logo        # Logo du projet
+│   └── packaging   # Fichiers liés à l'empaquetage des binaires
+└── tools           # Outils utilisés en développement
+```
--- a/go.mod
+++ b/go.mod
@ -3,13 +3,16 @@ module forge.cadoles.com/cadoles/bouncer
 go 1.20

 require (
-	forge.cadoles.com/Cadoles/go-proxy v0.0.0-20230512083245-e2dc3e1a0333
+	forge.cadoles.com/Cadoles/go-proxy v0.0.0-20230701194111-c6b3d482cca6
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/btcsuite/btcd/btcutil v1.1.3
+	github.com/drone/envsubst v1.0.3
+	github.com/getsentry/sentry-go v0.22.0
 	github.com/go-chi/chi/v5 v5.0.8
 	github.com/jedib0t/go-pretty/v6 v6.4.6
 	github.com/mitchellh/mapstructure v1.4.1
 	github.com/ory/dockertest/v3 v3.10.0
+	github.com/prometheus/client_golang v1.16.0
 	github.com/qri-io/jsonschema v0.2.1
 	github.com/redis/go-redis/v9 v9.0.4
 )
@ -21,6 +24,7 @@ require (
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/containerd/continuity v0.3.0 // indirect
@ -30,29 +34,35 @@ require (
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/huandu/xstrings v1.3.3 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/copystructure v1.0.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.0 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
 	github.com/opencontainers/runc v1.1.5 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.10.1 // indirect
 	github.com/qri-io/jsonpointer v0.1.1 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/rogpeppe/go-internal v1.10.0 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/spf13/cast v1.3.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
 	google.golang.org/genproto v0.0.0-20220314164441-57ef72a4c106 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

@ -60,21 +70,21 @@ require (
 	cdr.dev/slog v1.4.2 // indirect
 	github.com/alecthomas/chroma v0.10.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
 	github.com/dlclark/regexp2 v1.9.0 // indirect
 	github.com/fatih/color v1.15.0 // indirect
 	github.com/go-chi/cors v1.2.1
-	github.com/go-playground/locales v0.12.1 // indirect
-	github.com/go-playground/universal-translator v0.16.0 // indirect
+	github.com/go-playground/locales v0.14.0 // indirect
+	github.com/go-playground/universal-translator v0.18.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/uuid v1.3.0
-	github.com/leodido/go-urn v1.1.0 // indirect
+	github.com/leodido/go-urn v1.2.1 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.1 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc v1.0.4 // indirect
 	github.com/lestrrat-go/iter v1.0.2 // indirect
-	github.com/lestrrat-go/jwx/v2 v2.0.9
+	github.com/lestrrat-go/jwx/v2 v2.0.11
 	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/lib/pq v1.10.0 // indirect
 	github.com/lithammer/shortuuid/v4 v4.0.0
@ -86,10 +96,10 @@ require (
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	gitlab.com/wpetit/goweb v0.0.0-20230419082146-a94d9ed7202b
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/crypto v0.8.0 // indirect
+	golang.org/x/crypto v0.9.0 // indirect
 	golang.org/x/mod v0.9.0 // indirect
-	golang.org/x/sys v0.7.0 // indirect
-	golang.org/x/term v0.7.0 // indirect
+	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
 	golang.org/x/tools v0.7.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	gopkg.in/go-playground/validator.v9 v9.29.1 // indirect
--- a/go.sum
+++ b/go.sum
@ -49,8 +49,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-forge.cadoles.com/Cadoles/go-proxy v0.0.0-20230512083245-e2dc3e1a0333 h1:dAajr9wX8WuFPrwjbKNXRmbF+4AaAT7bUj66G7gdZ+c=
-forge.cadoles.com/Cadoles/go-proxy v0.0.0-20230512083245-e2dc3e1a0333/go.mod h1:o8ZK5v/3J1dRmklFVn1l6WHAyQ3LgegyHjRIT8KLAFw=
+forge.cadoles.com/Cadoles/go-proxy v0.0.0-20230701194111-c6b3d482cca6 h1:FTk0ZoaV5N8Tkps5Da5RrDMZZXSHZIuD67Hy1Y4fsos=
+forge.cadoles.com/Cadoles/go-proxy v0.0.0-20230701194111-c6b3d482cca6/go.mod h1:o8ZK5v/3J1dRmklFVn1l6WHAyQ3LgegyHjRIT8KLAFw=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@ -80,6 +80,8 @@ github.com/alecthomas/kong v0.2.1-0.20190708041108-0548c6b1afae/go.mod h1:+inYUS
 github.com/alecthomas/kong-hcl v0.1.8-0.20190615233001-b21fea9723c8/go.mod h1:MRgZdU3vrFd05IQ89AxUZ0aYdF39BYoNFa324SodPCA=
 github.com/alecthomas/repr v0.0.0-20180818092828-117648cd9897/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bsm/ginkgo/v2 v2.7.0 h1:ItPMPH90RbmZJt5GtkcNvIRuGEdwlBItdNVoyzaNQao=
 github.com/bsm/gomega v1.26.0 h1:LhQm+AFcgV2M0WyKroMASzAzCAJVpAxQXv4SaI9a69Y=
 github.com/btcsuite/btcd v0.20.1-beta/go.mod h1:wVuoA8VJLEcwgqHBwHmzLRazpKxTv13Px/pDuV7OomQ=
@ -141,9 +143,10 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/crypto/blake256 v1.0.0/go.mod h1:sQl2p6Y26YV+ZOcSTP6thNdn47hh8kt6rqSlvmrXFAc=
+github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeCxkaw7y45JueMRL4DIyJDKs=
-github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0 h1:HbphB4TFFXpv7MNrT52FGrrgVXF1owhMVTHFZIlnvd4=
-github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0/go.mod h1:DZGJHZMqrU4JJqFAWUS2UO1+lbSKsdiOoYi9Zzey7Fc=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
 github.com/decred/dcrd/lru v1.0.0/go.mod h1:mxKOwFd7lFjN2GZYsiz/ecgqR6kkYAl+0pz0tEMk218=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
@ -160,6 +163,8 @@ github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKoh
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/drone/envsubst v1.0.3 h1:PCIBwNDYjs50AsLZPYdfhSATKaRg/FJmDc2D6+C2x8g=
+github.com/drone/envsubst v1.0.3/go.mod h1:N2jZmlMufstn1KEqvbHjw40h1KyTmnVzHcSc9bFiJ2g=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@ -176,19 +181,24 @@ github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBD
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/getsentry/sentry-go v0.22.0 h1:XNX9zKbv7baSEI65l+H1GEJgSeIC1c7EN5kluWaP6dM=
+github.com/getsentry/sentry-go v0.22.0/go.mod h1:lc76E2QywIyW8WuBnwl8Lc4bkmQH4+w1gwTf25trprY=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-chi/chi v4.0.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
 github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
 github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
 github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
 github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-playground/locales v0.12.1 h1:2FITxuFt/xuCNP1Acdhv62OzaCiviiE4kotfhkmOqEc=
 github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
-github.com/go-playground/universal-translator v0.16.0 h1:X++omBR/4cE2MNg91AoC3rmGrCjJ8eAeUP/K/EKx4DM=
+github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
+github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
 github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
+github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
+github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
@ -228,8 +238,9 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@ -248,7 +259,6 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@ -307,14 +317,14 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/kkdai/bstream v0.0.0-20161212061736-f391b8402d23/go.mod h1:J+Gs4SYgM6CZQHDETBtE9HaSEkGmuNXF86RwHhHUvq4=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/leodido/go-urn v1.1.0 h1:Sm1gr51B1kKyfD2BlRcLSiEkffoG96g6TPv6eRoEiB8=
 github.com/leodido/go-urn v1.1.0/go.mod h1:+cyI34gQWZcE1eQU7NVgKkkzdXDQHr1dBMtdAPozLkw=
+github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
+github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
 github.com/lestrrat-go/blackmagic v1.0.1 h1:lS5Zts+5HIC/8og6cGHb0uCcNCa3OUt1ygh3Qz2Fe80=
 github.com/lestrrat-go/blackmagic v1.0.1/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
@ -323,8 +333,8 @@ github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJG
 github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
 github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
 github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
-github.com/lestrrat-go/jwx/v2 v2.0.9 h1:TRX4Q630UXxPVLvP5vGaqVJO7S+0PE6msRZUsFSBoC8=
-github.com/lestrrat-go/jwx/v2 v2.0.9/go.mod h1:K68euYaR95FnL0hIQB8VvzL70vB7pSifbJUydCTPmgM=
+github.com/lestrrat-go/jwx/v2 v2.0.11 h1:ViHMnaMeaO0qV16RZWBHM7GTrAnX2aFLVKofc7FuKLQ=
+github.com/lestrrat-go/jwx/v2 v2.0.11/go.mod h1:ZtPtMFlrfDrH2Y0iwfa3dRFn8VzwBrB+cyrm3IBWdDg=
 github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
@ -347,6 +357,8 @@ github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp9
 github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
@ -379,6 +391,7 @@ github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuh
 github.com/ory/dockertest/v3 v3.10.0 h1:4K3z2VMe8Woe++invjaTB7VRyQXQy5UY+loujO4aNE4=
 github.com/ory/dockertest/v3 v3.10.0/go.mod h1:nr57ZbRWMqfsdGdFNLHz5jjNdDb7VVFnzAeW1n5N1Lg=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c/go.mod h1:X07ZCGwUbLaax7L0S3Tw4hpejzu63ZrrQiUe6W0hcy0=
+github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@ -386,7 +399,15 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/profile v1.6.0/go.mod h1:qBsxPvzyUincmltOk6iyRVxHYg4adc0OFOv72ZdLa18=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
+github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
+github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
+github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
 github.com/qri-io/jsonpointer v0.1.1 h1:prVZBZLL6TW5vsSB9fFHFAMBLI4b0ri5vribQlTJiBA=
 github.com/qri-io/jsonpointer v0.1.1/go.mod h1:DnJPaYgiKu56EuDp8TU5wFLdZIcAnb/uH9v37ZaMV64=
 github.com/qri-io/jsonschema v0.2.1 h1:NNFoKms+kut6ABPf6xiKNM5214jzxAhDBrPHCJ97Wg0=
@ -397,20 +418,22 @@ github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
@ -428,8 +451,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.4/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7/go.mod h1:q4W45IWZaF22tdD+VEXcAWRA037jwmWEB5VWYORlTpc=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
@ -475,9 +498,8 @@ golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
-golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@ -560,8 +582,8 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@ -590,8 +612,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181128092732-4ed8d59d0b35/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@ -656,22 +678,24 @@ golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@ -683,8 +707,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@ -889,12 +913,12 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/go-playground/assert.v1 v1.2.1 h1:xoYuJVE7KT85PYWrN730RguIQO0ePzVRfFMXadIrXTM=
--- a/internal/admin/error.go
+++ b/internal/admin/error.go
@ -1,11 +1,14 @@
 package admin

 import (
+	"context"
 	"fmt"
 	"net/http"

 	"forge.cadoles.com/cadoles/bouncer/internal/schema"
+	"github.com/getsentry/sentry-go"
 	"gitlab.com/wpetit/goweb/api"
+	"gitlab.com/wpetit/goweb/logger"
 )

 const ErrCodeAlreadyExist api.ErrorCode = "already-exist"
@ -29,3 +32,8 @@ func invalidDataErrorResponse(w http.ResponseWriter, r *http.Request, err *schem

 	return
 }
+
+func logAndCaptureError(ctx context.Context, message string, err error) {
+	sentry.CaptureException(err)
+	logger.Error(ctx, message, logger.E(err))
+}
--- a/internal/admin/layer_route.go
+++ b/internal/admin/layer_route.go
@ -1,6 +1,7 @@
 package admin

 import (
+	"fmt"
 	"net/http"
 	"sort"

@ -10,7 +11,6 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/pkg/errors"
 	"gitlab.com/wpetit/goweb/api"
-	"gitlab.com/wpetit/goweb/logger"
 )

 type QueryLayerResponse struct {
@ -38,7 +38,7 @@ func (s *Server) queryLayer(w http.ResponseWriter, r *http.Request) {
 		options...,
 	)
 	if err != nil {
-		logger.Error(ctx, "could not list layers", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not list layers", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -85,7 +85,7 @@ func (s *Server) getLayer(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not get layer", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not get layer", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -120,7 +120,7 @@ func (s *Server) deleteLayer(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not delete layer", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not delete layer", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -156,7 +156,7 @@ func (s *Server) createLayer(w http.ResponseWriter, r *http.Request) {

 	layerName, err := store.ValidateName(createLayerReq.Name)
 	if err != nil {
-		logger.Error(r.Context(), "invalid 'name' parameter", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "invalid 'name' parameter", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeInvalidRequest, nil)

 		return
@ -165,7 +165,7 @@ func (s *Server) createLayer(w http.ResponseWriter, r *http.Request) {
 	layerType := store.LayerType(createLayerReq.Type)

 	if !setup.LayerTypeExists(layerType) {
-		logger.Error(r.Context(), "unknown layer type", logger.E(errors.WithStack(err)), logger.F("layerType", layerType))
+		logAndCaptureError(ctx, fmt.Sprintf("unknown layer type '%s'", layerType), errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeInvalidRequest, nil)

 		return
@ -179,7 +179,7 @@ func (s *Server) createLayer(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not create layer", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not create layer", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -223,7 +223,7 @@ func (s *Server) updateLayer(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not get layer", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not get layer", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -247,7 +247,7 @@ func (s *Server) updateLayer(w http.ResponseWriter, r *http.Request) {
 	if updateLayerReq.Options != nil {
 		layerOptionsSchema, err := setup.GetLayerOptionsSchema(layer.Type)
 		if err != nil {
-			logger.Error(r.Context(), "could not retrieve layer options schema", logger.E(errors.WithStack(err)))
+			logAndCaptureError(ctx, "could not retrieve layer options schema", errors.WithStack(err))
 			api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 			return
@ -258,7 +258,7 @@ func (s *Server) updateLayer(w http.ResponseWriter, r *http.Request) {
 		}(updateLayerReq.Options)

 		if err := schema.Validate(ctx, layerOptionsSchema, rawOptions); err != nil {
-			logger.Error(r.Context(), "could not validate layer options", logger.E(errors.WithStack(err)))
+			logAndCaptureError(ctx, "could not validate layer options", errors.WithStack(err))

 			var invalidDataErr *schema.InvalidDataError
 			if errors.As(err, &invalidDataErr) {
@ -286,7 +286,7 @@ func (s *Server) updateLayer(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not update layer", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not update layer", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -300,21 +300,7 @@ func getLayerName(w http.ResponseWriter, r *http.Request) (store.LayerName, bool

 	name, err := store.ValidateName(rawLayerName)
 	if err != nil {
-		logger.Error(r.Context(), "could not parse layer name", logger.E(errors.WithStack(err)))
-		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)
-
-		return "", false
-	}
-
-	return store.LayerName(name), true
-}
-
-func geLayerName(w http.ResponseWriter, r *http.Request) (store.LayerName, bool) {
-	rawLayerName := chi.URLParam(r, "layerName")
-
-	name, err := store.ValidateName(rawLayerName)
-	if err != nil {
-		logger.Error(r.Context(), "could not parse layer name", logger.E(errors.WithStack(err)))
+		logAndCaptureError(r.Context(), "could not parse layer name", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 		return "", false
--- a/internal/admin/proxy_route.go
+++ b/internal/admin/proxy_route.go
@ -11,7 +11,6 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/pkg/errors"
 	"gitlab.com/wpetit/goweb/api"
-	"gitlab.com/wpetit/goweb/logger"
 )

 type QueryProxyResponse struct {
@ -37,7 +36,7 @@ func (s *Server) queryProxy(w http.ResponseWriter, r *http.Request) {
 		options...,
 	)
 	if err != nil {
-		logger.Error(ctx, "could not list proxies", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not list proxies", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -79,7 +78,7 @@ func (s *Server) getProxy(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not get proxy", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not get proxy", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -109,7 +108,7 @@ func (s *Server) deleteProxy(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not delete proxy", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not delete proxy", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -140,14 +139,14 @@ func (s *Server) createProxy(w http.ResponseWriter, r *http.Request) {

