diff --git a/.github/workflows/ansible.yml b/.github/workflows/ansible.yml
deleted file mode 100644
index e536962c..00000000
--- a/.github/workflows/ansible.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Check ansible yaml files format
-
-on:
-  pull_request:
-    paths:
-      - 'ansible/**'
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - closed
-
-jobs:
-  format-check:
-    name: Check format
-    runs-on: ubuntu-latest
-    container: ghcr.io/google/yamlfmt:latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check yaml format
-        working-directory: ansible
-        run: yamlfmt -lint
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11c64e21..695b8fe1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,8 +2,6 @@ name: Continuous integration
 
 on:
   pull_request:
-    paths-ignore:
-      - 'ansible/**'
     types:
       - opened
       - reopened
@@ -84,3 +82,27 @@ jobs:
       - name: Run Go tests
         working-directory: migrations
         run: go test -v ./...
+    
+  ansible-format:
+    name: Check yaml formatting of ansible files
+    runs-on: ubuntu-latest
+    container: ghcr.io/google/yamlfmt:latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check yaml format
+        working-directory: ansible
+        run: yamlfmt -lint
+
+  ansible-lint:
+    name: Lint ansible files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint@main
+        with:
+          setup_python: "true"
+          working_directory: "ansible"
+          requirements_file: "requirements.yml"
diff --git a/Cargo.lock b/Cargo.lock
index afebce98..e6bc203e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,6 +17,18 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy 0.7.35",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -92,6 +104,31 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c2b7ddaa2c56a367ad27a094ad8ef4faacf8a617c2575acb2ba88949df999ca"
+dependencies = [
+ "aws-lc-sys",
+ "paste",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54ac4f13dad353b209b34cbec082338202cbc01c8f00336b55c750c13ac91f8f"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "paste",
+]
+
 [[package]]
 name = "axum"
 version = "0.5.17"
@@ -243,6 +280,29 @@ dependencies = [
  "tokio-postgres",
 ]
 
+[[package]]
+name = "bindgen"
+version = "0.69.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
+dependencies = [
+ "bitflags 2.8.0",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.12.1",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "prettyplease 0.2.29",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 2.0.98",
+ "which",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -308,9 +368,20 @@ version = "1.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "755717a7de9ec452bf7f3f1a3099085deabd7f2962b861dae91ecd7a365903d2"
 dependencies = [
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
@@ -341,6 +412,17 @@ dependencies = [
  "chrono",
 ]
 
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
 [[package]]
 name = "cmake"
 version = "0.1.53"
@@ -360,6 +442,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -483,6 +575,12 @@ dependencies = [
  "syn 2.0.98",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "dyn-stack"
 version = "0.13.0"
@@ -655,6 +753,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0d2fde1f7b3d48b8395d5f2de76c18a528bd6a9cdde438df747bfcba3e05d6f"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -679,6 +783,12 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -932,6 +1042,12 @@ version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
+[[package]]
+name = "glob"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+
 [[package]]
 name = "h2"
 version = "0.3.26"
@@ -1008,6 +1124,9 @@ name = "hashbrown"
 version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+dependencies = [
+ "foldhash",
+]
 
 [[package]]
 name = "heapless"
@@ -1179,6 +1298,7 @@ dependencies = [
  "hyper 1.6.0",
  "hyper-util",
  "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
@@ -1429,12 +1549,30 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
 
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.77"
@@ -1493,6 +1631,8 @@ dependencies = [
  "csv",
  "futures",
  "kafka",
+ "metrics",
+ "metrics-exporter-prometheus",
  "quick-xml",
  "regex",
  "rove",
@@ -1503,6 +1643,8 @@ dependencies = [
  "tokio-postgres",
  "tokio-util",
  "toml",
+ "tracing",
+ "tracing-subscriber",
  "util",
 ]
 
@@ -1534,12 +1676,28 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
 [[package]]
 name = "libc"
 version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
+[[package]]
+name = "libloading"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
+dependencies = [
+ "cfg-if",
+ "windows-targets",
+]
+
 [[package]]
 name = "libm"
 version = "0.2.11"
@@ -1602,12 +1760,65 @@ version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
+[[package]]
+name = "metrics"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a7deb012b3b2767169ff203fadb4c6b0b82b947512e5eb9e0b78c2e186ad9e3"
+dependencies = [
+ "ahash",
+ "portable-atomic",
+]
+
+[[package]]
+name = "metrics-exporter-prometheus"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd7399781913e5393588a8d8c6a2867bf85fb38eaf2502fdce465aad2dc6f034"
+dependencies = [
+ "base64 0.22.1",
+ "http-body-util",
+ "hyper 1.6.0",
+ "hyper-rustls",
+ "hyper-util",
+ "indexmap 2.7.1",
+ "ipnet",
+ "metrics",
+ "metrics-util",
+ "quanta",
+ "thiserror 1.0.69",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "metrics-util"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbd4884b1dd24f7d6628274a2f5ae22465c337c5ba065ec9b6edccddf8acc673"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "hashbrown 0.15.2",
+ "metrics",
+ "quanta",
+ "rand 0.8.5",
+ "rand_xoshiro",
+ "sketches-ddsketch",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.3"
@@ -1646,11 +1857,21 @@ dependencies = [
  "openssl-probe",
  "openssl-sys",
  "schannel",
- "security-framework",
+ "security-framework 2.11.1",
  "security-framework-sys",
  "tempfile",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "npyz"
 version = "0.8.3"
@@ -1662,6 +1883,16 @@ dependencies = [
  "py_literal",
 ]
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -1725,9 +1956,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.2"
+version = "1.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
 
 [[package]]
 name = "openssl"
@@ -1773,6 +2004,12 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.3"
@@ -1919,6 +2156,12 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
 
+[[package]]
+name = "portable-atomic"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+
 [[package]]
 name = "postgres-derive"
 version = "0.4.6"
@@ -1981,6 +2224,16 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "prettyplease"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6924ced06e1f7dfe3fa48d57b9f74f55d8915f5036121bef647ef4b204895fac"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.98",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.93"
@@ -2010,7 +2263,7 @@ dependencies = [
  "cfg-if",
  "cmake",
  "heck 0.4.1",
- "itertools",
+ "itertools 0.10.5",
  "lazy_static",
  "log",
  "multimap",
@@ -2029,7 +2282,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b670f45da57fb8542ebdbb6105a925fe571b67f9e7ed9f47a06a84e72b4e7cc"
 dependencies = [
  "anyhow",
- "itertools",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 1.0.109",
@@ -2072,6 +2325,21 @@ dependencies = [
  "pest_derive",
 ]
 
+[[package]]
+name = "quanta"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bd1fe6824cea6538803de3ff1bc0cf3949024db3d43c9643024bfb33a807c0e"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "web-sys",
+ "winapi",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.35.0"
@@ -2110,7 +2378,7 @@ checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.0",
- "zerocopy 0.8.16",
+ "zerocopy 0.8.17",
 ]
 
 [[package]]
@@ -2149,7 +2417,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b08f3c9802962f7e1b25113931d94f43ed9725bebc59db9d0c3e9a23b67e15ff"
 dependencies = [
  "getrandom 0.3.1",
- "zerocopy 0.8.16",
+ "zerocopy 0.8.17",
 ]
 
