Statistics: traffic, drops, devices and connections over time

internal/stats samples every minute what the kernel already counts: the
interfaces' counters (per zone too), Housecarl's table (hits per rule,
built-in and policy; drops by chain; quotas; per-device sets), the
connection tracking table, and housecarld's and the host's memory, CPU
and load. Logged drops feed top lists of sources and what they tried.
Aggregates go to a database of their own (stats.db; per minute 7 days,
per hour 90 days, per day 2 years), with the store and queries from
Jarl's.

Traffic per inside device is a setting (stats_per_device): counting sets
stats_up/down_v4/v6 and rules at the top of the forward chain, IPv6 per
/64, carried across reloads. Set names starting with meter_, conn_,
quota_ or stats_ are reserved (set_name_reserved).

GET /stats/{status,summary,timeline,top,hits,heatmap}, hc stats, a
Statistics page with Jarl's charts, two charts on the dashboard, and a
conntrack_full warning. e2e: 188 checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server_test.go

@@ -23,6 +23,7 @@ import (
 	"housecarl/internal/model"
 	"housecarl/internal/nft"
 	"housecarl/internal/render"
+	"housecarl/internal/stats"
 	"housecarl/internal/store"
 )
 
@@ -994,3 +995,67 @@ func TestTrace(t *testing.T) {
 		t.Errorf("tracing everything: %d", code)
 	}
 }
+
+// TestStatsEndpoints: statistics off, then on: the summary's top lists,
+// hits per rule (named, with those that counted none), and which
+// counters count drops.
+func TestStatsEndpoints(t *testing.T) {
+	e := newEnv(t)
+	if code := e.call(e.token, "GET", "/stats/summary", nil, nil); code != http.StatusServiceUnavailable {
+		t.Errorf("statistics off: %d", code)
+	}
+	var st StatsStatus
+	e.call(e.token, "GET", "/stats/status", nil, &st)
+	if st.Enabled {
+		t.Error("enabled without a collector")
+	}
+	e.call(e.token, "POST", "/zones", model.Zone{Name: "wan", Interfaces: []string{"wan"}, External: true}, nil)
+	e.call(e.token, "POST", "/rules", model.Rule{Chain: "input", Match: model.Match{Sources: []string{"198.51.100.0/24"}}, Action: "drop", Comment: "bad net"}, nil)
+	rule := e.eng.State().Rules[0]
+
+	ss, err := stats.OpenStore(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ss.Close()
+	src := stats.Sources{Table: e.fw.Table, SysNet: t.TempDir(), Proc: t.TempDir()}
+	e.srv.StatsSources(&src)
+	c := stats.NewCollector(ss, stats.Options{RetainMinute: 7 * 24 * time.Hour, RetainHour: 90 * 24 * time.Hour, RetainDay: 730 * 24 * time.Hour}, src, nil)
+	e.srv.SetStats(c)
+	c.Start(context.Background())
+	e.srv.LogPacket(api.LogEntry{Time: time.Now(), Source: "198.51.100.7", Protocol: "tcp", DestPort: 22, Verdict: "drop"})
+	c.Sample(context.Background())
+
+	var sum stats.Summary
+	if code := e.call(e.token, "GET", "/stats/summary?since=1h", nil, &sum); code != http.StatusOK {
+		t.Fatalf("summary: %d", code)
+	}
+	if len(sum.BlockedSources) != 1 || sum.BlockedSources[0].Key != "198.51.100.7" || len(sum.BlockedPorts) != 1 || sum.BlockedPorts[0].Key != "tcp/22" {
+		t.Errorf("summary: %+v", sum)
+	}
+	var hits []stats.Entry
+	e.call(e.token, "GET", "/stats/hits", nil, &hits)
+	if len(hits) != 1 || hits[0].Key != "r"+itoa(rule.ID) || hits[0].Count != 0 || !strings.Contains(hits[0].Name, "bad net") {
+		t.Errorf("hits: %+v", hits)
+	}
+	var top []stats.Entry
+	if code := e.call(e.token, "GET", "/stats/top?kind=blocked_port&since=7d", nil, &top); code != http.StatusOK || len(top) != 1 {
+		t.Errorf("top: %d %+v", code, top)
+	}
+	if code := e.call(e.token, "GET", "/stats/top?kind=nonsense", nil, nil); code != http.StatusBadRequest {
+		t.Errorf("an unknown list: %d", code)
+	}
+	if code := e.call(e.token, "GET", "/stats/timeline?keys=zrx:*,drops&since=2h", nil, nil); code != http.StatusOK {
+		t.Errorf("timeline: %d", code)
+	}
+	e.call(e.token, "GET", "/stats/status", nil, &st)
+	if !st.Enabled || st.LastSample == nil {
+		t.Errorf("status: %+v", st)
+	}
+	for mark, want := range map[string]string{"r" + itoa(rule.ID): "input true", "p-input": "input true", "p-output": "output false", "b-antispoof6": "early true", "b-established": " false"} {
+		chain, drop := e.srv.classifyMark(mark)
+		if got := fmt.Sprint(chain, " ", drop); got != want {
+			t.Errorf("%s: %q, want %q", mark, got, want)
+		}
+	}
+}