 	name, err := store.ValidateName(createProxyReq.Name)
 	if err != nil {
-		logger.Error(r.Context(), "could not parse 'name' parameter", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not parse 'name' parameter", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 		return
 	}

 	if _, err := url.Parse(createProxyReq.To); err != nil {
-		logger.Error(r.Context(), "could not parse 'to' parameter", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not parse 'to' parameter", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 		return
@ -161,7 +160,7 @@ func (s *Server) createProxy(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not create proxy", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not create proxy", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -207,7 +206,7 @@ func (s *Server) updateProxy(w http.ResponseWriter, r *http.Request) {
 	if updateProxyReq.To != nil {
 		_, err := url.Parse(*updateProxyReq.To)
 		if err != nil {
-			logger.Error(r.Context(), "could not parse 'to' parameter", logger.E(errors.WithStack(err)))
+			logAndCaptureError(ctx, "could not parse 'to' parameter", errors.WithStack(err))
 			api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 			return
@ -235,7 +234,7 @@ func (s *Server) updateProxy(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		logger.Error(ctx, "could not update proxy", logger.E(errors.WithStack(err)))
+		logAndCaptureError(ctx, "could not update proxy", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusInternalServerError, api.ErrCodeUnknownError, nil)

 		return
@ -249,7 +248,7 @@ func getProxyName(w http.ResponseWriter, r *http.Request) (store.ProxyName, bool

 	name, err := store.ValidateName(rawProxyName)
 	if err != nil {
-		logger.Error(r.Context(), "could not parse proxy name", logger.E(errors.WithStack(err)))
+		logAndCaptureError(r.Context(), "could not parse proxy name", errors.WithStack(err))
 		api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 		return "", false
@ -263,7 +262,7 @@ func getIntQueryParam(w http.ResponseWriter, r *http.Request, param string, defa
 	if rawValue != "" {
 		value, err := strconv.ParseInt(rawValue, 10, 64)
 		if err != nil {
-			logger.Error(r.Context(), "could not parse int param", logger.F("param", param), logger.E(errors.WithStack(err)))
+			logAndCaptureError(r.Context(), "could not parse int param", errors.WithStack(err))
 			api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 			return 0, false
@ -296,7 +295,7 @@ func getStringableSliceValues[T ~string](w http.ResponseWriter, r *http.Request,
 		for _, rv := range rawValues {
 			v, err := validate(rv)
 			if err != nil {
-				logger.Error(r.Context(), "could not parse ids slice param", logger.F("param", param), logger.E(errors.WithStack(err)))
+				logAndCaptureError(r.Context(), "could not parse ids slice param", errors.WithStack(err))
 				api.ErrorResponse(w, http.StatusBadRequest, api.ErrCodeMalformedRequest, nil)

 				return nil, false
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@ -9,13 +9,16 @@ import (

 	"forge.cadoles.com/cadoles/bouncer/internal/auth"
 	"forge.cadoles.com/cadoles/bouncer/internal/auth/jwt"
+	bouncerChi "forge.cadoles.com/cadoles/bouncer/internal/chi"
 	"forge.cadoles.com/cadoles/bouncer/internal/config"
 	"forge.cadoles.com/cadoles/bouncer/internal/jwk"
 	"forge.cadoles.com/cadoles/bouncer/internal/store"
+	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
 	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"gitlab.com/wpetit/goweb/logger"
 )

@ -89,7 +92,21 @@ func (s *Server) run(parentCtx context.Context, addrs chan net.Addr, errs chan e

 	router := chi.NewRouter()

-	router.Use(middleware.Logger)
+	if s.serverConfig.HTTP.UseRealIP {
+		router.Use(middleware.RealIP)
+	}
+
+	router.Use(middleware.RequestLogger(bouncerChi.NewLogFormatter()))
+
+	if s.serverConfig.Sentry.DSN != "" {
+		logger.Info(ctx, "enabling sentry http middleware")
+
+		sentryMiddleware := sentryhttp.New(sentryhttp.Options{
+			Repanic: true,
+		})
+
+		router.Use(sentryMiddleware.Handle)
+	}

 	corsMiddleware := cors.New(cors.Options{
 		AllowedOrigins:   s.serverConfig.CORS.AllowedOrigins,
@ -101,6 +118,25 @@ func (s *Server) run(parentCtx context.Context, addrs chan net.Addr, errs chan e

 	router.Use(corsMiddleware.Handler)

+	if s.serverConfig.Metrics.Enabled {
+		metrics := s.serverConfig.Metrics
+
+		logger.Info(ctx, "enabling metrics", logger.F("endpoint", metrics.Endpoint))
+
+		router.Group(func(r chi.Router) {
+			if metrics.BasicAuth != nil {
+				logger.Info(ctx, "enabling authentication on metrics endpoint")
+
+				r.Use(middleware.BasicAuth(
+					"metrics",
+					metrics.BasicAuth.CredentialsMap(),
+				))
+			}
+
+			r.Handle(string(metrics.Endpoint), promhttp.Handler())
+		})
+	}
+
 	router.Route("/api/v1", func(r chi.Router) {
 		r.Group(func(r chi.Router) {
 			r.Use(auth.Middleware(
--- a/internal/command/config/dump.go
+++ b/internal/command/config/dump.go
@ -18,6 +18,8 @@ func Dump() *cli.Command {
 		Usage: "Dump the current configuration",
 		Flags: flags,
 		Action: func(ctx *cli.Context) error {
+			logger.SetLevel(logger.LevelError)
+
 			conf, err := common.LoadConfig(ctx)
 			if err != nil {
 				return errors.Wrap(err, "Could not load configuration")
--- a/internal/command/main.go
+++ b/internal/command/main.go
@ -7,6 +7,7 @@ import (
 	"sort"
 	"time"

+	"github.com/getsentry/sentry-go"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
 )
@ -50,9 +51,10 @@ func Main(buildDate, projectVersion, gitRef, defaultConfigPath string, commands
 		},
 		Flags: []cli.Flag{
 			&cli.StringFlag{
-				Name:  "workdir",
-				Value: "",
-				Usage: "The working directory",
+				Name:    "workdir",
+				Value:   "",
+				EnvVars: []string{"BOUNCER_WORKDIR"},
+				Usage:   "The working directory",
 			},
 			&cli.StringFlag{
 				Name:   "projectVersion",
@ -89,6 +91,8 @@ func Main(buildDate, projectVersion, gitRef, defaultConfigPath string, commands
 			return
 		}

+		sentry.CaptureException(err)
+
 		debug := ctx.Bool("debug")

 		if !debug {
--- a/internal/command/server/admin/run.go
+++ b/internal/command/server/admin/run.go
@ -6,6 +6,7 @@ import (

 	"forge.cadoles.com/cadoles/bouncer/internal/admin"
 	"forge.cadoles.com/cadoles/bouncer/internal/command/common"
+	"forge.cadoles.com/cadoles/bouncer/internal/setup"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
 	"gitlab.com/wpetit/goweb/logger"
@ -27,6 +28,14 @@ func RunCommand() *cli.Command {
 			logger.SetFormat(logger.Format(conf.Logger.Format))
 			logger.SetLevel(logger.Level(conf.Logger.Level))

+			projectVersion := ctx.String("projectVersion")
+			flushSentry, err := setup.SetupSentry(ctx.Context, conf.Admin.Sentry, projectVersion)
+			if err != nil {
+				return errors.Wrap(err, "could not initialize sentry client")
+			}
+
+			defer flushSentry()
+
 			srv := admin.NewServer(
 				admin.WithServerConfig(conf.Admin),
 				admin.WithRedisConfig(conf.Redis),
--- a/internal/command/server/proxy/run.go
+++ b/internal/command/server/proxy/run.go
@ -28,6 +28,14 @@ func RunCommand() *cli.Command {
 			logger.SetFormat(logger.Format(conf.Logger.Format))
 			logger.SetLevel(logger.Level(conf.Logger.Level))

+			projectVersion := ctx.String("projectVersion")
+			flushSentry, err := setup.SetupSentry(ctx.Context, conf.Proxy.Sentry, projectVersion)
+			if err != nil {
+				return errors.Wrap(err, "could not initialize sentry client")
+			}
+
+			defer flushSentry()
+
 			layers, err := setup.GetLayers(ctx.Context, conf)
 			if err != nil {
 				return errors.Wrap(err, "could not initialize director layers")
--- a/internal/config/admin_server.go
+++ b/internal/config/admin_server.go
@ -1,16 +1,20 @@
 package config

 type AdminServerConfig struct {
-	HTTP HTTPConfig `yaml:"http"`
-	CORS CORSConfig `yaml:"cors"`
-	Auth AuthConfig `yaml:"auth"`
+	HTTP    HTTPConfig    `yaml:"http"`
+	CORS    CORSConfig    `yaml:"cors"`
+	Auth    AuthConfig    `yaml:"auth"`
+	Metrics MetricsConfig `yaml:"metrics"`
+	Sentry  SentryConfig  `yaml:"sentry"`
 }

 func NewDefaultAdminServerConfig() AdminServerConfig {
 	return AdminServerConfig{
-		HTTP: NewHTTPConfig("127.0.0.1", 8081),
-		CORS: NewDefaultCORSConfig(),
-		Auth: NewDefaultAuthConfig(),
+		HTTP:    NewHTTPConfig("127.0.0.1", 8081),
+		CORS:    NewDefaultCORSConfig(),
+		Auth:    NewDefaultAuthConfig(),
+		Metrics: NewDefaultMetricsConfig(),
+		Sentry:  NewDefaultSentryConfig(),
 	}
 }

--- a/internal/config/environment.go
+++ b/internal/config/environment.go
@ -6,11 +6,13 @@ import (
 	"strconv"
 	"time"

+	"github.com/drone/envsubst"
 	"github.com/pkg/errors"
 	"gopkg.in/yaml.v3"
 )

-var reVar = regexp.MustCompile(`^\${(\w+)}$`)
+// var reVar = regexp.MustCompile(`^\${(\w+)}$`)
+var reVar = regexp.MustCompile(`\${(.*?)}`)

 type InterpolatedString string

@ -53,6 +55,29 @@ func (ii *InterpolatedInt) UnmarshalYAML(value *yaml.Node) error {
 	return nil
 }

+type InterpolatedFloat float64
+
+func (ifl *InterpolatedFloat) UnmarshalYAML(value *yaml.Node) error {
+	var str string
+
+	if err := value.Decode(&str); err != nil {
+		return errors.Wrapf(err, "could not decode value '%v' (line '%d') into string", value.Value, value.Line)
+	}
+
+	if match := reVar.FindStringSubmatch(str); len(match) > 0 {
+		str = os.Getenv(match[1])
+	}
+
+	floatVal, err := strconv.ParseFloat(str, 10)
+	if err != nil {
+		return errors.Wrapf(err, "could not parse float '%v',  line '%d'", str, value.Line)
+	}
+
+	*ifl = InterpolatedFloat(floatVal)
+
+	return nil
+}
+
 type InterpolatedBool bool

 func (ib *InterpolatedBool) UnmarshalYAML(value *yaml.Node) error {
@ -107,14 +132,22 @@ type InterpolatedStringSlice []string

 func (iss *InterpolatedStringSlice) UnmarshalYAML(value *yaml.Node) error {
 	var data []string
+	var evErr error

 	if err := value.Decode(&data); err != nil {
 		return errors.Wrapf(err, "could not decode value '%v' (line '%d') into map", value.Value, value.Line)
 	}

 	for index, value := range data {
-		if match := reVar.FindStringSubmatch(value); len(match) > 0 {
-			value = os.Getenv(match[1])
+		//match := reVar.FindStringSubmatch(value)
+		re := regexp.MustCompile(`\${(.*?)}`)
+
+		res := re.FindAllStringSubmatch(value, 10)
+		if len(res) > 0 {
+			value, evErr = envsubst.EvalEnv(value)
+			if evErr != nil {
+				return evErr
+			}
 		}

 		data[index] = value
--- a/internal/config/http.go
+++ b/internal/config/http.go
@ -1,13 +1,15 @@
 package config

 type HTTPConfig struct {
-	Host InterpolatedString `yaml:"host"`
-	Port InterpolatedInt    `yaml:"port"`
+	Host      InterpolatedString `yaml:"host"`
+	Port      InterpolatedInt    `yaml:"port"`
+	UseRealIP InterpolatedBool   `yaml:"useRealIP"`
 }

 func NewHTTPConfig(host string, port int) HTTPConfig {
 	return HTTPConfig{
-		Host: InterpolatedString(host),
-		Port: InterpolatedInt(port),
+		Host:      InterpolatedString(host),
+		Port:      InterpolatedInt(port),
+		UseRealIP: true,
 	}
 }
--- a/internal/config/layers.go
+++ b/internal/config/layers.go
@ -3,7 +3,8 @@ package config
 import "time"

 type LayersConfig struct {
-	Queue QueueLayerConfig `yaml:"queue"`
+	Queue          QueueLayerConfig          `yaml:"queue"`
+	CircuitBreaker CircuitBreakerLayerConfig `yaml:"circuitbreaker"`
 }

 func NewDefaultLayersConfig() LayersConfig {
@ -12,6 +13,9 @@ func NewDefaultLayersConfig() LayersConfig {
 			TemplateDir:      "./layers/queue/templates",
 			DefaultKeepAlive: NewInterpolatedDuration(time.Minute),
 		},
+		CircuitBreaker: CircuitBreakerLayerConfig{
+			TemplateDir: "./layers/circuitbreaker/templates",
+		},
 	}
 }

@ -19,3 +23,7 @@ type QueueLayerConfig struct {
 	TemplateDir      InterpolatedString    `yaml:"templateDir"`
 	DefaultKeepAlive *InterpolatedDuration `yaml:"defaultKeepAlive"`
 }
+
+type CircuitBreakerLayerConfig struct {
+	TemplateDir InterpolatedString `yaml:"templateDir"`
+}
--- a/internal/config/logger.go
+++ b/internal/config/logger.go
@ -9,7 +9,7 @@ type LoggerConfig struct {

 func NewDefaultLoggerConfig() LoggerConfig {
 	return LoggerConfig{
-		Level:  InterpolatedInt(logger.LevelInfo),
+		Level:  InterpolatedInt(logger.LevelError),
 		Format: InterpolatedString(logger.FormatHuman),
 	}
 }
--- a/internal/config/metrics.go
+++ b/internal/config/metrics.go
@ -0,0 +1,35 @@
+package config
+
+import "fmt"
+
+type MetricsConfig struct {
+	Enabled   InterpolatedBool   `yaml:"enabled"`
+	Endpoint  InterpolatedString `yaml:"endpoint"`
+	BasicAuth *BasicAuthConfig   `yaml:"basicAuth"`
+}
+
+type BasicAuthConfig struct {
+	Credentials *InterpolatedMap `yaml:"credentials"`
+}
+
+func (c *BasicAuthConfig) CredentialsMap() map[string]string {
+	if c.Credentials == nil {
+		return map[string]string{}
+	}
+
+	credentials := make(map[string]string, len(*c.Credentials))
+
+	for k, v := range *c.Credentials {
+		credentials[k] = fmt.Sprintf("%v", v)
+	}
+
+	return credentials
+}
+
+func NewDefaultMetricsConfig() MetricsConfig {
+	return MetricsConfig{
+		Enabled:   true,
+		Endpoint:  "/.bouncer/metrics",
+		BasicAuth: nil,
+	}
+}
--- a/internal/config/proxy_server.go
+++ b/internal/config/proxy_server.go
@ -1,11 +1,73 @@
 package config