 [[package]]
@@ -2162,6 +2430,15 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "rand_xoshiro"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f97cdb2a36ed4183de61b2f824cc45c9f1037f28afe0a322e9fff4c108b5aaa"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "raw-cpuid"
 version = "11.3.0"
@@ -2355,6 +2632,12 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
 [[package]]
 name = "rustix"
 version = "0.38.44"
@@ -2374,6 +2657,7 @@ version = "0.23.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fb9263ab4eb695e42321db096e3b8fbd715a59b154d5c88d82db2175b681ba7"
 dependencies = [
+ "aws-lc-rs",
  "once_cell",
  "rustls-pki-types",
  "rustls-webpki",
@@ -2381,6 +2665,18 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 3.2.0",
+]
+
 [[package]]
 name = "rustls-pemfile"
 version = "2.2.0"
@@ -2402,6 +2698,7 @@ version = "0.102.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
 dependencies = [
+ "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -2450,7 +2747,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
  "bitflags 2.8.0",
- "core-foundation",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316"
+dependencies = [
+ "bitflags 2.8.0",
+ "core-foundation 0.10.0",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
@@ -2546,6 +2856,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -2567,6 +2886,12 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
 
+[[package]]
+name = "sketches-ddsketch"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1e9a774a6c28142ac54bb25d25562e6bcf957493a184f15ad4eebccb23e410a"
+
 [[package]]
 name = "slab"
 version = "0.4.9"
@@ -2702,7 +3027,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
 dependencies = [
  "bitflags 2.8.0",
- "core-foundation",
+ "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
 
@@ -2770,6 +3095,16 @@ dependencies = [
  "syn 2.0.98",
 ]
 
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.7.6"
@@ -2978,7 +3313,7 @@ version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9263bf4c9bfaae7317c1c2faf7f18491d2fe476f70c414b73bf5d445b00ffa1"
 dependencies = [
- "prettyplease",
+ "prettyplease 0.1.25",
  "proc-macro2",
  "prost-build",
  "quote",
@@ -3082,6 +3417,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
 dependencies = [
  "once_cell",
+ "valuable",
 ]
 
 [[package]]
@@ -3094,6 +3430,31 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+dependencies = [
+ "nu-ansi-term",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing-core",
+ "tracing-log",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -3193,6 +3554,12 @@ dependencies = [
  "tokio-util",
 ]
 
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -3349,6 +3716,22 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.9"
@@ -3358,6 +3741,12 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.52.0"
@@ -3545,11 +3934,11 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.16"
+version = "0.8.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b8c07a70861ce02bad1607b5753ecb2501f67847b9f9ada7c160fff0ec6300c"
+checksum = "aa91407dacce3a68c56de03abe2760159582b846c6a4acd2f456618087f12713"
 dependencies = [
- "zerocopy-derive 0.8.16",
+ "zerocopy-derive 0.8.17",
 ]
 
