@@ -0,0 +16,4 @@
+
+// HTTPHandler is an HTTP middleware handler that records per-service
+// request/response byte metrics for Prometheus.
+type HTTPHandler struct {

@@ -0,0 +64,4 @@
+// countingReader wraps an io.ReadCloser to count bytes read.
+type countingReader struct {
+	r         io.ReadCloser
+	bytesRead atomic.Uint64

@@ -0,0 +97,4 @@
+	return c.bytesWritten.Load()
+}
+
+func (c *countingResponseWriter) Unwrap() http.ResponseWriter {

@@ -0,0 +15,4 @@
+
+// L4Handler is a Layer4 handler that records bytes read and written
+// per connection, labeled by service FQDN and user public key for Prometheus metrics.
+type L4Handler struct {

@@ -328,1 +328,4 @@
 
+		// Record per-user bytes transferred on this TLS passthrough connection
+		metricsHandlerConfig := map[string]interface{}{
+			"service":      hostMatcher,

@@ -446,1 +453,4 @@
 
+		// Build per-service HTTP metrics handler
+		httpMetricsConfig := map[string]interface{}{
+			"service":      hostMatcher,

@@ -0,0 +37,4 @@
+}
+
+func (h *HTTPMetricsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error {
+	countedBody := &countingReader{r: r.Body}