+import "time"
+
 type ProxyServerConfig struct {
-	HTTP HTTPConfig `yaml:"http"`
+	HTTP      HTTPConfig      `yaml:"http"`
+	Metrics   MetricsConfig   `yaml:"metrics"`
+	Transport TransportConfig `yaml:"transport"`
+	Dial      DialConfig      `yaml:"dial"`
+	Sentry    SentryConfig    `yaml:"sentry"`
+}
+
+// See https://pkg.go.dev/net/http#Transport
+type TransportConfig struct {
+	ForceAttemptHTTP2      InterpolatedBool      `yaml:"forceAttemptHTTP2"`
+	MaxIdleConns           InterpolatedInt       `yaml:"maxIdleConns"`
+	MaxIdleConnsPerHost    InterpolatedInt       `yaml:"maxIdleConnsPerHost"`
+	MaxConnsPerHost        InterpolatedInt       `yaml:"maxConnsPerHost"`
+	IdleConnTimeout        *InterpolatedDuration `yaml:"idleConnTimeout"`
+	TLSHandshakeTimeout    *InterpolatedDuration `yaml:"tlsHandshakeTimeout"`
+	ExpectContinueTimeout  *InterpolatedDuration `yaml:"expectContinueTimeout"`
+	DisableKeepAlives      InterpolatedBool      `yaml:"disableKeepAlives"`
+	DisableCompression     InterpolatedBool      `yaml:"disableCompression"`
+	ResponseHeaderTimeout  *InterpolatedDuration `yaml:"responseHeaderTimeout"`
+	WriteBufferSize        InterpolatedInt       `yaml:"writeBufferSize"`
+	ReadBufferSize         InterpolatedInt       `yaml:"readBufferSize"`
+	MaxResponseHeaderBytes InterpolatedInt       `yaml:"maxResponseHeaderBytes"`
 }

 func NewDefaultProxyServerConfig() ProxyServerConfig {
 	return ProxyServerConfig{
-		HTTP: NewHTTPConfig("0.0.0.0", 8080),
+		HTTP:      NewHTTPConfig("0.0.0.0", 8080),
+		Metrics:   NewDefaultMetricsConfig(),
+		Transport: NewDefaultTransportConfig(),
+		Dial:      NewDefaultDialConfig(),
+		Sentry:    NewDefaultSentryConfig(),
+	}
+}
+
+// See https://pkg.go.dev/net#Dialer
+type DialConfig struct {
+	Timeout       *InterpolatedDuration `yaml:"timeout"`
+	KeepAlive     *InterpolatedDuration `yaml:"keepAlive"`
+	FallbackDelay *InterpolatedDuration `yaml:"fallbackDelay"`
+	DualStack     InterpolatedBool      `yaml:"dualStack"`
+}
+
+func NewDefaultDialConfig() DialConfig {
+	return DialConfig{
+		Timeout:       NewInterpolatedDuration(30 * time.Second),
+		KeepAlive:     NewInterpolatedDuration(30 * time.Second),
+		FallbackDelay: NewInterpolatedDuration(300 * time.Millisecond),
+		DualStack:     true,
+	}
+}
+
+func NewDefaultTransportConfig() TransportConfig {
+	return TransportConfig{
+		ForceAttemptHTTP2:      true,
+		MaxIdleConns:           100,
+		MaxIdleConnsPerHost:    100,
+		MaxConnsPerHost:        100,
+		IdleConnTimeout:        NewInterpolatedDuration(90 * time.Second),
+		TLSHandshakeTimeout:    NewInterpolatedDuration(10 * time.Second),
+		ExpectContinueTimeout:  NewInterpolatedDuration(1 * time.Second),
+		ResponseHeaderTimeout:  NewInterpolatedDuration(10 * time.Second),
+		DisableCompression:     false,
+		DisableKeepAlives:      false,
+		ReadBufferSize:         4096,
+		WriteBufferSize:        4096,
+		MaxResponseHeaderBytes: 0,
 	}
 }
--- a/internal/config/sentry.go
+++ b/internal/config/sentry.go
@ -0,0 +1,43 @@
+package config
+
+import "time"
+
+// Sentry configuration
+// See https://pkg.go.dev/github.com/getsentry/sentry-go?utm_source=godoc#ClientOptions
+type SentryConfig struct {
+	DSN                InterpolatedString      `yaml:"dsn"`
+	Debug              InterpolatedBool        `yaml:"debug"`
+	FlushTimeout       *InterpolatedDuration   `yaml:"flushTimeout"`
+	AttachStacktrace   InterpolatedBool        `yaml:"attachStacktrace"`
+	SampleRate         InterpolatedFloat       `yaml:"sampleRate"`
+	EnableTracing      InterpolatedBool        `yaml:"enableTracing"`
+	TracesSampleRate   InterpolatedFloat       `yaml:"tracesSampleRate"`
+	ProfilesSampleRate InterpolatedFloat       `yaml:"profilesSampleRate"`
+	IgnoreErrors       InterpolatedStringSlice `yaml:"ignoreErrors"`
+	SendDefaultPII     InterpolatedBool        `yaml:"sendDefaultPII"`
+	ServerName         InterpolatedString      `yaml:"serverName"`
+	Environment        InterpolatedString      `yaml:"environment"`
+	MaxBreadcrumbs     InterpolatedInt         `yaml:"maxBreadcrumbs"`
+	MaxSpans           InterpolatedInt         `yaml:"maxSpans"`
+	MaxErrorDepth      InterpolatedInt         `yaml:"maxErrorDepth"`
+}
+
+func NewDefaultSentryConfig() SentryConfig {
+	return SentryConfig{
+		DSN:                "",
+		Debug:              false,
+		FlushTimeout:       NewInterpolatedDuration(2 * time.Second),
+		AttachStacktrace:   true,
+		SampleRate:         1,
+		EnableTracing:      true,
+		TracesSampleRate:   0.2,
+		ProfilesSampleRate: 1,
+		IgnoreErrors:       []string{},
+		SendDefaultPII:     false,
+		ServerName:         "",
+		Environment:        "",
+		MaxBreadcrumbs:     0,
+		MaxSpans:           1000,
+		MaxErrorDepth:      10,
+	}
+}
--- a/internal/config/testdata/config.yml
+++ b/internal/config/testdata/config.yml
@ -2,5 +2,5 @@ logger:
  level: 0
  format: human
 http:
-  host: "0.0.0.0"
-  port: 3000
+  host: "${LISTEN_ADDR}"
+  port: 3000
--- a/internal/logger/writer.go
+++ b/internal/logger/writer.go
@ -0,0 +1,43 @@
+package logger
+
+import (
+	"context"
+	"io"
+
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+type Writer struct {
+	ctx   context.Context
+	level logger.Level
+}
+
+// Write implements io.Writer.
+func (w *Writer) Write(p []byte) (n int, err error) {
+	w.log(string(p))
+
+	return len(p), nil
+}
+
+func (w *Writer) log(message string) {
+	switch w.level {
+	case logger.LevelDebug:
+		logger.Debug(w.ctx, message)
+	case logger.LevelInfo:
+		logger.Info(w.ctx, message)
+	case logger.LevelWarn:
+		logger.Warn(w.ctx, message)
+	case logger.LevelError:
+		logger.Error(w.ctx, message)
+	case logger.LevelCritical:
+		logger.Critical(w.ctx, message)
+	default:
+		logger.Debug(w.ctx, message)
+	}
+}
+
+func NewWriter(ctx context.Context, level logger.Level) *Writer {
+	return &Writer{ctx, level}
+}
+
+var _ io.Writer = &Writer{}
--- a/internal/proxy/director/director.go
+++ b/internal/proxy/director/director.go
@ -10,6 +10,7 @@ import (
 	"forge.cadoles.com/Cadoles/go-proxy/wildcard"
 	"forge.cadoles.com/cadoles/bouncer/internal/store"
 	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
 	"gitlab.com/wpetit/goweb/logger"
 )

@ -59,6 +60,8 @@ MAIN:
 		logger.F("remoteAddr", r.RemoteAddr),
 	)

+	metricProxyRequestsTotal.With(prometheus.Labels{metricLabelProxy: string(match.Name)}).Add(1)
+
 	ctx = withProxy(ctx, match)

 	layers, err := d.getLayers(ctx, match.Name)
--- a/internal/proxy/director/layer/circuitbreaker/layer-options.json
+++ b/internal/proxy/director/layer/circuitbreaker/layer-options.json
@ -0,0 +1,23 @@
+{
+    "$id": "https://forge.cadoles.com/cadoles/bouncer/schemas/circuitbreaker-layer-options",
+    "title": "Circuit breaker layer options",
+    "type": "object",
+    "properties": {
+        "matchURLs": {
+            "type": "array",
+            "items": {
+                "type": "string"
+            }
+        },
+        "authorizedCIDRs": {
+            "type": "array",
+            "items": {
+                "type": "string"
+            }
+        },
+        "templateBlock": {
+            "type": "string"
+        }
+    },
+    "additionalProperties": false
+}
--- a/internal/proxy/director/layer/circuitbreaker/layer.go
+++ b/internal/proxy/director/layer/circuitbreaker/layer.go
@ -0,0 +1,151 @@
+package circuitbreaker
+
+import (
+	"context"
+	"html/template"
+	"net"
+	"net/http"
+	"path/filepath"
+	"sync"
+
+	"forge.cadoles.com/Cadoles/go-proxy"
+	"forge.cadoles.com/Cadoles/go-proxy/wildcard"
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
+	"forge.cadoles.com/cadoles/bouncer/internal/store"
+	"github.com/Masterminds/sprig/v3"
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+const LayerType store.LayerType = "circuitbreaker"
+
+type Layer struct {
+	templateDir string
+	loadOnce    sync.Once
+	tmpl        *template.Template
+}
+
+// LayerType implements director.MiddlewareLayer
+func (l *Layer) LayerType() store.LayerType {
+	return LayerType
+}
+
+// Middleware implements director.MiddlewareLayer
+func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			ctx := r.Context()
+
+			options, err := fromStoreOptions(layer.Options)
+			if err != nil {
+				logger.Error(ctx, "could not parse layer options", logger.E(errors.WithStack(err)))
+				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+
+				return
+			}
+
+			matches, err := l.matchAnyAuthorizedCIDRs(ctx, r.RemoteAddr, options.AuthorizedCIDRs)
+			if err != nil {
+				logger.Error(ctx, "could not match authorized cidrs", logger.E(errors.WithStack(err)))
+				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+
+				return
+			}
+
+			if matches {
+				h.ServeHTTP(w, r)
+
+				return
+			}
+
+			matches = wildcard.MatchAny(r.URL.String(), options.MatchURLs...)
+			if !matches {
+				h.ServeHTTP(w, r)
+
+				return
+			}
+
+			l.renderCircuitBreakerPage(w, r, layer, options)
+		}
+
+		return http.HandlerFunc(fn)
+	}
+}
+
+func (l *Layer) matchAnyAuthorizedCIDRs(ctx context.Context, remoteHostPort string, CIDRs []string) (bool, error) {
+	remoteHost, _, err := net.SplitHostPort(remoteHostPort)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	remoteAddr := net.ParseIP(remoteHost)
+	if remoteAddr == nil {
+		return false, errors.Errorf("remote host '%s' is not a valid ip address", remoteHost)
+	}
+
+	for _, rawCIDR := range CIDRs {
+		_, net, err := net.ParseCIDR(rawCIDR)
+		if err != nil {
+			return false, errors.WithStack(err)
+		}
+
+		match := net.Contains(remoteAddr)
+		if !match {
+			continue
+		}
+
+		return true, nil
+	}
+
+	logger.Debug(ctx, "comparing remote host with authorized cidrs", logger.F("remoteAddr", remoteAddr))
+
+	return false, nil
+}
+
+func (l *Layer) renderCircuitBreakerPage(w http.ResponseWriter, r *http.Request, layer *store.Layer, options *LayerOptions) {
+	ctx := r.Context()
+
+	pattern := filepath.Join(l.templateDir, "*.gohtml")
+
+	logger.Info(ctx, "loading circuit breaker page templates", logger.F("pattern", pattern))
+
+	tmpl, err := template.New("").Funcs(sprig.FuncMap()).ParseGlob(pattern)
+	if err != nil {
+		logger.Error(ctx, "could not load circuit breaker templates", logger.E(errors.WithStack(err)))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+
+		return
+	}
+
+	templateData := struct {
+		Layer        *store.Layer
+		LayerOptions *LayerOptions
+	}{
+		Layer:        layer,
+		LayerOptions: options,
+	}
+
+	w.Header().Add("Cache-Control", "no-cache")
+
+	w.WriteHeader(http.StatusOK)
+
+	if err := tmpl.ExecuteTemplate(w, options.TemplateBlock, templateData); err != nil {
+		logger.Error(ctx, "could not render circuit breaker page", logger.E(errors.WithStack(err)))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+
+		return
+	}
+}
+
+func New(funcs ...OptionFunc) *Layer {
+	opts := defaultOptions()
+	for _, fn := range funcs {
+		fn(opts)
+	}
+
+	return &Layer{
+		templateDir: opts.TemplateDir,
+	}
+}
+
+var _ director.MiddlewareLayer = &Layer{}
--- a/internal/proxy/director/layer/circuitbreaker/layer_options.go
+++ b/internal/proxy/director/layer/circuitbreaker/layer_options.go
@ -0,0 +1,36 @@
+package circuitbreaker
+
+import (
+	"forge.cadoles.com/cadoles/bouncer/internal/store"
+	"github.com/mitchellh/mapstructure"
+	"github.com/pkg/errors"
+)
+
+type LayerOptions struct {
+	MatchURLs       []string `mapstructure:"matchURLs"`
+	AuthorizedCIDRs []string `mapstructure:"authorizedCIDRs"`
+	TemplateBlock   string   `mapstructure:"templateBlock"`
+}
+
+func fromStoreOptions(storeOptions store.LayerOptions) (*LayerOptions, error) {
+	layerOptions := LayerOptions{
+		MatchURLs:       []string{"*"},
+		AuthorizedCIDRs: []string{},
+		TemplateBlock:   "default",
+	}
+
+	config := mapstructure.DecoderConfig{
+		Result: &layerOptions,
+	}
+
+	decoder, err := mapstructure.NewDecoder(&config)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := decoder.Decode(storeOptions); err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	return &layerOptions, nil
+}
--- a/internal/proxy/director/layer/circuitbreaker/options.go
+++ b/internal/proxy/director/layer/circuitbreaker/options.go
@ -0,0 +1,19 @@
+package circuitbreaker
+
+type Options struct {
+	TemplateDir string
+}
+
+type OptionFunc func(*Options)
+
+func defaultOptions() *Options {
+	return &Options{
+		TemplateDir: "./templates",
+	}
+}
+
+func WithTemplateDir(templateDir string) OptionFunc {
+	return func(o *Options) {
+		o.TemplateDir = templateDir
+	}
+}
--- a/internal/proxy/director/layer/circuitbreaker/schema.go
+++ b/internal/proxy/director/layer/circuitbreaker/schema.go
@ -0,0 +1,8 @@
+package circuitbreaker
+
+import (
+	_ "embed"
+)
+
+//go:embed layer-options.json
+var RawLayerOptionsSchema []byte
--- a/internal/proxy/director/layer/queue/debouncer.go
+++ b/internal/proxy/director/layer/queue/debouncer.go
@ -0,0 +1,73 @@
+package queue
+
+import (
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+type DebouncerMap struct {
+	debouncers sync.Map
+}
+
+func NewDebouncerMap() *DebouncerMap {
+	return &DebouncerMap{
+		debouncers: sync.Map{},
+	}
+}
+
+func (m *DebouncerMap) Do(key string, after time.Duration, fn func()) {
+	newDebouncer := NewDebouncer(after)
+	rawDebouncer, loaded := m.debouncers.LoadOrStore(key, newDebouncer)
+
+	debouncer, ok := rawDebouncer.(*Debouncer)
+	if !ok {
+		panic(errors.Errorf("unexpected debouncer value, expected '%T', got '%T'", newDebouncer, rawDebouncer))
+	}
+
+	if loaded {
+		debouncer.Update(after)
+	}
+
+	debouncer.Do(fn)
+}
+
+func NewDebouncer(after time.Duration) *Debouncer {
+	return &Debouncer{after: after}
+}
+
+type Debouncer struct {
+	mu    sync.Mutex
+	after time.Duration
+	timer *time.Timer
+	fn    func()
+}
+
+func (d *Debouncer) Do(fn func()) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if d.timer != nil {
+		d.timer.Stop()
+	}
+
+	d.fn = fn
+	d.timer = time.AfterFunc(d.after, d.fn)
+}
+
+func (d *Debouncer) Update(after time.Duration) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if after == d.after {
+		return
+	}
+
+	if d.timer != nil {
+		d.timer.Stop()
+	}
+
+	d.after = after
+	d.timer = time.AfterFunc(d.after, d.fn)
+}
--- a/internal/proxy/director/layer/queue/layer_options.go
+++ b/internal/proxy/director/layer/queue/layer_options.go
@ -11,15 +11,15 @@ import (