 [[package]]
@@ -3565,9 +3954,9 @@ dependencies = [
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.16"
+version = "0.8.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5226bc9a9a9836e7428936cde76bb6b22feea1a8bfdbc0d241136e4d13417e25"
+checksum = "06718a168365cad3d5ff0bb133aad346959a2074bd4a85c121255a11304a8626"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index c89b98d4..1204a3d2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,6 +23,8 @@ chronoutil = "0.2.7"
 csv = "1.3.1"
 futures = "0.3.28"
 kafka = "0.10.0"
+metrics = "0.24.1"
+metrics-exporter-prometheus = "0.16.2"
 postgres-types = { version = "0.2.8", features = ["derive", "with-chrono-0_4"] }
 quick-xml = { version = "0.35.0", features = [ "serialize", "overlapped-lists" ] }
 rand = "0.8.5"
@@ -35,3 +37,5 @@ tokio = { version = "1.43.0", features = ["rt-multi-thread", "macros", "signal"]
 tokio-postgres = { version = "0.7.12", features = ["with-chrono-0_4"] }
 tokio-util = { version = "0.7.13", features = ["rt"] }
 toml = "0.8.19"
+tracing = "0.1.41"
+tracing-subscriber = "0.3.19"
diff --git a/ansible/configure.yml b/ansible/configure.yml
index 55098709..3f8c940e 100644
--- a/ansible/configure.yml
+++ b/ansible/configure.yml
@@ -15,10 +15,23 @@
   # that always points to the primary
   vars:
     primary: lard-a # or provide via cmd '-e primary=...'
-
   roles:
     - role: pg
       vars:
         pg_version: 17
         pg_primary_ip: "{{ hostvars[primary].ansible_host }}"
         pg_mount_point: "{{ ostack_mount_point }}"
+        pg_is_replica: false
+
+- name: Set up node and postgres exporters
+  hosts: servers
+  remote_user: ubuntu
+  gather_facts: true
+  tags: exporters
+  roles:
+    - role: prometheus.prometheus.node_exporter
+      node_exporter_web_listen_address: "0.0.0.0:9001"
+    - role: prometheus.prometheus.postgres_exporter
+      postgres_exporter_name: "postgresql://lard_user:{{ pg_lard_password }}@localhost/lard"
+      postgres_exporter_web_listen_address: "0.0.0.0:9002"
+      postgres_exporter_enabled_collectors: ["stat_statements"]
diff --git a/ansible/group_vars/servers/main.yml b/ansible/group_vars/all/main.yml
similarity index 100%
rename from ansible/group_vars/servers/main.yml
rename to ansible/group_vars/all/main.yml
diff --git a/ansible/group_vars/all/vault/network.yml b/ansible/group_vars/all/vault/network.yml
new file mode 100644
index 00000000..0193d00e
--- /dev/null
+++ b/ansible/group_vars/all/vault/network.yml
@@ -0,0 +1,187 @@
+$ANSIBLE_VAULT;1.1;AES256
+35333133653165623464346230623164633934663135623636626233396338656231633137386434
+3039393637643535646338386335376262343232623430660a333334396338353565363131653736
+36616139323066316437393065633062313961643430613935316139393365396432393265303338
+3136323861353365370a633930393635613232323863326531326137386265343865616561343539
+63326532313732323236396536353539663466333639623461356637393262376261316565336139
+32636431386538383163633538373936336635653263313066613836396434313363393931333162
+33336561653865343361613264646630386334666264663339643636303163316536383134633966
+31303166356537633966323961303035313038373231653666303531323035666437383536656230
+62663033373366383534306337386265663464393136313739366264363731666434323238303433
+38333332656166363335333662343339393237393630633633376435623231643837376533626361
+35333564316361623163653366353334366464343230643937666338316534643639306565383135
+30646631666165333466623530326131323337353634616331653861666664666134636333366665
+31383237626337363165656332373236346263343938306634343066656564373233666632303236
+64373564373031643537643264613338363033363634666434336662323565623037303064633636
+35626165623131326266333038303361313338353330333533633339363533333231646264313462
+66393033376465383066346636323435643732623832623937653732343937613063636432636633
+62323936313035346561656363636536383965333661363062653962386534326465333830626336
+36613939353632393364623237643263303262326164313565333331343266616163633762616433
+65366136333662343036346630313862376564366436316237643930616638663231366263333861
+32323830626463303134636635336165633638643537653936396532383761653737353861383537
+65636564363534323565646136646137323836316531393962383233656564613932383865626231
+37396566386261373032656461636637646531386665393230313032393438646461613036643864
+35373166666634356431356438303464346532393936633435303564343035636162333638623738
+31353739333566393531323939373932326639366261633834343361623064343634376666303966
+34326464343763393233393530653561373761383366323939333537316639313866626261633238
+30666630653535336537323266366166333239303764613666613737373138633463306535313630
+63333538343964393930616261376339313431306166306365333238643535323065376661626338
+36643165666237636237386663386339346666396164313837653633326233663233343437363161
+38303230643836326261316638303232393962356263643361383465626661613835346230303331
+39363365656237626337326464323163656537336361366130363332323063386162376133366337
+31313163386233653631363230663534656339396330376239363063333732643062376133633834
+35633930333932633662383261376337633839356662363739366462633763383832343031616637
+32343763383663326133356432363661323730613063313034336633373962323032663737373930
+30613532386262616134393431633836333932653262343939363035316231623462613635323030
+35613735313437623136643132646134633737366332373830366535386539663038346262663363
+66643066643865643266326233353262613265383765623238623139316235363930616236653539
+64366630343861623139653164353062346433303232386664326133616366616131663162386631
+31653538616432633738613165373736613936653530323562353538366463373366313761636132
+30383331666430326361626130646164626265393633333737346631656261623333303532343565
+32306634343134363135653031376438613230316632383437396133303539386436633863333762
+64666165363662653633663434343863363233626133656135346564653930373234343062316639
+30643361626339393430626665373137623733376434363139366139663439373864343333346230
+32656636336230313263383664353264313938616335653661643663626536343237663662316636
+34613634353238613932363261336130336636393061616234616230373962343439656166356430
+62396334633538346632666166356261626233336138663430663036646634623631646536623563
+64396165366161656563393639346636393163333964336633646363623862633231303135613034
+31663662383931366164653466373466636137346461343239626130623330663338633263386430
+64303538343432623031393532656637333564646665343636326534353239383936363335346137
+34653533353635656334643335353632633962353333636361613466393162373336643966386361
+39383863323862656435616537343437393336373266383164333065636238303862356165636632
+61326639383330396434326235613663623766396366383163656636393464323734616466323234
+62353036373730386336626434326366336433333239323538323531306235613539656664396464
+33303435656464366334306536336631316566346561646234633931623835326364353861643734
+39643337636661353430353739643461353231613539393736643133613137376665363232653735
+33303936396636663364363965333938613864306136636261633062326135633531373262643939
+61383435623239646539356632616631353063363039613261623436653738313562303034383038
+31323832363434656562303062356462323433306234613737326564636464396665343333656239
+33343263656664613636323166383364353332643730643934653333356535666531663163373363
+37323061353662353235386435613164363263356438363866336238633635346432613662333764
+39366265353136353839666538306465656437353233643066633761393134313062383662356436
+31613066356366363066383864306363633262626133356634393063323761633134366233346137
+32396131346463663632643936353061616638373863356136623332646365356334623739393739
+36393437663231323538633032306530626231383766376134316233383764633232643562666461
+31656263306638613766346164613338346131376165666535323063643837383865626539623535
+35353361626335626134633662666539653830373035393239396466396233366130356335386433
+37663664393834316334336537646233373736626337646636633361316662333630656339353632
+63393332356232343466633534633266313434616366643962396336326136323538633836646362
+30346665366132643162373638333432356662636135303635343463653162316330343338353462
+64643961386166393161383863336331346131633966313564653965343836376161306130356536
+34616230663062353932656539353065343739623230653532326539396530353134323130613536
+31343664353365316666383332343739306162306337343962633039373735383934373530616666
+64636364343665373337313531303664366239313432313733373734353939363634323138626164
+65356438373130663363373532623430616461396237363261303237366463306163396661633738
+34313663303934656332613234363333643364323235623264373838323837373636303161613432
+38316664363065333766303235356632666636393132633236373738633165623464356162396239
+65633435623961323364346632333439346562333133396238383230313162373863653964363239
+32376162663466373738396530333266643435666231393832323735393362376139623265623464
+62346266323262303864326537633436393663323964616264643337636436336533653037386231
+63366233643561346635326133326336313031396538316136313436626532326439666239346464
+39313938363033353137633539353263393137626337363831353735313136366135366663323136
+33336539313334643034316137636466393436313931343664333962643061653534316532366437
+36326233376138336139393362333534396131666166396332336431626635623030366536386536
+33303739316237343063613434303964663465623834623731376163386361326239326364316431
+30316365356664303137396130306131313730616430386262316333663634396339613766353430
+39313531313330323365373730383438666130343535623662343739356361373861653764346635
+37663762336363613765363333303533643464393863343730333039366263313233386564666166
+36343436623334313633336566663831313535633866303934666661393636626232666432386231
+38343963656666363231636339383161303261383361623964376435303764343035306236663562
+37323739613161646236326437343033633666636534626231326132316663666131333463613065
+38306431623363396530313133373664626465623430633563643566633032666637396337633832
+35343263393031653937656562393131316162343865373538333939373661366339613963623966
+39656436366231306632646336323739366564356364363734373332353931353163373365663137
+64343964323230613936383531313731613633653766363030626130396530383965393133303635
+62663336656630613165336531386162373232303630336439626331623830623334666364353931
+61396635383234613931366131646638663830396533656333333939663461376235613036636361
+37383338613462633838313835653535343731653033313166633231333734643861343166303335
+34653866343530396338363763633739626265636338663634613337306536666635616531356663
+36303562303432323861363539333265633338663464363665353136653864313730623465393464
+32343466343930396363356136376437633130666337653465663063666163313633353265323135
