Description
We fetch IPsec lease pools only; api/ipsec/leases/search adds per-lease mobile-client visibility (who holds which address from which pool). Aggregate counts as metrics; keep per-client identity out of labels (bounded cardinality — count by pool, not by client).
Acceptance Criteria
- #1 Lease counts per pool exported; no unbounded per-client labels
- #2 AGENTS.md new-collector steps complete; gates clean
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
Verify the current IPsec pool collector against this task acceptance contract; confirm it exports online/offline lease counts only by bounded pool dimensions from the existing list_leases.py-backed response; avoid adding the redundant leases/search call or duplicate metric family; run focused IPsec pool tests, just gen and just check; record the supersession and finalize as a tracker-only task.
Implementation Notes
Reconciled the task against current main before adding code. The existing IPsec collector already exports online and offline lease counts per pool as opnsense_ipsec_pool_leases_online and opnsense_ipsec_pool_leases_offline with only bounded pool and net labels. FetchIPsecPools consumes the leases/pools response produced by the same list_leases.py backend as leases/search, and the existing optional per-user metric is separately default-off. Adding the preserved ipsec_leases collector would duplicate the accepted signal and add a redundant firewall API call, so no source change was made. Verification: just test IPsecCollector_Update_Pools and just test FetchIPsecPools passed; just gen was clean; just check passed including 427 Grafana tests, 1,220 Prometheus targets, 80 manifests and no called vulnerabilities. CodeRabbit was skipped because this is tracker-only reconciliation with no source diff.
Final Summary
Closed as already satisfied by the existing IPsec pool metrics: online/offline lease counts are exported per bounded pool and network labels from the shared list_leases.py payload, with per-user identity excluded from the always-on series. Avoided a duplicate collector and extra API call. Focused pool/client tests, just gen and the full just check gate passed; no code review was required for the tracker-only change.