 type LayerOptions struct {
 	Capacity  int64         `mapstructure:"capacity"`
-	Matchers  []string      `mapstructure:"matchers"`
 	KeepAlive time.Duration `mapstructure:"keepAlive"`
+	MatchURLs []string      `mapstructure:"matchURLs"`
 }

 func fromStoreOptions(storeOptions store.LayerOptions, defaultKeepAlive time.Duration) (*LayerOptions, error) {
 	layerOptions := LayerOptions{
 		Capacity:  1000,
-		Matchers:  []string{"*"},
 		KeepAlive: defaultKeepAlive,
+		MatchURLs: []string{"*"},
 	}

 	config := mapstructure.DecoderConfig{
--- a/internal/proxy/director/layer/queue/metrics.go
+++ b/internal/proxy/director/layer/queue/metrics.go
@ -0,0 +1,31 @@
+package queue
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+const (
+	metricNamespace  = "bouncer_layer_queue"
+	metricLabelProxy = "proxy"
+	metricLabelLayer = "layer"
+)
+
+var (
+	metricQueueSessions = promauto.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name:      "sessions",
+			Help:      "Bouncer's queue layer current sessions",
+			Namespace: metricNamespace,
+		},
+		[]string{metricLabelProxy, metricLabelLayer},
+	)
+	metricQueueCapacity = promauto.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name:      "capacity",
+			Help:      "Bouncer's queue layer capacity",
+			Namespace: metricNamespace,
+		},
+		[]string{metricLabelProxy, metricLabelLayer},
+	)
+)
--- a/internal/proxy/director/layer/queue/options.go
+++ b/internal/proxy/director/layer/queue/options.go
@ -1,6 +1,8 @@
 package queue

-import "time"
+import (
+	"time"
+)

 type Options struct {
 	TemplateDir      string
--- a/internal/proxy/director/layer/queue/queue.go
+++ b/internal/proxy/director/layer/queue/queue.go
@ -4,18 +4,22 @@ import (
 	"context"
 	"fmt"
 	"html/template"
+	"math/rand"
 	"net/http"
 	"path/filepath"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"

 	"forge.cadoles.com/Cadoles/go-proxy"
+	"forge.cadoles.com/Cadoles/go-proxy/wildcard"
 	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
 	"forge.cadoles.com/cadoles/bouncer/internal/store"
 	"github.com/Masterminds/sprig/v3"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
 	"gitlab.com/wpetit/goweb/logger"
 )

@ -30,7 +34,9 @@ type Queue struct {
 	loadOnce    sync.Once
 	tmpl        *template.Template

-	refreshJobRunning uint32
+	refreshJobRunning       uint32
+	updateMetricsJobRunning uint32
+	postKeepAliveDebouncer  *DebouncerMap
 }

 // LayerType implements director.MiddlewareLayer
@ -52,6 +58,15 @@ func (q *Queue) Middleware(layer *store.Layer) proxy.Middleware {
 				return
 			}

+			matches := wildcard.MatchAny(r.URL.String(), options.MatchURLs...)
+			if !matches {
+				h.ServeHTTP(w, r)
+
+				return
+			}
+
+			defer q.updateMetrics(ctx, layer.Proxy, layer.Name, options)
+
 			cookieName := q.getCookieName(layer.Name)

 			cookie, err := r.Cookie(cookieName)
@ -72,8 +87,6 @@ func (q *Queue) Middleware(layer *store.Layer) proxy.Middleware {
 			sessionID := cookie.Value
 			queueName := string(layer.Name)

-			q.refreshQueue(queueName, options.KeepAlive)
-
 			rank, err := q.adapter.Touch(ctx, queueName, sessionID)
 			if err != nil {
 				logger.Error(ctx, "could not retrieve session rank", logger.E(errors.WithStack(err)))
@ -102,6 +115,30 @@ func (q *Queue) Middleware(layer *store.Layer) proxy.Middleware {
 	}
 }

+func (q *Queue) updateSessionsMetric(ctx context.Context, proxyName store.ProxyName, layerName store.LayerName) {
+	if !atomic.CompareAndSwapUint32(&q.updateMetricsJobRunning, 0, 1) {
+		return
+	}
+
+	defer atomic.StoreUint32(&q.updateMetricsJobRunning, 0)
+
+	queueName := string(layerName)
+
+	status, err := q.adapter.Status(ctx, queueName)
+	if err != nil {
+		logger.Error(ctx, "could not retrieve queue status", logger.E(errors.WithStack(err)))
+
+		return
+	}
+
+	metricQueueSessions.With(
+		prometheus.Labels{
+			metricLabelLayer: string(layerName),
+			metricLabelProxy: string(proxyName),
+		},
+	).Set(float64(status.Sessions))
+}
+
 func (q *Queue) renderQueuePage(w http.ResponseWriter, r *http.Request, queueName string, options *LayerOptions, rank int64) {
 	ctx := r.Context()

@ -135,22 +172,26 @@ func (q *Queue) renderQueuePage(w http.ResponseWriter, r *http.Request, queueNam
 		return
 	}

+	refreshRate := time.Duration(int64(options.KeepAlive.Seconds()/2)) * time.Second
+
 	templateData := struct {
 		QueueName       string
 		LayerOptions    *LayerOptions
 		Rank            int64
 		CurrentSessions int64
 		MaxSessions     int64
-		RefreshRate     int64
+		RefreshRate     time.Duration
 	}{
 		QueueName:       queueName,
 		LayerOptions:    options,
 		Rank:            rank + 1,
 		CurrentSessions: status.Sessions,
 		MaxSessions:     options.Capacity,
-		RefreshRate:     5,
+		RefreshRate:     refreshRate,
 	}

+	w.Header().Add("Cache-Control", "no-cache")
+	w.Header().Add("Retry-After", strconv.FormatInt(int64(refreshRate.Seconds()), 10))
 	w.WriteHeader(http.StatusServiceUnavailable)

 	if err := q.tmpl.ExecuteTemplate(w, "queue", templateData); err != nil {
@ -161,24 +202,55 @@ func (q *Queue) renderQueuePage(w http.ResponseWriter, r *http.Request, queueNam
 	}
 }

-func (q *Queue) refreshQueue(queueName string, keepAlive time.Duration) {
+func (q *Queue) refreshQueue(ctx context.Context, layerName store.LayerName, keepAlive time.Duration) {
 	if !atomic.CompareAndSwapUint32(&q.refreshJobRunning, 0, 1) {
 		return
 	}

-	go func() {
-		defer atomic.StoreUint32(&q.refreshJobRunning, 0)
+	defer atomic.StoreUint32(&q.refreshJobRunning, 0)

-		ctx, cancel := context.WithTimeout(context.Background(), keepAlive*2)
-		defer cancel()
+	if err := q.adapter.Refresh(ctx, string(layerName), keepAlive); err != nil {
+		logger.Error(ctx, "could not refresh queue",
+			logger.E(errors.WithStack(err)),
+			logger.F("queue", layerName),
+		)
+	}
+}

-		if err := q.adapter.Refresh(ctx, queueName, keepAlive); err != nil {
-			logger.Error(ctx, "could not refresh queue",
-				logger.E(errors.WithStack(err)),
-				logger.F("queue", queueName),
-			)
-		}
-	}()
+func (q *Queue) updateMetrics(ctx context.Context, proxyName store.ProxyName, layerName store.LayerName, options *LayerOptions) {
+	// Update queue capacity metric
+	metricQueueCapacity.With(
+		prometheus.Labels{
+			metricLabelLayer: string(layerName),
+			metricLabelProxy: string(proxyName),
+		},
+	).Set(float64(options.Capacity))
+
+	// Refresh queue data and metrics
+	q.refreshQueue(ctx, layerName, options.KeepAlive)
+	q.updateSessionsMetric(ctx, proxyName, layerName)
+
+	// (Re)schedule an update job after session ttl + semi-random time padding
+	// to update metrics after last session expiration
+	randDuration := rand.Int63n(int64(options.KeepAlive))
+	timePadding := options.KeepAlive/2 + time.Duration(randDuration)
+	after := options.KeepAlive + timePadding
+
+	debouncingKey := fmt.Sprintf("%s/%s", proxyName, layerName)
+
+	q.postKeepAliveDebouncer.Do(debouncingKey, after, func() {
+		ctx := logger.With(
+			context.Background(),
+			logger.F("proxy", proxyName),
+			logger.F("layer", layerName),
+			logger.F("after", after),
+		)
+
+		logger.Info(ctx, "running post keep alive refresh job")
+
+		q.refreshQueue(ctx, layerName, options.KeepAlive)
+		q.updateSessionsMetric(ctx, proxyName, layerName)
+	})
 }

 func (q *Queue) getCookieName(layerName store.LayerName) string {
@ -192,9 +264,10 @@ func New(adapter Adapter, funcs ...OptionFunc) *Queue {
 	}

 	return &Queue{
-		adapter:          adapter,
-		templateDir:      opts.TemplateDir,
-		defaultKeepAlive: opts.DefaultKeepAlive,
+		adapter:                adapter,
+		templateDir:            opts.TemplateDir,
+		defaultKeepAlive:       opts.DefaultKeepAlive,
+		postKeepAliveDebouncer: NewDebouncerMap(),
 	}
 }

--- a/internal/proxy/director/layer/queue/redis/adapter.go
+++ b/internal/proxy/director/layer/queue/redis/adapter.go
@ -30,7 +30,7 @@ func (a *Adapter) Refresh(ctx context.Context, queueName string, keepAlive time.

 		cmd := tx.ZRangeByScore(ctx, lastSeenKey, &redis.ZRangeBy{
 			Min: "0",
-			Max: strconv.FormatInt(expires.Unix(), 10),
+			Max: strconv.FormatInt(expires.UnixNano(), 10),
 		})

 		members, err := cmd.Result()
@ -75,7 +75,7 @@ func (a *Adapter) Touch(ctx context.Context, queueName string, sessionId string)

 	for retry > 0 {
 		err := withTx(ctx, a.client, func(ctx context.Context, tx *redis.Tx) error {
-			now := time.Now().UTC().Unix()
+			now := time.Now().UTC().UnixNano()

 			err := tx.ZAddNX(ctx, rankKey, redis.Z{Score: float64(now), Member: sessionId}).Err()
 			if err != nil {
--- a/internal/proxy/director/layer/queue/redis/adapter_test.go
+++ b/internal/proxy/director/layer/queue/redis/adapter_test.go
@ -0,0 +1,12 @@
+package redis
+
+import (
+	"testing"
+
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/queue/testsuite"
+)
+
+func TestAdapter(t *testing.T) {
+	adapter := NewAdapter(client, 3)
+	testsuite.TestAdapter(t, adapter)
+}
--- a/internal/proxy/director/layer/queue/redis/main_test.go
+++ b/internal/proxy/director/layer/queue/redis/main_test.go
@ -0,0 +1,58 @@
+package redis
+
+import (
+	"context"
+	"log"
+	"os"
+	"testing"
+
+	"github.com/ory/dockertest/v3"
+	"github.com/pkg/errors"
+	"github.com/redis/go-redis/v9"
+)
+
+var client redis.UniversalClient
+
+func TestMain(m *testing.M) {
+	// uses a sensible default on windows (tcp/http) and linux/osx (socket)
+	pool, err := dockertest.NewPool("")
+	if err != nil {
+		log.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	// uses pool to try to connect to Docker
+	err = pool.Client.Ping()
+	if err != nil {
+		log.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	// pulls an image, creates a container based on it and runs it
+	resource, err := pool.Run("redis", "alpine3.17", []string{})
+	if err != nil {
+		log.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	if err := pool.Retry(func() error {
+		client = redis.NewUniversalClient(&redis.UniversalOptions{
+			Addrs: []string{resource.GetHostPort("6379/tcp")},
+		})
+
+		ctx := context.Background()
+
+		if cmd := client.Ping(ctx); cmd.Err() != nil {
+			return errors.WithStack(err)
+		}
+
+		return nil
+	}); err != nil {
+		log.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	code := m.Run()
+
+	if err := pool.Purge(resource); err != nil {
+		log.Fatalf("%+v", errors.WithStack(err))
+	}
+
+	os.Exit(code)
+}
--- a/internal/proxy/director/layer/queue/schema/layer-options.json
+++ b/internal/proxy/director/layer/queue/schema/layer-options.json
@ -9,6 +9,12 @@
        },
        "keepAlive": {
            "type": "string"
+        },
+        "matchURLs": {
+            "type": "array",
+            "items": {
+                "type": "string"
+            }
        }
    },
    "additionalProperties": false
--- a/internal/proxy/director/layer/queue/testsuite/adapter.go
+++ b/internal/proxy/director/layer/queue/testsuite/adapter.go
@ -0,0 +1,99 @@
+package testsuite
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/queue"
+	"github.com/pkg/errors"
+)
+
+type adapterTestCase struct {
+	Name string
+	Do   func(adapter queue.Adapter) error
+}
+
+var adapterTestCases = []adapterTestCase{
+	{
+		Name: "Test queue ranking",
+		Do: func(adapter queue.Adapter) error {
+			ctx := context.Background()
+			queueName := "test_queue_ranking"
+
+			sessionIdPattern := "session-%d"
+			totalSessions := int64(100)
+
+			for idx := int64(0); idx < totalSessions; idx++ {
+				sessionId := fmt.Sprintf(sessionIdPattern, idx)
+				rank, err := adapter.Touch(ctx, queueName, sessionId)
+				if err != nil {
+					return errors.Wrapf(err, "could not touch session '%s' (index: %d, rank: %d)", sessionId, idx, rank)
+				}
+
+				if e, g := int64(idx), rank; e != g {
+					return errors.Errorf("rank('%s'): expected '%v', got '%v'", sessionId, e, g)
+				}
+			}
+
+			status, err := adapter.Status(ctx, queueName)
+			if err != nil {
+				return errors.Wrap(err, "could not retrieve queue status")
+			}
+
+			if e, g := totalSessions, status.Sessions; e != g {
+				return errors.Errorf("status.Sessions: expected '%v', got '%v'", e, g)
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Test session expiration",
+		Do: func(adapter queue.Adapter) error {
+			ctx := context.Background()
+			queueName := "test_session_expiration"
+
+			sessionId := "session-1"
+
+			rank, err := adapter.Touch(ctx, queueName, sessionId)
+			if err != nil {
+				return errors.Wrapf(err, "could not touch session '%s'", sessionId)
+			}
+
+			if e, g := int64(0), rank; e != g {
+				return errors.Errorf("rank('%s'): expected '%v', got '%v'", sessionId, e, g)
+			}
+
+			<-time.After(time.Second)
+
+			if err := adapter.Refresh(ctx, queueName, time.Second); err != nil {
+				return errors.Wrap(err, "could not refresh queue")
+			}
+
+			status, err := adapter.Status(ctx, queueName)
+			if err != nil {
+				return errors.Wrap(err, "could not retrieve queue status")
+			}
+
+			if e, g := int64(0), status.Sessions; e != g {
+				return errors.Errorf("status.Sessions: expected '%v', got '%v'", e, g)
+			}
+
+			return nil
+		},
+	},
+}
+
+func TestAdapter(t *testing.T, adapter queue.Adapter) {
+	for _, tc := range adapterTestCases {
+		func(tc adapterTestCase) {
+			t.Run(tc.Name, func(t *testing.T) {
+				if err := tc.Do(adapter); err != nil {
+					t.Fatalf("%+v", errors.WithStack(err))
+				}
+			})
+		}(tc)
+	}
+}
--- a/internal/proxy/director/metrics.go
+++ b/internal/proxy/director/metrics.go
@ -0,0 +1,20 @@
+package director
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+const (
+	metricNamespace  = "bouncer_proxy_director"
+	metricLabelProxy = "proxy"
+)
+
+var metricProxyRequestsTotal = promauto.NewCounterVec(
+	prometheus.CounterOpts{
+		Name:      "proxy_requests_total",
+		Help:      "Bouncer proxy total requests",
+		Namespace: metricNamespace,
+	},
+	[]string{metricLabelProxy},
+)
--- a/internal/proxy/server.go
+++ b/internal/proxy/server.go
@ -6,15 +6,21 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"