+37663238323738313930356461373632323563363036353864653233366364336531326436303165
+35643963383462336266306637646265623237633764623963396661663132313037386664656262
+61646130366163343333383637363965643263373031353461303063343231326331633066626638
+30353833633661653164323639313961663133626162363539636461373031373839386437373364
+63386565633334323766356237383764396239643230396339333061656232396666343663303933
+61396136393732653461663531346439363039363939303332366133633734363136623136386166
+37633764656265643431343563343032616661666332356264623139343039623036373562333632
+34313161633664646362383165313932643936303837663734613037316133316364313330373035
+65303937323033323362653631393066373830613164316432393964636632616334393361656562
+37303534663565653862396566633261393564623439376364323830383066393662383365333332
+66663237323731633263383330346565636139353336353436363131373064633263343362336133
+65383963376636613465666666393631366531303635323236323464663863343434313539326434
+66303564333365383864336665363564656331336238383736666364326165396162366565316432
+61353632313766353237376237356464346339633963356136613663343364323665386333656135
+31323337336566393961343333383961303837393432623861616465633539363232303266626331
+64366562313461353639316638333536333963643662353133353334333733323663363934636364
+39636434373665353332633662393236363938626636333039356331643436373566316632313461
+37616661653238613065386264636434663032383737333463313331633436623237626133643461
+34333931656131663361633238336461366464653631373263383262323737643234353866396136
+34336230386137643030643732616464626530343863666463626438383566633433366439396538
+35663464633762623661336438616365386164393530303233306237313933613834643463363339
+32616139646232306664313031306137313331393263656561346263346335323364386533383935
+32653264633364313662353138323863643936383166626635363866663665633761336434393032
+38363639636466393862316365313732663663656261666566626135666134343739393035666634
+62313765333537316533666664646132613861643863346461336563366337343637303133373635
+64316638636339356566663136393962373961663435616334326437643864386231663462643034
+33663936386365386466383762376265633163383563616466613130373564663338666138656132
+30383533383437353866333837623134643635343562346462313765383966373936313832383936
+61626233356632366466663531373462313965353631373136313732313039396130363333646564
+33643637366333343861383535626361303866323965366633616636373235383132306338386163
+65636562313934656132653935383335346236373839373763663430346331626362643430636132
+39366265323366396364663935643331366462643035356563306636376335633866653439336464
+33396362653065346365613936333266353739346666643031646537363239343037623462313064
+63356538663061383863616334656462636436373361396433663435383833383764323739326439
+30326261656131626334646336376631633032653662373032383837373233333336393038376230
+32653839333337653731313966353337653262313137653635626337666563363739303433613465
+30626565353239373232346562303132626337343661633030303336333464306538346261313465
+38356639386431303337303331366566643731363661663539303162346236396566616634643864
+66653964653734313064323232346335643333323330353533333330666661383935333834386135
+39663262653534306131336265386638383234356365373535343863393762636532363935323465
+64353465343061626664623932633833313035386263646461386232636435636136333733353066
+66323363376235376662356537656539363535633930373433623737396631613139336634383463
+36316538663665306263646166623362376230653937323865653962333338323331633133616635
+38616663636630623934303534343264316463353665333935383965613537313638643166666537
+65646662323831336531636630643263363837306132616464343030343562656234336266313664
+37323864393839643763323434623536626362343234336134636266326536303966623963633233
+37643235343261313332346638356233626339356534366564663238353964616337656261383864
+32653331383962393063616562376339643332616261326232663736346335386639333037303063
+62323331383431303333383261376564323930343761613263376632303635663665643066626137
+31356264363961396538396430666238643632326239383966356638313135623737663063333864
+65383264393733356364396563383530343733303066323737633233373238373964313863383431
+38323230373964363766643531313064663233323035313036656232353862336565323939396364
+62313932346132396538336432316161326264373433366563303934363938653364343661336534
+39333231353538623465373938353431393762333939633963613138613033616636313931323337
+39393562653465333036343631373937616538663533313539646664386362666639303134383438
+65643738363737323732333964383839313130313932613732666638643232663935653836633535
+35393061373431613930633861396565393434353532393066353832323933663163383039623937
+31656233626335363362336335323864663832353166653737396432656362313735643937386531
+32646461346131646635656139643866383862343165373161356463333839656165376230316361
+64356461643962333831373534646632396264646661353536653339323666613136616663316366
+66393639343038363239643038316364643134363737636638626666326361643535393333666635
+65613738356365653636656137656462623865346461353037663566353133386162356365303230
+63613161383061626433656262316462316465323365616165316666623538333938333630306134
+64656435653861663532396531626138653964346438313564323934333130356631383864353461
+64373265316262393561663334386564393031333765386534626236326264333138303466653332
+30326561306634336634313962353030313762643437333737316137396336306234393565386561
+38356166333561333830386330383336626565666138373461313962653039613533316434613033
+66643931386435646433376639356639316465373230343764386636323731303932316332303564
+62323634663339373334313836346334396336306366656464613930393539343530623030383362
+64323030303031663034393839363231636339333664323537616164303438323361613036373132
+31383765613231383266663964633830636165646536323263643531303963363639306533336433
+61366332336364343866386634306239343166393639343563366533363334343065646433356336
+32613763353636653732343931633837613133356366653538396439633262343437366665363363
+63643235393937633836313764623337323630313133663131333064343064393338383238383636
+30636631376531343334613362336464386535336462656239666562376664363764613134663065
+62636431396364326462393463623233373463626465396166326336356535626636323936383135
+39366534626166616130643864306235343434383265316365623031303636623663373630653130
+31613864636538383161623162336534373233633366613938363638613430626666626531643230
+33656438613930626337343131363766316438633964323538313763323432303030356166666331
+39393465623230316631323338373332633432646430636235303733643763343232383936646535
+66386531373064643931333433353361313664376262366430343536346462623436363831306332
+32623938353631653434623565373464393431363963383038313739336439336433633166376564
+31626535306365303535626461656436333035663362386539366236373337303735353733646636
+33353064663538653861306465633439393666346431363264653938653665303762346637363538
+37663035623639343964646565646633656232313862656661613063396635633033316566396630
+36376561333130653965356332313865396332353839653765396637623766323965343738666238
+6330383065393634616164326166363435333835623437396162
diff --git a/ansible/group_vars/servers/vault/postgres.yml b/ansible/group_vars/all/vault/postgres.yml
similarity index 100%
rename from ansible/group_vars/servers/vault/postgres.yml
rename to ansible/group_vars/all/vault/postgres.yml
diff --git a/ansible/group_vars/servers/vault/ssh.yml b/ansible/group_vars/all/vault/ssh.yml
similarity index 100%
rename from ansible/group_vars/servers/vault/ssh.yml
rename to ansible/group_vars/all/vault/ssh.yml
diff --git a/ansible/group_vars/all/vault/vm.yml b/ansible/group_vars/all/vault/vm.yml
new file mode 100644
index 00000000..85316557
--- /dev/null
+++ b/ansible/group_vars/all/vault/vm.yml
@@ -0,0 +1,21 @@
+$ANSIBLE_VAULT;1.1;AES256
+66343937386562613266353962626638613461623238393138383664623637313663373362373235
+3565303531396262383638633031373933623034623033620a643536616332386432333639636162
+30663236363838663665646666386533643539333164333430303334626565643637643032393833
+3636643636393932650a613239666233663834373363336530396666366635633537306434373165
+65356138343565653239663430383137316430396632373433323265663365303234313238386135
+36613339393235613662386465653766633465313666623434613230353331346162643264333938
+61616632623931343333306638663464663035343766663966643534643964326137396533633532
+39326430653565623133633135633065303365326534316638383434353261303930316333663263
+31643463666335353261613361373432656633643265313438346437656634363038373432643130
+33376361393466646137356439386563626230313739626338616565656164616135316137366362
+66353332313633316333626463626532313162613063356166646232343537383566393131393931
+38396162316633313333346338613165653530333739313264366637313064613766383831333238
+63333862613333363831363730316230336531633030333535616165373137306233323862353039
+34353032303063663135656331323330376566643837656434326337623266633266353935613162
+35366238613830376139303361663432303334333264313961663533643136336464346531303762
+30613162353638656534663830636635626637646464313864643832313031353033366139646134
+34376636613863616235633466396130393739616532663464643133353731346533626166323562
+33313762616239383737653765316132303630323964643761653961383531363864353535633131
+32373464363562656336643566336639313261383432626630663930623639393136656630306662
+36643463316261306136
diff --git a/ansible/group_vars/servers/vault/network.yml b/ansible/group_vars/servers/vault/network.yml
deleted file mode 100644
index 8eb73604..00000000
--- a/ansible/group_vars/servers/vault/network.yml
+++ /dev/null
@@ -1,102 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-32366166643830646532373861376535653835613537373237313133383636333639613438643536
-6634313563366538363235666666646235633831353734620a343437623466663131646633646661
-38343432303865386138616330306234656437623966383533343930663437333732393736376635
-3164646665656333310a646231616666653034363432656438356135396339353266626666383838
-61333639386435306330323034336339623536326431373731366332643135346362663538353035
-36393264636232646431373966353131316439633562663439326264343631306561363564623432
-64323134383362616631353166653065363861626132313033323663333763393039336363386431
-66373162396133376335653963623234373764363038343165386362383963346137333430383936
-65383135303864666561396338393763653637393561653764343735626330373539323232323531
-37663162643838383836316161616532613062373437346338303431363963646332643632346265
-38393165643137343733303031333333336230656165646234306639663836326531316235666538
-61643066383666613434353966306337336335663830653836393539323563656438613935343035
