// ✅ 推荐
var (
    httpRequestsTotal = prometheus.NewCounterVec(
        prometheus.CounterOpts{
            Namespace: "myapp",
            Subsystem: "http",
            Name:      "requests_total",
            Help:      "Total HTTP requests",
        },
        []string{"method", "path", "status"},
    )
    httpRequestDuration = prometheus.NewHistogramVec(
        prometheus.HistogramOpts{
            Namespace: "myapp",
            Subsystem: "http",
            Name:      "request_duration_seconds",
            Help:      "HTTP request duration",
            Buckets:   prometheus.DefBuckets,
        },
        []string{"method", "path"},
    )
)

// ❌ 不推荐
var (
    reqCount = prometheus.NewCounter(
        prometheus.CounterOpts{
            Name: "req_count",  // 缺少 namespace/subsystem
            Help: "Request count",
        },
    )
)

// ❌ 绝对不要用这些作为标签
user_id          // 百万级用户
request_id       // 每请求唯一
trace_id         // 链路追踪 ID
session_id       // 会话 ID
ip_address       // IP 地址
timestamp        // 时间戳
error_message    // 错误信息（文本）
url_full         // 完整 URL（无限组合）

// ✅ 推荐的标签设计
var httpRequests = prometheus.NewCounterVec(
    prometheus.CounterOpts{Name: "http_requests_total"},
    []string{
        "method",     // GET/POST/PUT/DELETE (4)
        "path",       // /api/users, /api/orders (有限)
        "status",     // 200/201/400/404/500 (有限)
        "handler",    // handler 函数名 (有限)
    },
)

// ❌ 危险的标签设计
var httpRequests = prometheus.NewCounterVec(
    prometheus.CounterOpts{Name: "http_requests_total"},
    []string{
        "method",
        "url",        // 完整 URL，可能无限组合！
        "user_id",    // 用户 ID，百万级！
        "ip",         // IP 地址，百万级！
    },
)

// 电商系统指标标签设计
var orderMetrics = prometheus.NewCounterVec(
    prometheus.CounterOpts{Name: "orders_created_total"},
    []string{
        "channel",        // web/app/miniapp (3)
        "payment_method", // alipay/wechat/card (3)
        "region",         // cn-east/cn-south/cn-north (3-5)
        "order_type",     // normal/refund (2)
        // 总组合数: 3 × 3 × 3 × 2 = 54 (安全)
    },
)

# ✅ 好的告警规则
- alert: HighErrorRate
  expr: |
    sum by(job) (rate(http_requests_total{status=~"5.."}[5m]))
    / sum by(job) (rate(http_requests_total[5m]))
    > 0.05
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: "{{ $labels.job }} 错误率 {{ $value | humanizePercentage }}"

# ❌ 不好的告警规则
- alert: HighErrorRate
  expr: http_requests_total{status="500"} > 100  # 绝对值没有意义
  for: 0s  # 没有 for，容易误报

# 1. 使用 for 过滤瞬态告警
for: 5m

# 2. 使用抑制规则
inhibit_rules:
  - source_match:
      severity: critical
    target_match:
      severity: warning
    equal: [alertname, instance]

# 3. 使用分组合并
route:
  group_by: [alertname, cluster]
  group_wait: 30s
  group_interval: 5m

# 启用 TLS 和 Basic Auth
# web.yml
tls_server_config:
  cert_file: /etc/prometheus/tls/server.crt
  key_file: /etc/prometheus/tls/server.key
basic_auth_users:
  admin: $2y$10$hash

# 限制网络访问
--web.listen-address=127.0.0.1:9090

# ❌ 不要在配置中硬编码密码
basic_auth:
  username: admin
  password: secret123

# ✅ 使用密码文件
basic_auth:
  username: admin
  password_file: /etc/prometheus/auth/password

# ✅ 使用环境变量
basic_auth:
  username: ${PROM_USER}
  password: ${PROM_PASSWORD}