 	"forge.cadoles.com/Cadoles/go-proxy"
 	bouncerChi "forge.cadoles.com/cadoles/bouncer/internal/chi"
 	"forge.cadoles.com/cadoles/bouncer/internal/config"
 	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
 	"forge.cadoles.com/cadoles/bouncer/internal/store"
+	"github.com/getsentry/sentry-go"
+	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"gitlab.com/wpetit/goweb/logger"
 )

@ -83,19 +89,56 @@ func (s *Server) run(parentCtx context.Context, addrs chan net.Addr, errs chan e
 		s.directorLayers...,
 	)

+	if s.serverConfig.HTTP.UseRealIP {
+		router.Use(middleware.RealIP)
+	}
+
 	router.Use(middleware.RequestLogger(bouncerChi.NewLogFormatter()))
-	router.Use(director.Middleware())

-	handler := proxy.New(
-		proxy.WithRequestTransformers(
-			director.RequestTransformer(),
-		),
-		proxy.WithResponseTransformers(
-			director.ResponseTransformer(),
-		),
-	)
+	if s.serverConfig.Sentry.DSN != "" {
+		logger.Info(ctx, "enabling sentry http middleware")

-	router.Handle("/*", handler)
+		sentryMiddleware := sentryhttp.New(sentryhttp.Options{
+			Repanic: true,
+		})
+
+		router.Use(sentryMiddleware.Handle)
+	}
+
+	if s.serverConfig.Metrics.Enabled {
+		metrics := s.serverConfig.Metrics
+
+		logger.Info(ctx, "enabling metrics", logger.F("endpoint", metrics.Endpoint))
+
+		router.Group(func(r chi.Router) {
+			if metrics.BasicAuth != nil {
+				logger.Info(ctx, "enabling authentication on metrics endpoint")
+
+				r.Use(middleware.BasicAuth(
+					"metrics",
+					metrics.BasicAuth.CredentialsMap(),
+				))
+			}
+
+			r.Handle(string(metrics.Endpoint), promhttp.Handler())
+		})
+	}
+
+	router.Group(func(r chi.Router) {
+		r.Use(director.Middleware())
+
+		handler := proxy.New(
+			proxy.WithRequestTransformers(
+				director.RequestTransformer(),
+			),
+			proxy.WithResponseTransformers(
+				director.ResponseTransformer(),
+			),
+			proxy.WithReverseProxyFactory(s.createReverseProxy),
+		)
+
+		r.Handle("/*", handler)
+	})

 	if err := http.Serve(listener, router); err != nil && !errors.Is(err, net.ErrClosed) {
 		errs <- errors.WithStack(err)
@ -104,6 +147,52 @@ func (s *Server) run(parentCtx context.Context, addrs chan net.Addr, errs chan e
 	logger.Info(ctx, "http server exiting")
 }

+func (s *Server) createReverseProxy(ctx context.Context, target *url.URL) *httputil.ReverseProxy {
+	reverseProxy := httputil.NewSingleHostReverseProxy(target)
+
+	dialConfig := s.serverConfig.Dial
+
+	dialer := &net.Dialer{
+		Timeout:       time.Duration(*dialConfig.Timeout),
+		KeepAlive:     time.Duration(*dialConfig.KeepAlive),
+		FallbackDelay: time.Duration(*dialConfig.FallbackDelay),
+		DualStack:     bool(dialConfig.DualStack),
+	}
+
+	transportConfig := s.serverConfig.Transport
+
+	reverseProxy.Transport = &http.Transport{
+		Proxy:                  http.ProxyFromEnvironment,
+		DialContext:            dialer.DialContext,
+		ForceAttemptHTTP2:      bool(transportConfig.ForceAttemptHTTP2),
+		MaxIdleConns:           int(transportConfig.MaxIdleConns),
+		MaxIdleConnsPerHost:    int(transportConfig.MaxIdleConnsPerHost),
+		MaxConnsPerHost:        int(transportConfig.MaxConnsPerHost),
+		IdleConnTimeout:        time.Duration(*transportConfig.IdleConnTimeout),
+		TLSHandshakeTimeout:    time.Duration(*transportConfig.TLSHandshakeTimeout),
+		ExpectContinueTimeout:  time.Duration(*transportConfig.ExpectContinueTimeout),
+		DisableKeepAlives:      bool(transportConfig.DisableKeepAlives),
+		DisableCompression:     bool(transportConfig.DisableCompression),
+		ResponseHeaderTimeout:  time.Duration(*transportConfig.ResponseHeaderTimeout),
+		WriteBufferSize:        int(transportConfig.WriteBufferSize),
+		ReadBufferSize:         int(transportConfig.ReadBufferSize),
+		MaxResponseHeaderBytes: int64(transportConfig.MaxResponseHeaderBytes),
+	}
+
+	reverseProxy.ErrorHandler = s.errorHandler
+
+	return reverseProxy
+}
+
+func (s *Server) errorHandler(w http.ResponseWriter, r *http.Request, err error) {
+	err = errors.WithStack(err)
+
+	logger.Error(r.Context(), "proxy error", logger.E(err))
+	sentry.CaptureException(err)
+
+	http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+}
+
 func NewServer(funcs ...OptionFunc) *Server {
 	opt := defaultOption()
 	for _, fn := range funcs {
--- a/internal/setup/circuitbreaker_layer.go
+++ b/internal/setup/circuitbreaker_layer.go
@ -0,0 +1,21 @@
+package setup
+
+import (
+	"forge.cadoles.com/cadoles/bouncer/internal/config"
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/circuitbreaker"
+)
+
+func init() {
+	RegisterLayer(circuitbreaker.LayerType, setupCircuitBreakerLayer, circuitbreaker.RawLayerOptionsSchema)
+}
+
+func setupCircuitBreakerLayer(conf *config.Config) (director.Layer, error) {
+	options := []circuitbreaker.OptionFunc{
+		circuitbreaker.WithTemplateDir(string(conf.Layers.CircuitBreaker.TemplateDir)),
+	}
+
+	return circuitbreaker.New(
+		options...,
+	), nil
+}
--- a/internal/setup/sentry.go
+++ b/internal/setup/sentry.go
@ -0,0 +1,42 @@
+package setup
+
+import (
+	"context"
+	"time"
+
+	"forge.cadoles.com/cadoles/bouncer/internal/config"
+	loggerWriter "forge.cadoles.com/cadoles/bouncer/internal/logger"
+	"github.com/getsentry/sentry-go"
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+func SetupSentry(ctx context.Context, conf config.SentryConfig, release string) (func(), error) {
+	err := sentry.Init(sentry.ClientOptions{
+		Dsn:                string(conf.DSN),
+		Debug:              bool(conf.Debug),
+		AttachStacktrace:   bool(conf.AttachStacktrace),
+		SampleRate:         float64(conf.SampleRate),
+		EnableTracing:      bool(conf.EnableTracing),
+		TracesSampleRate:   float64(conf.TracesSampleRate),
+		ProfilesSampleRate: float64(conf.ProfilesSampleRate),
+		IgnoreErrors:       conf.IgnoreErrors,
+		SendDefaultPII:     bool(conf.SendDefaultPII),
+		ServerName:         string(conf.ServerName),
+		Release:            release,
+		Environment:        string(conf.Environment),
+		MaxBreadcrumbs:     int(conf.MaxBreadcrumbs),
+		MaxSpans:           int(conf.MaxSpans),
+		MaxErrorDepth:      int(conf.MaxErrorDepth),
+		DebugWriter:        loggerWriter.NewWriter(ctx, logger.LevelDebug),
+	})
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	flush := func() {
+		sentry.Flush(time.Duration(*conf.FlushTimeout))
+	}
+
+	return flush, nil
+}
--- a/internal/store/testsuite/layer_repository.go
+++ b/internal/store/testsuite/layer_repository.go
@ -2,6 +2,7 @@ package testsuite

 import (
 	"context"
+	"reflect"
 	"testing"

 	"forge.cadoles.com/cadoles/bouncer/internal/store"
@ -48,6 +49,187 @@ var layerRepositoryTestCases = []layerRepositoryTestCase{
 				return errors.Errorf("layer.UpdatedAt should not be zero value")
 			}

+			return nil
+		},
+	},
+	{
+		Name: "Create then get layer",
+		Do: func(repo store.LayerRepository) error {
+			ctx := context.Background()
+
+			var proxyName store.ProxyName = "create_then_get_layer_proxy"
+			var layerName store.LayerName = "create_then_get_layer"
+			var layerType store.LayerType = "dummy"
+			var layerOptions store.LayerOptions = store.LayerOptions{
+				"foo": "bar",
+				"test": struct {
+					Items []int `json:"items"`
+				}{
+					Items: []int{1, 2, 3},
+				},
+			}
+
+			createdLayer, err := repo.CreateLayer(ctx, proxyName, layerName, layerType, layerOptions)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			foundLayer, err := repo.GetLayer(ctx, proxyName, layerName)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			if e, g := createdLayer.Name, foundLayer.Name; e != g {
+				return errors.Errorf("foundLayer.Name: expected '%v', got '%v'", createdLayer.Name, foundLayer.Name)
+			}
+
+			if e, g := createdLayer.CreatedAt, foundLayer.CreatedAt; !reflect.DeepEqual(e, g) {
+				return errors.Errorf("foundLayer.CreatedAt: expected '%v', got '%v'", createdLayer.CreatedAt, foundLayer.CreatedAt)
+			}
+
+			if e, g := createdLayer.UpdatedAt, foundLayer.UpdatedAt; !reflect.DeepEqual(e, g) {
+				return errors.Errorf("foundLayer.UpdatedAt: expected '%v', got '%v'", createdLayer.UpdatedAt, foundLayer.UpdatedAt)
+			}
+
+			if e, g := createdLayer.Enabled, foundLayer.Enabled; !reflect.DeepEqual(e, g) {
+				return errors.Errorf("foundLayer.Enabled: expected '%v', got '%v'", createdLayer.Enabled, foundLayer.Enabled)
+			}
+
+			if e, g := createdLayer.Weight, foundLayer.Weight; !reflect.DeepEqual(e, g) {
+				return errors.Errorf("foundLayer.Weight: expected '%v', got '%v'", createdLayer.Weight, foundLayer.Weight)
+			}
+
+			if e, g := createdLayer.Proxy, foundLayer.Proxy; !reflect.DeepEqual(e, g) {
+				return errors.Errorf("foundLayer.Proxy: expected '%v', got '%v'", createdLayer.Proxy, foundLayer.Proxy)
+			}
+
+			if e, g := createdLayer.Options, foundLayer.Options; !reflect.DeepEqual(e, g) {
+				return errors.Errorf("foundLayer.Options: expected '%v', got '%v'", createdLayer.Options, foundLayer.Options)
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Create then delete layer",
+		Do: func(repo store.LayerRepository) error {
+			ctx := context.Background()
+
+			var layerName store.LayerName = "create_then_delete_layer"
+			var proxyName store.ProxyName = store.ProxyName(string(layerName) + "_proxy")
+			var layerType store.LayerType = "dummy"
+			var layerOptions store.LayerOptions = store.LayerOptions{
+				"foo": "bar",
+				"test": struct {
+					Items []int `json:"items"`
+				}{
+					Items: []int{1, 2, 3},
+				},
+			}
+
+			createdLayer, err := repo.CreateLayer(ctx, proxyName, layerName, layerType, layerOptions)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			if err := repo.DeleteLayer(ctx, createdLayer.Proxy, createdLayer.Name); err != nil {
+				return errors.WithStack(err)
+			}
+
+			foundLayer, err := repo.GetLayer(ctx, createdLayer.Proxy, createdLayer.Name)
+			if err == nil {
+				return errors.New("err should not be nil")
+			}
+
+			if !errors.Is(err, store.ErrNotFound) {
+				return errors.Errorf("err should be store.ErrNotFound, got '%+v'", err)
+			}
+
+			if foundLayer != nil {
+				return errors.Errorf("foundLayer should be nil, got '%v'", foundLayer)
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Create already existing layer",
+		Do: func(repo store.LayerRepository) error {
+			ctx := context.Background()
+
+			var layerName store.LayerName = "create_already_existing_layer"
+			var proxyName store.ProxyName = store.ProxyName(string(layerName) + "_proxy")
+			var layerType store.LayerType = "dummy"
+			var layerOptions store.LayerOptions = store.LayerOptions{
+				"foo": "bar",
+				"test": struct {
+					Items []int `json:"items"`
+				}{
+					Items: []int{1, 2, 3},
+				},
+			}
+
+			_, err := repo.CreateLayer(ctx, proxyName, layerName, layerType, layerOptions)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			_, err = repo.CreateLayer(ctx, proxyName, layerName, layerType, layerOptions)
+			if err == nil {
+				return errors.New("err should not be nil")
+			}
+
+			if !errors.Is(err, store.ErrAlreadyExist) {
+				return errors.Errorf("err: expected store.ErrAlreadyExists, got '%+v'", err)
+			}
+
+			return nil
+		},
+	},
+	{
+		Name: "Create then query layer",
+		Do: func(repo store.LayerRepository) error {
+			ctx := context.Background()
+
+			var layerName store.LayerName = "create_then_query_layer"
+			var proxyName store.ProxyName = store.ProxyName(string(layerName) + "_proxy")
+			var layerType store.LayerType = "dummy"
+			var layerOptions store.LayerOptions = store.LayerOptions{
+				"foo": "bar",
+				"test": struct {
+					Items []int `json:"items"`
+				}{
+					Items: []int{1, 2, 3},
+				},
+			}
+
+			createdLayer, err := repo.CreateLayer(ctx, proxyName, layerName, layerType, layerOptions)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			headers, err := repo.QueryLayers(ctx, createdLayer.Proxy)
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			if len(headers) < 1 {
+				return errors.Errorf("len(headers): expected value > 1, got '%v'", len(headers))
+			}
+
+			found := false
+
+			for _, h := range headers {
+				if h.Name == createdLayer.Name {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				return errors.New("could not find created layer in query results")
+			}
+
 			return nil
 		},
 	},
--- a/internal/store/testsuite/proxy_repository.go
+++ b/internal/store/testsuite/proxy_repository.go
@ -83,6 +83,14 @@ var proxyRepositoryTestCases = []proxyRepositoryTestCase{
 				return errors.Errorf("foundProxy.To: expected '%v', got '%v'", createdProxy.To, foundProxy.To)
 			}

+			if e, g := createdProxy.Enabled, foundProxy.Enabled; e != g {
+				return errors.Errorf("foundProxy.Enabled: expected '%v', got '%v'", createdProxy.Enabled, foundProxy.Enabled)
+			}
+
+			if e, g := createdProxy.Weight, foundProxy.Weight; e != g {
+				return errors.Errorf("foundProxy.Weight: expected '%v', got '%v'", createdProxy.Weight, foundProxy.Weight)
+			}
+
 			if e, g := createdProxy.CreatedAt, foundProxy.CreatedAt; e != g {
 				return errors.Errorf("foundProxy.CreatedAt: expected '%v', got '%v'", createdProxy.CreatedAt, foundProxy.CreatedAt)
 			}
@ -127,7 +135,7 @@ var proxyRepositoryTestCases = []proxyRepositoryTestCase{
 		},
 	},
 	{
-		Name: "Create then query",
+		Name: "Create then query layer",
 		Do: func(repo store.ProxyRepository) error {
 			ctx := context.Background()