-36623739306239343864363833356263336330303037393533643165633561323738326137366339
-39616330623738343430643561623032313038376639303065383032623739633662623232643931
-39373934623132663662633163646165666264376632346432353935666533323564323466633764
-31616535393630643138616433656139306463613866336231376630353135306431343764313364
-64346361633736393236393363366238306366666565653962393962633462613764333530356666
-34343831376437623431343865353666613337386532393937353933666234356162356461653564
-61396236373136303265633639633331313765616565653235656262363832336335653666346436
-63366638613334336235666663616437613537626436303735303139333534643632333438626565
-61326462326134376664663439333561396332333036346330363935333631353562373839336233
-30303438623732366338393636656330306135613363383236383635396137386664353733303165
-31643132313633613363313566633463626462336464663161643331653735353063633136663338
-64333936333062633965333731636336323961313263363439383034633036666239626363393466
-37313861653031393938636234636561626661323161633563633035323664336431313936643839
-37363233653731383163366138613938333537373936623138363463643136363735373965653966
-65626139376139383663396663626630363537613238316439633931343631393265656130376634
-38643262333039353633343463373465656433376561336263343862613630666464653037313266
-63383739653437376162383831666235353533316663633534373633346264356139633332356630
-62643631646563663136396636306432363162666630303965316432303263633361613030613863
-34343163623162663339346163363536333563613931663664373132393761346637333737326439
-62633566636332636639353137393132623265336638336537346564373837666339316563303836
-37656164343230323664323735633937303264343135303936376362633463396261313236303534
-66663331333762363133663662333637653238356537376434636333666636386164656536366563
-64636437616531316366303330623635663233346632313239363538363966333230353666393762
-30316262373837653331633034363863323364626632366335663663393838643037376333643039
-65386434323862653939373162646537653061313362353466306535656631336633313435633732
-30636137613261666633323631613933633834616464373731646566626233343266343264626163
-64393435306637653563646437666365626339636130373862666364336231633536363938623830
-36393538323565636533663537633761353464373730653936313164626234303637303362663165
-66363935333364646662373164396163633334363137356162376134363932363936333062326436
-38333766383035616439396231313334373437653530396639303936393439653736613736386133
-62623032636666316465303937616131313662363734303530316233333862393231616662353431
-39373137366439343230373930396261663162366630393063303265313965333536623333313433
-38303563336632333133393039333739656337653132656563623932383263636264623466646165
-61386537336237653539313938646335313139306239366636653534343561373363623061323530
-65323638396665626433663932623364316465383734343235666132303531346632323731376530
-37356663623564646661653030393763326162666338336161663066646233363637653437656437
-66313063356535323266613666616565636337663264663738626235663337376435316535343466
-63616538663832386365303266386537653731663262323834333338383938643834623065653934
-32623131393138633362623163643861336265396563613639653336613833386437393139636461
-38316236373733633336343561653335346164373834653436393337366139343437363439306363
-61373837376237666336363732646564643539666233663037343239636562333136646239356637
-64323135346162393930373635326335343336346161356361336365666666613234313535343562
-66653337306139613633376630373836363730313866373637633834613565366664343064386435
-38323262396638346337323932363537323364353134303436393734333631646630633238306532
-63626365343264323737316634353365393331643264393339653266366532393039663338353735
-30326431343964646135333033303661373037356463353832313263323533373762363635656361
-65303533616330663732643730323961623066316665323239316237663462333232396463386536
-32393262333333326338623934633261383237376462303665343363346437366564633563643861
-36313836386438333435613561616463363063393164383963646163343162313563393238623634
-37366336376135666232323735363934376637653939633938643838333366363962373434316135
-39666663353438303238356333646136346564663966623563663963306635343837356462366164
-62393739333836326265626138373238633032343938313232303732613063373762346136313533
-64373965306430323730346535383530663032386231653734633265653332373338306232346537
-31346531643335623037363730353437663035363636373831623663646664333963353130343164
-62663036393532613835666262373266376437623761336332373562393737306430383561383937
-30353936363830323231336235393264313434396163653631383434653763626162666238643635
-30613865346336386136313461366230666332383630646466333130616437356461363862643463
-65613866663932396432653863366462373032616461353966623763616566643732396137393137
-32333461656665303538643737613231626532393036363932333764653234666633363364663233
-36653935626366346236623561613233343464613138643266326536626561323261626330326536
-33623835656266343236623838343331643635633962323762633761333038313861323133323563
-62343732653265383262323832393037316365316234653064613862393161633238336637326563
-31373930323836666166306532663265616637326137333661333436663961633338313336393631
-61376539333839663538623631333962373264386338393230356638323363313131316530663937
-34346239356438393936303334366232313663633630656130633333313032346134333838323937
-38396634336532616639396465353635343836323863373561366138376131326630623562623631
-31616463633562373464626535626237633366626137663539383939633261313435623666643036
-37633339383933626361633932343234643165326363646566636338393635366439353465313462
-30346530653836363536336339313234303836393962316535633832623763306362366633363435
-63306230373234353432336163386534383033316331653962643438346165663033383565633030
-66313466393830616264643633346130633161356635656466373734393537323063353931386132
-61336333616137373539366261323162303766346534643332356163303861613633646535353534
-38383061633066656536613735346631626439353336316333653931303663626538383564313062
-38373263623064666161303365343962633734643965346336313363623761663362363861373662
-65376161613763663337343437353936343135353439396164353530336265326530383232346634
-65653235333934396662333962393165393936626363623136373363343430383561346633653437
-31366538656465353261373931306664316361646334393833356465313031663334363465363665
-33636563316365636437396137326262363263386162346161316135353332346430303165383066
-38343033396136663733653339643334316536356635306434343261383734633535316431326261
-38626238613331333138383739376465303738626430326635633431333539333636646535643739
-37363037623335323862303462313636396536393934376662396634636331663566336262326666
-36633137386138336532626633346535396130326236653565653939353064636566306139313432
-37363461616562363039653234653762643532666138376366373066363164633064643936336435
-36363032346332386463653162656362623863306561393263303663313164626363393337623731
-33653836393964396132373433366666373531383132396464353762353061666532353865663038
-34393362653838613738313163616561326235386331373335346230303935343661373438666162
-66653133643961303361366266666663373366396364623234383730303933636635623034313266
-39373566336364306337653930303938623938396334643239646666306630373463626661313736
-63323634626565333062373539396162343637363734663335396534363766303061
diff --git a/ansible/group_vars/servers/vault/vm.yml b/ansible/group_vars/servers/vault/vm.yml
deleted file mode 100644
index dcc3e165..00000000
--- a/ansible/group_vars/servers/vault/vm.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-37646661373966386233333166336137653636653633623830383130376539383364643565356664
-3564353130326265343537666663343639663534396230660a626232373765333335363263626637
-35386231653530613337333761626532336233663562346138386634666537353231376261663634
-6636363335666166370a333732363434393134643538313131303134333234366239666162393561
-34623961353136356363636164643839306361643061653930386237363366623032646132326564
-61653135323761343933643339313935323035373933616433383935323265623334353732656265
-63653034323562373433373033303834653834616338616565303036303663613435356637633439
-30323539666433363831366661356238366465653130343931313732373137303133613537616538
-30333336666235363565383966356632313739383961623735306261396463613534303935643766
-39356330646439613434393039336232343031393733363038613936633839663637363630336536
-64383464383365616564313834333062396433383333636132653235383433623130376339386537
-32623731313062343964636639663265333130616466326664346261336463653832373539663665
-62323238666661336136363239313336643639323039303765623634666637326431323161613337
-33353638613563666530633864326462313735333761333762653266656632303037356233363932
-37636439373664346536636438326435623737666631613738343365626566666665383262316435
-34383730643033306634313565346166663063376464313633643963306538313530303463366137
-63316339396464336564316663666461353661323630313438626430613436346335666138633438
-64623566353432386162636638623130346164613165636563376666656637303638306364396463
-373132656561326137666338366632336561
diff --git a/ansible/requirements.txt b/ansible/requirements.txt
index 50ecf4c7..01d791c7 100644
--- a/ansible/requirements.txt
+++ b/ansible/requirements.txt
@@ -1,7 +1,7 @@
 ansible-core~=2.17.4
 ansible-lint~=24.9.2
 netaddr~=0.7.19
-openstacksdk~=1.3.0
-python-openstackclient~=6.2.0
+openstacksdk~=4.3.0
+python-openstackclient~=7.2.1
 psycopg [binary]
 wheel
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
index 45323db2..78565274 100644
--- a/ansible/requirements.yml
+++ b/ansible/requirements.yml
@@ -5,3 +5,4 @@ collections:
   - community.general
   - community.postgresql
   - openstack.cloud
+  - prometheus.prometheus
diff --git a/ansible/roles/ostack/tasks/keypair.yml b/ansible/roles/ostack/tasks/keypair.yml
index b99c7aaa..8c1e8000 100644
--- a/ansible/roles/ostack/tasks/keypair.yml
+++ b/ansible/roles/ostack/tasks/keypair.yml
@@ -5,5 +5,5 @@
     region_name: "{{ ostack_region }}"
     name: "{{ ostack_key_name }}"
     public_key_file: "{{ ostack_key_file }}"
-    state: present
+    state: replace
   tags: addkey
diff --git a/ansible/roles/ostack/tasks/network/create_ipalias_network.yml b/ansible/roles/ostack/tasks/network/create_ipalias_network.yml
index df0250aa..344df5d1 100644
--- a/ansible/roles/ostack/tasks/network/create_ipalias_network.yml
+++ b/ansible/roles/ostack/tasks/network/create_ipalias_network.yml
@@ -16,7 +16,7 @@
     name: ipalias-subnet
     cidr: "{{ ostack_ipalias_network_cidr }}"
     state: present
-    dns_nameservers: "{{ ostack_networks_dns[ostack_region] }}"
+    dns_nameservers: "{{ ostack_network_dns[ostack_region] }}"
   run_once: true
 