--- a/layers/circuitbreaker/templates/default.gohtml
+++ b/layers/circuitbreaker/templates/default.gohtml
@ -0,0 +1,73 @@
+{{ define "default" }}
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width,initial-scale=1">
+        <title>Accès bloqué - {{ .Layer.Name }}</title>
+        <style>
+            html {
+              box-sizing: border-box;
+              font-size: 16px;
+            }
+
+            *, *:before, *:after {
+              box-sizing: inherit;
+            }
+
+            body, h1, h2, h3, h4, h5, h6, p, ol, ul {
+              margin: 0;
+              padding: 0;
+              font-weight: normal;
+            }
+
+            html, body {
+              width: 100%;
+              height: 100%;
+              font-family: Arial, Helvetica, sans-serif;
+              background-color: #f7f7f7;
+            }
+
+            #container {
+              display: flex;
+              align-items: center;
+              justify-content: center;
+              height: 100%;
+              flex-direction: column;
+            }
+
+            #card {
+              padding: 1.5em 1em;
+              border: 1px solid #e0e0e0;
+              background-color: white;
+              border-radius: 5px;
+              box-shadow: 2px 2px #cccccc1c;
+              color: #333333 !important;
+            }
+
+            .title {
+              margin-bottom: 1.2em;
+            }
+
+            p {
+              margin-bottom: 0.5em;
+            }
+
+            .footer {
+              font-size: 0.7em;
+              margin-top: 2em;
+              text-align: right;
+            }
+        </style>
+    </head>
+    <body>
+        <div id="container">
+            <div id="card">
+                <h2 class="title">Page indisponible</h2>
+                <p>La page à laquelle vous souhaitez accéder est actuellement indisponible.</p>
+                <p class="footer">Propulsé par <a href="https://forge.cadoles.com/Cadoles/bouncer">Bouncer</a>.</p>
+            </div>
+        </div>
+    </body>
+</html>
+{{ end }}
--- a/layers/queue/templates/queue.gohtml
+++ b/layers/queue/templates/queue.gohtml
@ -5,7 +5,7 @@
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width,initial-scale=1">
        <title>Veuillez patienter - {{ .QueueName }}</title>
-        <meta http-equiv="refresh" content="{{ .RefreshRate }}">
+        <meta http-equiv="refresh" content="{{ .RefreshRate.Seconds }}">
        <style>
            html {
              box-sizing: border-box;
--- a/misc/docker-compose/README.md
+++ b/misc/docker-compose/README.md
@ -0,0 +1,37 @@
+# Exemple de déploiement multi-noeuds avec Docker-Compose
+
+Le répertoire [`misc/docker-compose`](./) contient un exemple de déploiement de Bouncer multi-noeuds avec:
+
+- 3 instances du service `bouncer-proxy`;
+- 1 instance du service `haproxy` en frontal en charge du load-balancing;
+- 1 instance du service `bouncer-admin`;
+- 1 serveur Redis.
+
+## Prérequis
+
+- [Docker Compose](https://docs.docker.com/compose/)
+
+## Étapes
+
+1. Se positionner dans le répertoire puis lancer l'environnement avec la commande `docker-compose`:
+
+    ```bash
+    cd misc/docker-compose
+    docker-compose up
+    ```
+
+2. Entrer dans le conteneur `bouncer-admin` puis créer un jeton d'accès:
+
+    ```bash
+    docker-compose exec bouncer-admin /bin/sh
+    bouncer auth create-token --role writer > .bouncer-token
+    ```
+
+3. Créer un proxy via le CLI:
+
+    ```bash
+    bouncer admin proxy create --proxy-name myproxy --proxy-to "https://www.cadoles.com/"
+    bouncer admin proxy update --proxy-name myproxy --proxy-enabled=true
+    ```
+
+4. Via votre navigateur, accéder à l'URL http://127.0.0.1:8080. La page du site Cadoles devrait s'afficher. Dans le log de la commande `docker-compose up` vous devriez voir que les requêtes sont routées à tour de rôle sur les 3 instances de Bouncer en exécution.
--- a/misc/docker-compose/bouncer/admin-key.json
+++ b/misc/docker-compose/bouncer/admin-key.json
@ -0,0 +1 @@
+{"d":"JuBw5OsGv3rPgVczxUgtJ6iUQ41LQu4Xpu-t8IKI_z8r-BZBlbndxidPmRlGZASLGL3rhY4qw6_ScFxakrMpCreO1RMU0kqtz--N48BXFnW5tEgr1voyyKP__bPssQNn6PgkoyAd11es7MEKlBff_DtGrcSkVRgU0zDZB-vIU0aNEIZPNw0icbYqc1u_QQNPpBU9cw6P33WHhzvfCVAkZKRszwznhiPM08n1vjpiA7e1kQ8a6OC4IFZBvohkmpmyOq1g1OLRABQ83YPCjGjCAejO-jEWkbLksp6rAl_YYpCvfBAjFV76JuZq4eh5IU82LsSfi3PGYBkhxWuLY779XQ","dp":"gljHOQowGK7fVn2DJizWtgRIDJuKpKnoX2PWNJUbm2WZwcEPZalAkxn7Y-w_reLVJZuRpfKEUMS-Tn3-CwI1ZjCHPqMPTXcoG0Pe2E-Z88jOs9lW4XSOASiiM980VIvkV1xCxDJkN3NsDFQ9j9kRGnKuMnsucCW3AKaU917hXNU","dq":"mqY19JcEBDnzS70_XkAsOKqPzemOScax66b-4N6zrsgeLVlRjHffY9uCAgBWzlxOidRdQN8q23ZJB4fqsKB2w00Iw7Jxx94IoAKGjKDT5iB48Y_kdKLAwSHRTXsqA9GG3po_H_JpP_EqX4TDBYtqQZuBD_tACP9HbLYMi_V2YU8","e":"AQAB","kty":"RSA","n":"sam0X0BGcuFwX8z3Wde8cv2o_zl6A9ghpkT0tCjw8qH3GNWrbAqzncSWdHBzoChBgAbuTOVs-ixYC0KeUhwFdc8Ul-jmKJWFaS8kIr3y4EH62-vLgMuIKfaxbsyUG6KMkJfnftge1jPO4ccddNej9msxcqTxu37dcgstutwtd6QkS9p5RrNbDBc8-Z7SQ4TuxJfP8msXRnCPJ-I44yszGdQF1Np2DXakJHVn8PBrDh3iSFwORw8jxNS4oS0OlBl5aSc0t5XkkaNcSU2a50SKts290w54fl6MPJ1sLnnznLy4uu37-nrfEUvqRLDZL9B1F82RM1dtLIIiN4gnSrMlpQ","p":"wOmFPhAT_wXWzMuwtEdYIer3-CiOWxFKpFL09eEJkJ29MIUchEaoiJaUAghqPxM48llfOVaUaLbFVxmo5U3fyjNMaP-nHMUBwojutykMK-gC2R3J4bQgFWfKbGSL7M7UsextAvpq9iiOuR0LNE-xTfCgPIxHVdPZskO3yx0DkjM","q":"68OGRb0tLRjb_PpkGctcSjEz_vvcyjzxGL-fn4_h4GCw98Xrj6Y4rZ4lfWWRSeDohSvdd-ICSlxvxkQOIOcA0H7jyJcBC0KDs4hX5BRGJNDri3QX0ry4_F1ptAdbfiFgQGqCfMRCr7L60Tfd_6tLczvny7eEBKQNGdj6dLfhgMc","qi":"DFwixyxUDf0REPLLa8hOKieRL95_AH9rbYWzStBOdSjKWra5l0reD6a4bbvAYvl0e8qCcRI6S8Nzpz0BYm4sJL7poVOnjxqvBY3Q9Ppf4Mq8lW39pOCJcqOHIvvYHsMjTC5uwp7Yg2p0GvxuUibbyNL1PXf6WZ_szVP_oSMrCXA"}
--- a/misc/docker-compose/bouncer/config.yml
+++ b/misc/docker-compose/bouncer/config.yml
@ -0,0 +1,47 @@
+admin:
+    http:
+        host: 127.0.0.1
+        port: 8081
+    cors:
+        allowedOrigins:
+            - http://localhost:3001
+        allowCredentials: true
+        allowMethods:
+            - POST
+            - GET
+            - PUT
+            - DELETE
+        allowedHeaders:
+            - Origin
+            - Accept
+            - Content-Type
+            - Authorization
+            - Sentry-Trace
+        debug: false
+    auth:
+        issuer: http://127.0.0.1:8081
+        privateKey: /etc/bouncer/admin-key.json
+    metrics:
+        enabled: true
+        endpoint: /.bouncer/metrics
+        basicAuth: null
+proxy:
+    http:
+        host: 0.0.0.0
+        port: 8080
+    metrics:
+        enabled: true
+        endpoint: /.bouncer/metrics
+        basicAuth: null
+        
+redis:
+    addresses:
+        - redis:6379
+    master: ""
+logger:
+    level: 1
+    format: human
+layers:
+    queue:
+        templateDir: /usr/share/bouncer/layers/queue/templates
+        defaultKeepAlive: 1m0s
--- a/misc/docker-compose/docker-compose.yml
+++ b/misc/docker-compose/docker-compose.yml
@ -0,0 +1,42 @@
+version: "2"
+services:
+  haproxy:
+    image: reg.cadoles.com/proxy_cache/library/haproxy:2.7-alpine
+    ports:
+      - 8080:8080
+    links:
+      - bouncer-proxy-1
+      - bouncer-proxy-2
+      - bouncer-proxy-3
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
+
+  bouncer-admin:
+    image: reg.cadoles.com/cadoles/bouncer:latest
+    command: bouncer -c /etc/bouncer/config.yml server admin run
+    links:
+      - redis
+    volumes:
+      - ./bouncer/config.yml:/etc/bouncer/config.yml
+      - ./bouncer/admin-key.json:/etc/bouncer/admin-key.json
+
+  bouncer-proxy-1: &bouncer-proxy
+    image: reg.cadoles.com/cadoles/bouncer:latest
+    command: bouncer -c /etc/bouncer/config.yml server proxy run
+    links:
+      - redis
+    volumes:
+      - ./bouncer/config.yml:/etc/bouncer/config.yml
+      - ./bouncer/admin-key.json:/etc/bouncer/admin-key.json
+
+  bouncer-proxy-2: *bouncer-proxy
+  bouncer-proxy-3: *bouncer-proxy
+      
+  redis:
+    image: reg.cadoles.com/proxy_cache/library/redis:7-alpine
+    command: redis-server --save 60 1 --loglevel verbose
+    volumes:
+      - redis-data:/data
+
+volumes:
+  redis-data:
--- a/misc/docker-compose/haproxy/haproxy.cfg
+++ b/misc/docker-compose/haproxy/haproxy.cfg
@ -0,0 +1,21 @@
+global
+    maxconn 100
+    log stdout format raw local0 info
+
+defaults
+    mode    http
+    timeout client  30s
+    timeout server  30s
+    timeout connect 30s
+    log global
+    option httplog
+
+frontend proxy
+    bind    *:8080
+    default_backend bouncer-proxy
+
+backend bouncer-proxy
+    mode    http
+    server  bouncer-proxy-1 bouncer-proxy-1:8080 check
+    server  bouncer-proxy-2 bouncer-proxy-2:8080 check
+    server  bouncer-proxy-3 bouncer-proxy-3:8080 check
--- a/misc/grafterm/dashboard.json
+++ b/misc/grafterm/dashboard.json
@ -0,0 +1,196 @@
+{
+  "version": "v1",
+  "datasources": {
+    "prometheus": {
+      "prometheus": {
+        "address": "http://127.0.0.1:9090"
+      }
+    }
+  },
+  "dashboard": {
+    "variables": {
+      "job": {
+        "constant": { "value": "bouncer-proxy" }
+      },
+      "interval": {
+        "interval": { "steps": 50 }
+      }
+    },
+    "widgets": [
+      {
+        "title": "Bouncer - Total queue sessions",
+        "gridPos": { "w": 20 },
+        "singlestat": {
+          "thresholds": [{ "color": "#47D038" }],
+          "query": {
+            "datasourceID": "prometheus",
+            "expr": "sum(bouncer_layer_queue_sessions{job=\"{{.job}}\"})"
+          }
+        }
+      },
+      {
+        "title": "Bouncer Traffic",
+        "gridPos": {
+          "w": 80
+        },
+        "graph": {
+          "queries": [
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(rate(bouncer_proxy_director_proxy_requests_total{job=\"{{.job}}\"}[{{.interval}}]))",
+              "legend": "req/s"
+            }
+          ]
+        }
+      },
+      {
+        "title": "Goroutines",
+        "gridPos": { "w": 20 },
+        "singlestat": {
+          "thresholds": [{ "color": "#47D038" }],
+          "query": {
+            "datasourceID": "prometheus",
+            "expr": "sum(go_goroutines{job=\"{{.job}}\"})"
+          }
+        }
+      },
+      {
+        "title": "GC duration",
+        "gridPos": { "w": 20 },
+        "singlestat": {
+          "unit": "second",
+          "query": {
+            "datasourceID": "prometheus",
+            "expr": "max(go_gc_duration_seconds{job=\"{{.job}}\"})"
+          }
+        }
+      },
+      {
+        "title": "Stack",
+        "gridPos": { "w": 20 },
+        "singlestat": {
+          "unit": "bytes",
+          "thresholds": [{ "color": "#22F1F1" }],
+          "query": {
+            "datasourceID": "prometheus",
+            "expr": "sum(go_memstats_stack_inuse_bytes{job=\"{{.job}}\"})"
+          }
+        }
+      },
+      {
+        "title": "Heap",
+        "gridPos": { "w": 20 },
+        "singlestat": {
+          "unit": "bytes",
+          "thresholds": [{ "color": "#22F1F1" }],
+          "query": {
+            "datasourceID": "prometheus",
+            "expr": "sum(go_memstats_heap_inuse_bytes{job=\"{{.job}}\"})"
+          }
+        }
+      },
+      {
+        "title": "Alloc",
+        "gridPos": { "w": 20 },
+        "singlestat": {
+          "unit": "bytes",
+          "thresholds": [{ "color": "#22F1F1" }],
+          "query": {
+            "datasourceID": "prometheus",
+            "expr": "sum(go_memstats_alloc_bytes{job=\"{{.job}}\"})"
+          }
+        }
+      },
+      {
+        "title": "Goroutines",
+        "gridPos": { "w": 50 },
+        "graph": {
+          "visualization": {
+            "legend": { "disable": true },
+            "yAxis": { "unit": "", "decimals": 2 }
+          },
+          "queries": [
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(go_goroutines{job=\"{{.job}}\"})"
+            }
+          ]
+        }
+      },
+      {
+        "title": "GC duration",
+        "gridPos": { "w": 50 },
+        "graph": {
+          "queries": [
+            {
+              "datasourceID": "prometheus",
+              "expr": "max(go_gc_duration_seconds{job=\"{{.job}}\"}) by (quantile)",
+              "legend": "Q{{.quantile}}"
+            }
+          ],
+          "visualization": {
+            "yAxis": { "unit": "second" },
+            "seriesOverride": [
+              { "regex": "^Q0$", "color": "#F9E2D2" },
+              { "regex": "^Q0.25$", "color": "#F2C96D" },
+              { "regex": "^Q0.5(0)?$", "color": "#EAB839" },
+              { "regex": "^Q0.75$", "color": "#EF843C" },
+              { "regex": "^Q1(.0)?$", "color": "#E24D42" }
+            ]
+          }
+        }
+      },
+      {
+        "title": "Memory",
+        "gridPos": { "w": 50 },
+        "graph": {
+          "visualization": {
+            "yAxis": { "unit": "byte", "decimals": 0 }
+          },
+          "queries": [
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(go_memstats_stack_inuse_bytes{job=\"{{.job}}\"})",
+              "legend": "stack inuse"
+            },
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(go_memstats_heap_inuse_bytes{job=\"{{.job}}\"})",
+              "legend": "heap inuse"
+            },
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(go_memstats_alloc_bytes{job=\"{{.job}}\"})",
+              "legend": "alloc"
+            }
+          ]
+        }
+      },
+      {
+        "title": "Memory ops rate",
+        "gridPos": {
+          "w": 50
+        },
+        "graph": {
+          "queries": [
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(rate(go_memstats_frees_total{job=\"{{.job}}\"}[{{.interval}}]))",
+              "legend": "frees/s"
+            },
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(rate(go_memstats_mallocs_total{job=\"{{.job}}\"}[{{.interval}}]))",
+              "legend": "mallocs/s"
+            },
+            {
+              "datasourceID": "prometheus",
+              "expr": "sum(rate(go_memstats_lookups_total{job=\"{{.job}}\"}[{{.interval}}]))",
+              "legend": "lookups/s"
+            }
+          ]
+        }
+      }
+    ]
+  }
+}
--- a/misc/images/bouncer/Dockerfile
+++ b/misc/images/bouncer/Dockerfile
@ -0,0 +1,49 @@
+FROM golang:1.20 AS BUILD
+
+RUN apt-get update \
+    && apt-get install -y make
+
+ARG YQ_VERSION=4.34.1
+
+RUN mkdir -p /usr/local/bin \
+    && wget -O /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64 \
+    && chmod +x /usr/local/bin/yq
+
+COPY . /src
+
+WORKDIR /src
+
+RUN make GORELEASER_ARGS='build --rm-dist --single-target --snapshot' goreleaser
+
+# Patch config
+RUN /src/dist/bouncer_linux_amd64_v1/bouncer -c '' config dump > /src/dist/bouncer_linux_amd64_v1/config.yml \
+    && yq -i '.layers.queue.templateDir = "/usr/share/bouncer/layers/queue/templates"' /src/dist/bouncer_linux_amd64_v1/config.yml \
+    && yq -i '.admin.auth.privateKey = "/etc/bouncer/admin-key.json"' /src/dist/bouncer_linux_amd64_v1/config.yml \
+    && yq -i '.redis.adresses = ["redis:6379"]' /src/dist/bouncer_linux_amd64_v1/config.yml
+
+FROM alpine:3.18 AS RUNTIME
+
+ARG DUMB_INIT_VERSION=1.2.5
+
+RUN apk add --no-cache ca-certificates
+
+RUN mkdir -p /usr/local/bin \
+    && wget -O /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_x86_64 \
+    && chmod +x /usr/local/bin/dumb-init
+
+ENTRYPOINT ["/usr/local/bin/dumb-init", "--"]
+
+RUN mkdir -p /usr/local/bin /usr/share/bouncer/bin /etc/bouncer
+
+COPY --from=BUILD /src/dist/bouncer_linux_amd64_v1/bouncer /usr/share/bouncer/bin/bouncer
+COPY --from=BUILD /src/layers /usr/share/bouncer/layers
+COPY --from=BUILD /src/dist/bouncer_linux_amd64_v1/config.yml /etc/bouncer/config.yml
+
+RUN ln -s /usr/share/bouncer/bin/bouncer /usr/local/bin/bouncer
+
+EXPOSE 8080
+EXPOSE 8081
+
+ENV BOUNCER_CONFIG=/etc/bouncer/config.yml
+
+CMD ["bouncer"]
--- a/misc/jenkins/Dockerfile
+++ b/misc/jenkins/Dockerfile
@ -7,12 +7,22 @@ ARG https_proxy=