 - name: Connect ipalias network to public network
@@ -36,7 +36,7 @@
     region_name: "{{ ostack_region }}"
     network_name: ipalias
     name: ipalias-subnet
-    cidr: "{{ network_ostack_network_cidr }}"
+    cidr: "{{ ostack_ipalias_network_cidr }}"
     no_gateway_ip: true
     state: present
   run_once: true
diff --git a/ansible/roles/ostack/tasks/network/create_project_network.yml b/ansible/roles/ostack/tasks/network/create_project_network.yml
index 62a97538..973a8a8a 100644
--- a/ansible/roles/ostack/tasks/network/create_project_network.yml
+++ b/ansible/roles/ostack/tasks/network/create_project_network.yml
@@ -15,7 +15,7 @@
     network_name: "{{ ostack_network_name }}"
     name: "{{ ostack_network_name }}-subnet"
     cidr: "{{ ostack_network_cidr }}"
-    dns_nameservers: "{{ networks_dns[ostack_region] }}"
+    dns_nameservers: "{{ ostack_network_dns[ostack_region] }}"
 
 - name: Connect private network to public network
   openstack.cloud.router:
diff --git a/ansible/roles/ostack/tasks/network/create_project_security_group.yml b/ansible/roles/ostack/tasks/network/create_project_security_group.yml
index 4fa115dd..05d21df5 100644
--- a/ansible/roles/ostack/tasks/network/create_project_security_group.yml
+++ b/ansible/roles/ostack/tasks/network/create_project_security_group.yml
@@ -3,19 +3,9 @@
   openstack.cloud.security_group:
     cloud: "{{ ostack_cloud }}"
     region_name: "{{ ostack_region }}"
-    name: "{{ item }}"
-    description: Created with Ansible
-  loop: '{{ ostack_network_security_groups | map(attribute="name") | list | unique }}'
-
-- name: Populate security groups
-  openstack.cloud.security_group_rule:
-    cloud: "{{ ostack_cloud }}"
-    region_name: "{{ ostack_region }}"
-    security_group: "{{ item.name }}"
-    protocol: tcp
-    port_range_max: "{{ item.rule.port }}"
-    port_range_min: "{{ item.rule.port }}"
-    remote_ip_prefix: "{{ item.rule.subnet }}"
+    name: "{{ item.name }}"
+    description: "{{ item.description }}"
+    security_group_rules: "{{ item.security_group_rules }}"
   loop: "{{ ostack_network_security_groups }}"
   loop_control:
-    label: "updating security group {{ item.name }} with rule {{ item.rule }}"
+    label: "Updating security group {{ item.name }}"
diff --git a/ansible/roles/pg/handlers/main.yml b/ansible/roles/pg/handlers/main.yml
new file mode 100644
index 00000000..b8ad7727
--- /dev/null
+++ b/ansible/roles/pg/handlers/main.yml
@@ -0,0 +1,15 @@
+---
+- name: Rsync postgres directory to ssd mount
+  ansible.posix.synchronize:
+    archive: true
+    src: /var/lib/postgresql
+    dest: "{{ pg_mount_point }}"
+  become: true
+  # synchronize runs by default on localhost
+  delegate_to: "{{ inventory_hostname }}"
+
+- name: Restart postgres service
+  ansible.builtin.systemd_service:
+    name: postgresql
+    state: restarted
+  become: true
diff --git a/ansible/roles/pg/tasks/configure/create_primary.yml b/ansible/roles/pg/tasks/configure/create_primary.yml
index 4aa7e4e9..079cf97e 100644
--- a/ansible/roles/pg/tasks/configure/create_primary.yml
+++ b/ansible/roles/pg/tasks/configure/create_primary.yml
@@ -71,6 +71,7 @@
         value: replica
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     - name: Set hot_standby parameter
       community.postgresql.postgresql_set:
@@ -78,6 +79,7 @@
         value: true
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     - name: Set hot_standby_feedback parameter
       community.postgresql.postgresql_set:
@@ -85,6 +87,7 @@
         value: true
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     # This actually determine if replication is running
     # If one of the standbys goes down, setting this to 0 temporarily
@@ -95,6 +98,7 @@
         value: 10
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     # needs to be enabled to use pg_rewind
     # https://www.postgresql.org/docs/current/app-pgrewind.html
@@ -105,6 +109,7 @@
         value: true
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     # TODO: we are not actively using replication slots right now
     # replication slots:
@@ -117,6 +122,7 @@
         value: 10
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     # make it SYNCHRONOUS REPLICATION (without the next two settings it would be asynchronous)
     # https://www.postgresql.org/docs/current/runtime-config-replication.html#GUC-SYNCHRONOUS-STANDBY-NAMES
@@ -126,6 +132,7 @@
         value: "*" # all the standbys
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
     # https://www.postgresql.org/docs/current/runtime-config-wal.html#GUC-SYNCHRONOUS-COMMIT
     # will not give standby query consistency (tradeoff for better write performance), but will give standby durable commit after OS crash
@@ -136,6 +143,7 @@
         value: "on"
       become: true
       become_user: postgres
+      notify: Restart postgres service
 