 # Install dev environment dependencies
 RUN export DEBIAN_FRONTEND=noninteractive &&\
+    apt clean &&\
    apt-get update -y &&\
-    apt-get install -y --no-install-recommends curl ca-certificates build-essential wget unzip tar git jq
+    apt-get install -y --no-install-recommends curl ca-certificates build-essential wget unzip tar git jq gnupg

 # Add LetsEncrypt certificates
 RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash

+RUN install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
+    && chmod a+r /etc/apt/keyrings/docker.gpg \
+    && echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+        "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" \
+        | tee /etc/apt/sources.list.d/docker.list > /dev/null \
+    && apt-get update \
+    && apt-get install -y docker-ce-cli
+
 ARG GO_VERSION=1.20.4

 # Install Go
--- a/misc/k8s/kustomization/base/kustomization.yaml
+++ b/misc/k8s/kustomization/base/kustomization.yaml
@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bouncer
+
+resources:
+- ./resources/namespace.yaml
+- ./resources/bouncer-server
+- ./resources/bouncer-admin
+- ./resources/redis
+
--- a/misc/k8s/kustomization/base/resources/bouncer-admin/files/admin-key.json
+++ b/misc/k8s/kustomization/base/resources/bouncer-admin/files/admin-key.json
@ -0,0 +1 @@
+{"d":"JuBw5OsGv3rPgVczxUgtJ6iUQ41LQu4Xpu-t8IKI_z8r-BZBlbndxidPmRlGZASLGL3rhY4qw6_ScFxakrMpCreO1RMU0kqtz--N48BXFnW5tEgr1voyyKP__bPssQNn6PgkoyAd11es7MEKlBff_DtGrcSkVRgU0zDZB-vIU0aNEIZPNw0icbYqc1u_QQNPpBU9cw6P33WHhzvfCVAkZKRszwznhiPM08n1vjpiA7e1kQ8a6OC4IFZBvohkmpmyOq1g1OLRABQ83YPCjGjCAejO-jEWkbLksp6rAl_YYpCvfBAjFV76JuZq4eh5IU82LsSfi3PGYBkhxWuLY779XQ","dp":"gljHOQowGK7fVn2DJizWtgRIDJuKpKnoX2PWNJUbm2WZwcEPZalAkxn7Y-w_reLVJZuRpfKEUMS-Tn3-CwI1ZjCHPqMPTXcoG0Pe2E-Z88jOs9lW4XSOASiiM980VIvkV1xCxDJkN3NsDFQ9j9kRGnKuMnsucCW3AKaU917hXNU","dq":"mqY19JcEBDnzS70_XkAsOKqPzemOScax66b-4N6zrsgeLVlRjHffY9uCAgBWzlxOidRdQN8q23ZJB4fqsKB2w00Iw7Jxx94IoAKGjKDT5iB48Y_kdKLAwSHRTXsqA9GG3po_H_JpP_EqX4TDBYtqQZuBD_tACP9HbLYMi_V2YU8","e":"AQAB","kty":"RSA","n":"sam0X0BGcuFwX8z3Wde8cv2o_zl6A9ghpkT0tCjw8qH3GNWrbAqzncSWdHBzoChBgAbuTOVs-ixYC0KeUhwFdc8Ul-jmKJWFaS8kIr3y4EH62-vLgMuIKfaxbsyUG6KMkJfnftge1jPO4ccddNej9msxcqTxu37dcgstutwtd6QkS9p5RrNbDBc8-Z7SQ4TuxJfP8msXRnCPJ-I44yszGdQF1Np2DXakJHVn8PBrDh3iSFwORw8jxNS4oS0OlBl5aSc0t5XkkaNcSU2a50SKts290w54fl6MPJ1sLnnznLy4uu37-nrfEUvqRLDZL9B1F82RM1dtLIIiN4gnSrMlpQ","p":"wOmFPhAT_wXWzMuwtEdYIer3-CiOWxFKpFL09eEJkJ29MIUchEaoiJaUAghqPxM48llfOVaUaLbFVxmo5U3fyjNMaP-nHMUBwojutykMK-gC2R3J4bQgFWfKbGSL7M7UsextAvpq9iiOuR0LNE-xTfCgPIxHVdPZskO3yx0DkjM","q":"68OGRb0tLRjb_PpkGctcSjEz_vvcyjzxGL-fn4_h4GCw98Xrj6Y4rZ4lfWWRSeDohSvdd-ICSlxvxkQOIOcA0H7jyJcBC0KDs4hX5BRGJNDri3QX0ry4_F1ptAdbfiFgQGqCfMRCr7L60Tfd_6tLczvny7eEBKQNGdj6dLfhgMc","qi":"DFwixyxUDf0REPLLa8hOKieRL95_AH9rbYWzStBOdSjKWra5l0reD6a4bbvAYvl0e8qCcRI6S8Nzpz0BYm4sJL7poVOnjxqvBY3Q9Ppf4Mq8lW39pOCJcqOHIvvYHsMjTC5uwp7Yg2p0GvxuUibbyNL1PXf6WZ_szVP_oSMrCXA"}
--- a/misc/k8s/kustomization/base/resources/bouncer-admin/files/config.yml
+++ b/misc/k8s/kustomization/base/resources/bouncer-admin/files/config.yml
@ -0,0 +1,36 @@
+admin:
+  http:
+    host: 127.0.0.1
+    port: 8081
+  cors:
+    allowedOrigins:
+    - http://localhost:3001
+    allowCredentials: true
+    allowMethods:
+    - POST
+    - GET
+    - PUT
+    - DELETE
+    allowedHeaders:
+    - Origin
+    - Accept
+    - Content-Type
+    - Authorization
+    - Sentry-Trace
+    debug: false
+  auth:
+    issuer: http://127.0.0.1:8081
+    privateKey: /etc/bouncer/admin-key.json
+  metrics:
+    enabled: true
+    endpoint: /.bouncer/metrics
+    basicAuth: null
+
+redis:
+  addresses:
+  - ${REDIS_SENTINEL_HOST}:${REDIS_SENTINEL_PORT}
+  master: "${REDIS_MASTER_NAME}"
+
+logger:
+  level: 3
+  format: human
--- a/misc/k8s/kustomization/base/resources/bouncer-admin/kustomization.yaml
+++ b/misc/k8s/kustomization/base/resources/bouncer-admin/kustomization.yaml
@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ./resources/service.yaml
+- ./resources/deployment.yaml
+
+configMapGenerator:
+- name: bouncer-admin-config
+  files:
+  - ./files/config.yml
+  - ./files/admin-key.json
+- name: bouncer-admin-env
+  literals:
+  - REDIS_SENTINEL_HOST="rfs-$(REDIS_SERVICE_NAME)"
+  - REDIS_SENTINEL_PORT="26379"
+  - REDIS_MASTER_NAME="mymaster"
--- a/misc/k8s/kustomization/base/resources/bouncer-admin/resources/deployment.yaml
+++ b/misc/k8s/kustomization/base/resources/bouncer-admin/resources/deployment.yaml
@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bouncer-admin
+  labels:
+    app: bouncer-admin
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: bouncer-admin
+  template:
+    metadata:
+      labels:
+        app: bouncer-admin
+    spec:
+      containers:
+      - name: bouncer-admin
+        image: reg.cadoles.com/cadoles/bouncer:v2023.7.8-b44ff2a
+        command: ["bouncer"]
+        args: ["--debug", "-c", "/etc/bouncer/config.yml", "server", "admin", "run"]
+        imagePullPolicy: Always
+        envFrom:
+        - configMapRef:
+            name: bouncer-admin-env
+        env:
+        - name: REDIS_SENTINEL_HOST
+          value: "rfs-$(REDIS_SERVICE_NAME)"
+        ports:
+        - name: bouncer-admin
+          containerPort: 8081
+        volumeMounts:
+        - mountPath: /etc/bouncer/
+          name: bouncer-admin-config
+      volumes:
+      - name: bouncer-admin-config
+        configMap:
+          name: bouncer-admin-config
--- a/misc/k8s/kustomization/base/resources/bouncer-admin/resources/service.yaml
+++ b/misc/k8s/kustomization/base/resources/bouncer-admin/resources/service.yaml
@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: bouncer-admin
+  name: bouncer-admin
+spec:
+  type: ClusterIP
+  ports:
+  - name: bouncer-admin
+    port: 8081
+    targetPort: 8080
+  selector:
+    io.kompose.service: bouncer-admin
--- a/misc/k8s/kustomization/base/resources/bouncer-server/files/config.yml
+++ b/misc/k8s/kustomization/base/resources/bouncer-server/files/config.yml
@ -0,0 +1,22 @@
+proxy:
+  http:
+    host: 0.0.0.0
+    port: 8080
+  metrics:
+    enabled: true
+    endpoint: /.bouncer/metrics
+    basicAuth: null
+
+layers:
+  queue:
+    templateDir: /usr/share/bouncer/layers/queue/templates
+    defaultKeepAlive: 1m0s
+
+redis:
+  addresses:
+  - ${RFS_BOUNCER_REDIS_SERVICE_HOST}:${RFS_BOUNCER_REDIS_SERVICE_PORT}
+  master: ""
+
+logger:
+  level: 3
+  format: human
--- a/misc/k8s/kustomization/base/resources/bouncer-server/kustomization.yaml
+++ b/misc/k8s/kustomization/base/resources/bouncer-server/kustomization.yaml
@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ./resources/service.yaml
+- ./resources/deployment.yaml
+
+configMapGenerator:
+- name: bouncer-server-config
+  files:
+  - ./files/config.yml
--- a/misc/k8s/kustomization/base/resources/bouncer-server/resources/deployment.yaml
+++ b/misc/k8s/kustomization/base/resources/bouncer-server/resources/deployment.yaml
@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bouncer-server
+  labels:
+    app: bouncer-server
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: bouncer-server
+  template:
+    metadata:
+      labels:
+        app: bouncer-server
+    spec:
+      containers:
+      - name: bouncer-server
+        image: reg.cadoles.com/cadoles/bouncer:v2023.7.8-b44ff2a
+        command: ["bouncer", "-c", "/etc/bouncer/config.yml", "server", "proxy", "run"]
+        imagePullPolicy: Always
+        ports:
+        - name: bouncer-server
+          containerPort: 8080
+        volumeMounts:
+        - mountPath: /etc/bouncer/
+          name: bouncer-server-config
+      volumes:
+      - name: bouncer-server-config
+        configMap:
+          name: bouncer-server-config
--- a/misc/k8s/kustomization/base/resources/bouncer-server/resources/service.yaml
+++ b/misc/k8s/kustomization/base/resources/bouncer-server/resources/service.yaml
@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: bouncer-server
+  name: bouncer-server
+spec:
+  type: ClusterIP
+  ports:
+  - name: bouncer-server
+    port: 8080
+    targetPort: 8080
+  selector:
+    io.kompose.service: bouncer-server
--- a/misc/k8s/kustomization/base/resources/namespace.yaml
+++ b/misc/k8s/kustomization/base/resources/namespace.yaml
@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bouncer
--- a/misc/k8s/kustomization/base/resources/redis/kustomization.yaml
+++ b/misc/k8s/kustomization/base/resources/redis/kustomization.yaml
@ -0,0 +1,15 @@
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ./resources/redis-cluster.yaml
+
+vars:
+- name: REDIS_SERVICE_NAME
+  objref:
+    name: bouncer-redis
+    apiVersion: databases.spotahome.com/v1
+    kind: RedisFailover
+  fieldref:
+    fieldpath: metadata.name
--- a/misc/k8s/kustomization/base/resources/redis/resources/redis-cluster.yaml
+++ b/misc/k8s/kustomization/base/resources/redis/resources/redis-cluster.yaml
@ -0,0 +1,21 @@
+apiVersion: databases.spotahome.com/v1
+kind: RedisFailover
+metadata:
+  name: bouncer-redis
+spec:
+  sentinel:
+    replicas: 3
+    resources:
+      requests:
+        cpu: 100m
+      limits:
+        memory: 100Mi
+  redis:
+    replicas: 3
+    resources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+      limits:
+        cpu: 400m
+        memory: 500Mi
--- a/misc/k8s/kustomization/overlays/dev/kustomization.yaml
+++ b/misc/k8s/kustomization/overlays/dev/kustomization.yaml
@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bouncer-dev
+
+resources:
+- ../../base
+
+secretGenerator:
+- files:
+  - secrets/dockerconfig/.dockerconfigjson
+  name: regcred-dev
+  type: kubernetes.io/dockerconfigjson
+
+patches:
+- path: patches/add-registry-pull-secret.patch.yaml
+  target:
+    kind: Deployment
+    version: v1
--- a/misc/k8s/kustomization/overlays/dev/patches/add-registry-pull-secret.patch.yaml
+++ b/misc/k8s/kustomization/overlays/dev/patches/add-registry-pull-secret.patch.yaml
@ -0,0 +1,4 @@
+- op: add
+  path: "/spec/template/spec/imagePullSecrets"
+  value:
+  - name: regcred-dev
--- a/misc/logo/bouncer.png
+++ b/misc/logo/bouncer.png
--- a/misc/packaging/common/config.yml
+++ b/misc/packaging/common/config.yml
@ -6,6 +6,9 @@ admin:
        host: 127.0.0.1
        # Port d'écoute du service
        port: 8081
+        # Utiliser les entêtes HTTP True-Client-IP, X-Real-IP ou X-Forwarded-For
+        # pour le calcul de l'adresse distante à l'origine des requêtes
+        useRealIP: true