 # https://www.repmgr.org/docs/current/quickstart-primary-register.html
 - name: Run repmgr to register the primary
@@ -149,10 +157,3 @@
 - name: Print out the register_primary_results
   ansible.builtin.debug:
     var: register_results.stderr_lines
-
-# make sure these changes take effect
-- name: Restart postgres service
-  ansible.builtin.systemd_service:
-    name: postgresql
-    state: restarted
-  become: true
diff --git a/ansible/roles/pg/tasks/configure/create_standby.yml b/ansible/roles/pg/tasks/configure/create_standby.yml
index c04eb71e..6117849c 100644
--- a/ansible/roles/pg/tasks/configure/create_standby.yml
+++ b/ansible/roles/pg/tasks/configure/create_standby.yml
@@ -81,10 +81,10 @@
 # - name: Print out the basebackup_results
 #   debug: msg="backup {{ basebackup_results }}"
 
-- name: Restart service postgres
+- name: Start service postgres
   ansible.builtin.systemd_service:
     name: postgresql
-    state: restarted
+    state: started
   become: true
 
 - name: Waits for port 5432 to be available, don't check for initial 10 seconds
@@ -109,6 +109,7 @@
     var: register_results.stderr_lines
 
 # run some sql... to confirm clone?
+# TODO: can probably make this fail if query is not what we expect
 - name: Do some sql to test for the existence of lard...?
   community.postgresql.postgresql_query:
     db: lard
diff --git a/ansible/roles/pg/tasks/configure/install_postgres.yml b/ansible/roles/pg/tasks/configure/install_postgres.yml
index fd63cd9f..d4f06497 100644
--- a/ansible/roles/pg/tasks/configure/install_postgres.yml
+++ b/ansible/roles/pg/tasks/configure/install_postgres.yml
@@ -48,36 +48,55 @@
   ansible.builtin.set_fact:
     ansible_python_interpreter: "{{ pg_venv }}/bin/python3"
 
-# Make so the data is actually kept on the ssd mount
-# First stop postgres service
-- name: Stop service postgres, if running
-  ansible.builtin.systemd_service:
-    name: postgresql
-    state: stopped
-  become: true
+- name: Read postgres config file
+  ansible.builtin.slurp:
+    src: /etc/postgresql/{{ pg_version }}/main/postgresql.conf
+  register: pg_conf_file
 
-- name: Rsync postgres directory to ssd mount
-  ansible.posix.synchronize:
-    archive: true
-    src: /var/lib/postgresql
-    dest: "{{ pg_mount_point }}"
-  become: true
-  # synchronize runs by default on localhost
-  delegate_to: "{{ inventory_hostname }}"
+- name: Check data directory set
+  ansible.builtin.set_fact:
+    pg_data_directory_set: "{{ pg_conf_file['content'] | b64decode | regex_search(\"(?<=data_directory\\s=\\s')\\S+(?=')\") == pg_dir }}"
+
+- name: Check listen addresses set
+  ansible.builtin.set_fact:
+    pg_listen_addresses_set: "{{ pg_conf_file['content'] | b64decode | regex_search(\"(?<=listen_addresses\\s=\\s')\\S+(?=')\") == '*' }}"
 
+- name: Check stat_statements set
+  ansible.builtin.set_fact:
+    pg_stat_statements_set: "{{ pg_conf_file['content'] | b64decode | regex_search(\"pg_stat_statements\") == 'pg_stat_statements' }}"
+
+# Make so the data is actually kept on the ssd mount
 - name: Change postgres data directory
+  # we use replace here instead of postgresql_set because postgres is not running
   ansible.builtin.replace:
     dest: /etc/postgresql/{{ pg_version }}/main/postgresql.conf
     regexp: '(data_directory\s=\s)\S+'
     replace: "\\1'{{ pg_dir }}'"
   become: true
+  when: not pg_data_directory_set
+  notify:
+    - Rsync postgres directory to ssd mount
+    - Restart postgres service
 
 - name: Change postgres listen_addresses
+  # we use replace here instead of postgresql_set because postgres is not running
   ansible.builtin.replace:
     dest: /etc/postgresql/{{ pg_version }}/main/postgresql.conf
     regexp: '#(listen_addresses\s=\s)\S+'
     replace: "\\1'*'"
   become: true
+  when: not pg_listen_addresses_set
+  notify: Restart postgres service
+
+- name: Enable postgres stat_statements
+  # we use replace here instead of postgresql_set because postgres is not running
+  ansible.builtin.replace:
+    dest: /etc/postgresql/{{ pg_version }}/main/postgresql.conf
+    regexp: "^#?(shared_preload_libraries = '.*)(')"
+    replace: '\1pg_stat_statements\2'
+  become: true
+  when: not pg_stat_statements_set
+  notify: Restart postgres service
 
 # probably want to restrict this once we know what will connect?
 # but the security group rules should take care of limiting to met ranges
@@ -89,10 +108,16 @@
     method: md5
     # users and database default to all
   become: true
+  notify: Restart postgres service
+
+# Make sure any configuration changes are applied before moving on
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
 
-# make sure these changes take effect
-- name: Restart postgres service
+# Ensure postgres is running and will start at boot
+- name: Start postgres
   ansible.builtin.systemd_service:
     name: postgresql
-    state: restarted
+    state: started
+    enabled: true
   become: true
diff --git a/ansible/roles/pg/tasks/configure/repmgr.yml b/ansible/roles/pg/tasks/configure/repmgr.yml
index 9bf6b3d4..c6f4c863 100644
--- a/ansible/roles/pg/tasks/configure/repmgr.yml
+++ b/ansible/roles/pg/tasks/configure/repmgr.yml
@@ -1,7 +1,5 @@
 ---
 # https://www.repmgr.org/docs/current/quickstart-repmgr-user-database.html
-# TODO: not idempotent, after the primary/standby relationship is established,
-# the standby node becomes read-only
 - name: Create repmgr user
   community.postgresql.postgresql_user:
     name: repmgr
@@ -11,8 +9,6 @@
   become: true
   become_user: postgres
 
-# TODO: not idempotent, after the primary/standby relationship is established,
-# the standby node becomes read-only
 - name: Create a repmgr database, with owner repmgr
   community.postgresql.postgresql_db:
     name: repmgr
@@ -30,6 +26,7 @@
     address: all
     method: trust
   become: true
+  notify: Restart postgres service
 