    # Configuration CORS du service
    # Uniquement nécessaire si un frontend web
@ -26,10 +29,45 @@ admin:
            - Authorization
            - Sentry-Trace
        debug: false
+    
+    # Authentification JWT
    auth:
+        # Origine du jeton JWT
        issuer: http://127.0.0.1:8081
+        # Clé privée permettant de signer les jetons
+        # JWT générés pour l'usage de l'API d'administration.
        privateKey: /etc/bouncer/admin-key.json

+    # Métriques Prometheus
+    metrics:
+        # Activer ou désactiver la publication des métriques
+        enabled: true
+        # Route de publication des métriques
+        endpoint: /.bouncer/metrics
+        # Authentification "basic auth" sur la page
+        # de publication
+        # Mettre à null pour désactiver l'authentification
+        basicAuth: null
+    
+    # Configuration de l'intégration Sentry
+    # Voir https://pkg.go.dev/github.com/getsentry/sentry-go?utm_source=godoc#ClientOptions
+    sentry:
+        dsn: ""
+        debug: false
+        flushTimeout: 2s
+        attachStacktrace: true
+        sampleRate: 1
+        enableTracing: true
+        tracesSampleRate: 0.2
+        profilesSampleRate: 1
+        ignoreErrors: []
+        sendDefaultPII: false
+        serverName: ""
+        environment: ""
+        maxBreadcrumbs: 0
+        maxSpans: 1000
+        maxErrorDepth: 10
+
 # Configuration du service "proxy"
 proxy:
    http:
@ -38,6 +76,66 @@ proxy:
        host: 0.0.0.0
        # Port d'écoute du service
        port: 8080
+        # Utiliser les entêtes HTTP True-Client-IP, X-Real-IP ou X-Forwarded-For
+        # pour le calcul de l'adresse distante à l'origine des requêtes
+        useRealIP: true
+    
+    # Métriques Prometheus
+    metrics:
+        # Activer ou désactiver la publication des métriques
+        enabled: true
+        # Route de publication des métriques
+        endpoint: /.bouncer/metrics
+        # Authentification "basic auth" sur la page
+        # de publication
+        # Mettre à null pour désactiver l'authentification
+        basicAuth:
+            credentials:
+                prom: etheus
+
+    # Configuration du transport HTTP(S)
+    # Voir https://pkg.go.dev/net/http#Transport
+    transport:
+        forceAttemptHTTP2: true
+        maxIdleConns: 100
+        maxIdleConnsPerHost: 100
+        maxConnsPerHost: 100
+        idleConnTimeout: 1m30s
+        tlsHandshakeTimeout: 10s
+        expectContinueTimeout: 1s
+        disableKeepAlives: false
+        disableCompression: false
+        responseHeaderTimeout: 10s
+        writeBufferSize: 4096
+        readBufferSize: 4096
+        maxResponseHeaderBytes: 0
+
+    # Configuration de l'intégration Sentry
+    # Voir https://pkg.go.dev/github.com/getsentry/sentry-go?utm_source=godoc#ClientOptions
+    sentry:
+        dsn: ""
+        debug: false
+        flushTimeout: 2s
+        attachStacktrace: true
+        sampleRate: 1
+        enableTracing: true
+        tracesSampleRate: 0.2
+        profilesSampleRate: 1
+        ignoreErrors: []
+        sendDefaultPII: false
+        serverName: ""
+        environment: ""
+        maxBreadcrumbs: 0
+        maxSpans: 1000
+        maxErrorDepth: 10
+
+    # Configuration des connexions TCP
+    # Voir https://pkg.go.dev/net#Dialer
+    dial:
+        timeout: 30s
+        keepAlive: 30s
+        fallbackDelay: 300ms
+        dualStack: true

 # Configuration du client Redis
 #
@ -69,4 +167,10 @@ layers:
        # Répertoire contenant les templates
        templateDir: "/etc/bouncer/layers/queue/templates"
        # Temps de vie par défaut d'une session
-        defaultKeepAlive: 1m
+        defaultKeepAlive: 1m
+    
+    # Configuration du layer "circuitbreaker"
+    circuitbreaker:
+        # Répertoire contenant les templates
+        templateDir: "/etc/bouncer/layers/circuitbreaker/templates"
+    
--- a/misc/prometheus/prometheus.yml
+++ b/misc/prometheus/prometheus.yml
@ -0,0 +1,7 @@
+scrape_configs:
+  - job_name: bouncer-proxy
+    metrics_path: /.bouncer/metrics
+    static_configs:
+      - targets:
+          - "localhost:8080"
+    scrape_interval: 5s
--- a/misc/siege/urls.txt
+++ b/misc/siege/urls.txt
@ -0,0 +1,6 @@
+http://localhost:8080/blog/
+http://localhost:8080/services/
+http://localhost:8080/
+http://localhost:8080/recrutement/
+http://localhost:8080/faq/
+http://localhost:8080/societe/histoire/
--- a/modd.conf
+++ b/modd.conf
@ -8,10 +8,15 @@ layers/**
    prep: make build-bouncer
    prep: make config.yml
    prep: make .bouncer-token
-    daemon: make run BOUNCER_CMD="--config config.yml server admin run"
-    daemon: make run BOUNCER_CMD="--config config.yml server proxy run"
+    daemon: make run BOUNCER_CMD="--debug --config config.yml server admin run"
+    daemon: make run BOUNCER_CMD="--debug --config config.yml server proxy run"
 }

 {
    daemon +sigint: make run-redis
+}
+
+misc/prometheus/prometheus.yml
+{
+    daemon +sigint: make run-prometheus
 }
--- a/skaffold.yaml
+++ b/skaffold.yaml
@ -0,0 +1,42 @@
+apiVersion: skaffold/v3
+kind: Config
+
+metadata:
+  name: bouncer
+
+manifests:
+  kustomize:
+    paths:
+    - misc/k8s/kustomization/base
+
+profiles:
+- name: dev
+  manifests:
+    kustomize:
+      paths:
+      - misc/k8s/kustomization/overlays/dev
+  activation:
+  - command: dev
+
+build:
+  local:
+    push: true
+
+  tagPolicy:
+    sha256: {}
+
+  artifacts:
+  - image: reg.cadoles.com/cadoles/bouncer
+    context: .
+    sync:
+      infer:
+      - cmd/**
+      - internal/**
+      - layers/**
+      - tools/**
+      - data/**
+    docker:
+      dockerfile: misc/images/bouncer/Dockerfile
+
+deploy:
+  statusCheckDeadlineSeconds: 600
Author	SHA1	Message	Date
Philippe Caseiro	1b7344bcb5	fix(config): supporting multiple env variables in a value. All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details ref #9	2023-07-10 17:02:56 +02:00
Philippe Caseiro	bcc73a97cc	feat(k8s): adding kubernetes support All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details Cadoles/bouncer/pipeline/pr-develop This commit looks good Details Now we can use skaffold and deploy bouncer in a kubernetes cluster ref #10	2023-07-10 17:02:56 +02:00
William Petit	b44ff2a68e	doc: add proxy http api reference All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-08 12:19:43 -06:00
William Petit	c719fdca37	feat: add prometheus + grafterm dashboard in local dev environment	2023-07-08 12:18:38 -06:00
William Petit	2b91c1e167	feat(store,repository): add more integration tests All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-07 12:22:31 -06:00
William Petit	cebf1daf72	chore: update github.com/lestrrat-go/jwx/v2 All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-07 10:20:27 -06:00
wpetit	6734cf6526	Merge pull request 'Génération de l'image Docker via le pipeline Jenkins' (#7 ) from ci-docker-release into develop Some checks reported errors Cadoles/bouncer/pipeline/head Something is wrong with the build of this commit Details Reviewed-on: #7	2023-07-07 18:11:06 +02:00
William Petit	368273f1ee	chore(ci): release docker image Some checks are pending Cadoles/bouncer/pipeline/pr-develop Build started... Details	2023-07-07 10:10:22 -06:00
wpetit	553513d647	Merge pull request 'Implémentation du layer "circuitbreaker"' (#6 ) from circuitbreaker into develop All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details Reviewed-on: #6	2023-07-06 16:46:17 +02:00
William Petit	60487c11d6	feat: optional real-ip middleware All checks were successful Cadoles/bouncer/pipeline/pr-develop This commit looks good Details	2023-07-06 08:16:17 -06:00
William Petit	e6f18e7cd8	fix(doc): typo All checks were successful Cadoles/bouncer/pipeline/pr-develop This commit looks good Details	2023-07-06 07:59:20 -06:00
William Petit	a207291c04	feat: implements circuitbreaker layer	2023-07-06 07:59:20 -06:00
William Petit	64b5182f8b	fix(doc): bad link All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-06 07:41:53 -06:00
William Petit	ce2c19f9b3	feat(layer,queue): implement matchURLs option All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-05 13:54:01 -06:00
William Petit	1ffec1f173	feat(layer,queue): prevent browser caching for queue page All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-05 13:35:21 -06:00
William Petit	aab5452fa2	feat: sentry integration All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details ref #3	2023-07-05 12:05:30 -06:00
William Petit	a176b754cd	feat: add queue adapter tests All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-05 08:55:15 -06:00
wpetit	7b04eb2418	fix(doc): bad link All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-05 15:14:27 +02:00
wpetit	f8d9ff15b5	doc: add link to misc/docker-compose Some checks reported errors Cadoles/bouncer/pipeline/head Something is wrong with the build of this commit Details	2023-07-05 15:13:31 +02:00
William Petit	5bd7cbc132	fix(docker): move templates to expected path All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-03 19:42:44 -06:00
William Petit	1b06f07ce8	feat: update packaged configuration All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-01 13:55:26 -06:00
William Petit	82228fd115	feat: allow customization of proxy transport configuration All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-01 13:43:18 -06:00
William Petit	15daddbe13	feat: add multi-nodes docker-compose deployment example All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-01 11:38:16 -06:00
William Petit	5a7062d53e	fix: remove log message All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-07-01 11:33:59 -06:00
William Petit	74409f18e8	feat: update packaged configuration All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-06-30 17:51:01 -06:00
wpetit	ab7f64a684	Merge pull request 'Métriques de base Prometheus' (#4 ) from metrics into develop All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details Reviewed-on: #4	2023-07-01 01:32:10 +02:00
William Petit	d5cc15de3b	chore: run service in debug mode by default All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details Cadoles/bouncer/pipeline/pr-develop This commit looks good Details	2023-06-30 10:26:52 -06:00
William Petit	56609ec316	feat: add basic prometheus metrics integration Some checks reported errors Cadoles/bouncer/pipeline/head Something is wrong with the build of this commit Details	2023-06-30 10:26:27 -06:00
William Petit	5bf391b6bf	fix(docker): add layers templates in image All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-06-29 20:36:11 -06:00
William Petit	74928fe413	chore: add log message for workdir and configuration loading All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-06-29 20:16:25 -06:00
William Petit	ff1d01828d	fix: docker image build All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-06-29 20:14:20 -06:00
William Petit	851f5d64cc	doc: add getting started with sources tutorial	2023-06-29 20:13:21 -06:00
William Petit	e0d81c061b	chore: add png logo All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-06-29 14:45:47 -06:00
wpetit	440d467938	fix(doc): bad link All checks were successful Cadoles/bouncer/pipeline/head This commit looks good Details	2023-06-26 16:37:55 +02:00
				`@ -0,0 +1 @@`
				{"d":"JuBw5OsGv3rPgVczxUgtJ6iUQ41LQu4Xpu-t8IKI_z8r-BZBlbndxidPmRlGZASLGL3rhY4qw6_ScFxakrMpCreO1RMU0kqtz--N48BXFnW5tEgr1voyyKP__bPssQNn6PgkoyAd11es7MEKlBff_DtGrcSkVRgU0zDZB-vIU0aNEIZPNw0icbYqc1u_QQNPpBU9cw6P33WHhzvfCVAkZKRszwznhiPM08n1vjpiA7e1kQ8a6OC4IFZBvohkmpmyOq1g1OLRABQ83YPCjGjCAejO-jEWkbLksp6rAl_YYpCvfBAjFV76JuZq4eh5IU82LsSfi3PGYBkhxWuLY779XQ","dp":"gljHOQowGK7fVn2DJizWtgRIDJuKpKnoX2PWNJUbm2WZwcEPZalAkxn7Y-w_reLVJZuRpfKEUMS-Tn3-CwI1ZjCHPqMPTXcoG0Pe2E-Z88jOs9lW4XSOASiiM980VIvkV1xCxDJkN3NsDFQ9j9kRGnKuMnsucCW3AKaU917hXNU","dq":"mqY19JcEBDnzS70_XkAsOKqPzemOScax66b-4N6zrsgeLVlRjHffY9uCAgBWzlxOidRdQN8q23ZJB4fqsKB2w00Iw7Jxx94IoAKGjKDT5iB48Y_kdKLAwSHRTXsqA9GG3po_H_JpP_EqX4TDBYtqQZuBD_tACP9HbLYMi_V2YU8","e":"AQAB","kty":"RSA","n":"sam0X0BGcuFwX8z3Wde8cv2o_zl6A9ghpkT0tCjw8qH3GNWrbAqzncSWdHBzoChBgAbuTOVs-ixYC0KeUhwFdc8Ul-jmKJWFaS8kIr3y4EH62-vLgMuIKfaxbsyUG6KMkJfnftge1jPO4ccddNej9msxcqTxu37dcgstutwtd6QkS9p5RrNbDBc8-Z7SQ4TuxJfP8msXRnCPJ-I44yszGdQF1Np2DXakJHVn8PBrDh3iSFwORw8jxNS4oS0OlBl5aSc0t5XkkaNcSU2a50SKts290w54fl6MPJ1sLnnznLy4uu37-nrfEUvqRLDZL9B1F82RM1dtLIIiN4gnSrMlpQ","p":"wOmFPhAT_wXWzMuwtEdYIer3-CiOWxFKpFL09eEJkJ29MIUchEaoiJaUAghqPxM48llfOVaUaLbFVxmo5U3fyjNMaP-nHMUBwojutykMK-gC2R3J4bQgFWfKbGSL7M7UsextAvpq9iiOuR0LNE-xTfCgPIxHVdPZskO3yx0DkjM","q":"68OGRb0tLRjb_PpkGctcSjEz_vvcyjzxGL-fn4_h4GCw98Xrj6Y4rZ4lfWWRSeDohSvdd-ICSlxvxkQOIOcA0H7jyJcBC0KDs4hX5BRGJNDri3QX0ry4_F1ptAdbfiFgQGqCfMRCr7L60Tfd_6tLczvny7eEBKQNGdj6dLfhgMc","qi":"DFwixyxUDf0REPLLa8hOKieRL95_AH9rbYWzStBOdSjKWra5l0reD6a4bbvAYvl0e8qCcRI6S8Nzpz0BYm4sJL7poVOnjxqvBY3Q9Ppf4Mq8lW39pOCJcqOHIvvYHsMjTC5uwp7Yg2p0GvxuUibbyNL1PXf6WZ_szVP_oSMrCXA"}