 - name: Change hba conf to allow repmgr to connect to the repmgr db
   community.postgresql.postgresql_pg_hba:
@@ -40,6 +37,7 @@
     address: all
     method: trust
   become: true
+  notify: Restart postgres service
 
 # TODO: use pg_ctlcluster instead of systemctl? Recommended by the repmgr docs
 # https://www.repmgr.org/docs/4.0/configuration-service-commands.html
@@ -61,9 +59,8 @@
     dest: "/etc/repmgr.conf"
     mode: "0755"
   become: true
+  notify: Restart postgres service
 
-- name: Restart postgres
-  ansible.builtin.systemd_service:
-    name: postgresql
-    state: restarted
-  become: true
+# Make sure any configuration changes are applied before moving on
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
diff --git a/ansible/roles/pg/tasks/main.yml b/ansible/roles/pg/tasks/main.yml
index 0b7ec81f..c33da7ca 100644
--- a/ansible/roles/pg/tasks/main.yml
+++ b/ansible/roles/pg/tasks/main.yml
@@ -13,15 +13,35 @@
 - name: Install postgres
   ansible.builtin.import_tasks: configure/install_postgres.yml
 
+# Needed to disable certain tasks, as replicas are read-only and can't run them
+- name: Discover replication status
+  community.postgresql.postgresql_query:
+    db: "lard"
+    login_host: "localhost"
+    login_user: "lard_user"
+    login_password: "{{ pg_lard_password }}"
+    query: SELECT * FROM pg_stat_wal_receiver
+  register: pg_stat_wal_receiver
+  # This will fail on first run, as the lard user and db are not yet created. In this case
+  # the following task will not run, leaving is_replica as false
+  ignore_errors: true
+- name: Set replication status fact
+  ansible.builtin.set_fact:
+    pg_is_replica: "{{ pg_stat_wal_receiver.rowcount == 1 }}"
+  when: pg_stat_wal_receiver is succeeded
+
 - name: Configure repmgr
   ansible.builtin.import_tasks: configure/repmgr.yml
+  when: not pg_is_replica
 
 # This needs to be done after postgres installation
 - name: Share postgres SSH keys
   ansible.builtin.import_tasks: configure/ssh.yml
 
 - name: Create primary
-  when: ansible_host == pg_primary_ip
+  when:
+    - ansible_host == pg_primary_ip
+    - not pg_is_replica
   block:
     - name: Setup primary DB
       ansible.builtin.import_tasks: configure/create_primary.yml
@@ -34,4 +54,6 @@
 
 - name: Create standby
   ansible.builtin.import_tasks: configure/create_standby.yml
-  when: ansible_host != pg_primary_ip
+  when:
+    - ansible_host != pg_primary_ip
+    - not pg_is_replica
diff --git a/ansible/teardown.yml b/ansible/teardown.yml
index b958bc34..7bdc21f6 100644
--- a/ansible/teardown.yml
+++ b/ansible/teardown.yml
@@ -13,6 +13,7 @@
     - name: Remove VMs
       openstack.cloud.server:
         cloud: "{{ ostack_cloud }}"
+        region_name: "{{ ostack_region }}"
         name: "{{ inventory_hostname }}"
         state: absent
       delegate_to: localhost
@@ -21,6 +22,7 @@
     - name: Remove Volumes
       openstack.cloud.volume:
         cloud: "{{ ostack_cloud }}"
+        region_name: "{{ ostack_region }}"
         name: "{{ inventory_hostname }}"
         state: absent
       delegate_to: localhost
diff --git a/ingestion/Cargo.toml b/ingestion/Cargo.toml
index ca23d66e..34155963 100644
--- a/ingestion/Cargo.toml
+++ b/ingestion/Cargo.toml
@@ -20,6 +20,8 @@ util = { path = "../util" }
 csv.workspace = true
 futures.workspace = true
 kafka.workspace = true
+metrics.workspace = true
+metrics-exporter-prometheus.workspace = true
 quick-xml.workspace = true
 regex.workspace = true
 rove.workspace = true
@@ -30,3 +32,5 @@ tokio.workspace = true
 tokio-postgres.workspace = true
 tokio-util.workspace = true
 toml.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
diff --git a/ingestion/src/kldata.rs b/ingestion/src/kldata.rs
index cdd98a4a..4d5cd889 100644
--- a/ingestion/src/kldata.rs
+++ b/ingestion/src/kldata.rs
@@ -11,6 +11,7 @@ use std::{
     str::{FromStr, Lines},
     sync::{Arc, RwLock},
 };
+use tracing::{info, warn};
 
 /// Represents a set of observations that came in the same message from obsinn, with shared
 /// station_id and type_id
@@ -169,6 +170,10 @@ fn parse_obs<'a>(
             (timestamp, vals)
         };
 
+        // used to increment metrics
+        let mut num_scalar = 0;
+        let mut num_nonscalar = 0;
+
         for (i, val) in vals.enumerate() {
             // TODO: should we do some smart bounds-checking??
             let col = columns[i].clone();
@@ -176,6 +181,7 @@ fn parse_obs<'a>(
             let value = match reference_params.get(&col.param_code) {
                 Some(ref_param) => {
                     if ref_param.is_scalar {
+                        num_scalar += 1;
                         // NOTE: we assume ref_params marked as scalar in Stinfosys to be floats (but
                         // could be ints, which wouldn't be ideal)
                         let parsed = val.parse().map_err(|_| {
@@ -184,8 +190,9 @@ fn parse_obs<'a>(
 
                         ObsType::Scalar(parsed)
                     } else {
+                        num_nonscalar += 1;
                         // TODO: we should implement logging/tracing sooner or later
-                        println!(
+                        info!(
                             "non-scalar param ({}, {}, {}): '{}'",
                             ref_param.id, col.param_code, ref_param.element_id, val
                         );
@@ -194,7 +201,7 @@ fn parse_obs<'a>(
                     }
                 }
                 None => {
-                    println!("unrecognised param_code '{}': '{}'", col.param_code, val);
+                    warn!("unrecognised param_code '{}': '{}'", col.param_code, val);
                     ObsType::NonScalar(val)
                 }
             };
@@ -202,6 +209,9 @@ fn parse_obs<'a>(
             obs.push(ObsinnObs { id: col, value })
         }
 
+        metrics::counter!("scalar_datapoints").increment(num_scalar);
+        metrics::counter!("nonscalar_datapoints").increment(num_nonscalar);
+
         // TODO: should this be more resiliant?
         if obs.is_empty() {
             return Err(row_is_empty());
@@ -304,7 +314,7 @@ pub async fn filter_and_label_kldata<'a>(
             )? {
                 // TODO: log that the timeseries is closed? Mostly useful for tests
                 #[cfg(feature = "integration_tests")]
-                eprintln!("station {}: timeseries is closed", chunk.station_id);
+                info!("station {}: timeseries is closed", chunk.station_id);
                 continue;
             }
 
diff --git a/ingestion/src/kvkafka.rs b/ingestion/src/kvkafka.rs
index 81f103aa..85cd8259 100644
--- a/ingestion/src/kvkafka.rs
+++ b/ingestion/src/kvkafka.rs
@@ -4,6 +4,7 @@ use serde::{Deserialize, Deserializer};
 use thiserror::Error;
 use tokio::sync::mpsc;
 use tokio_util::sync::CancellationToken;
+use tracing::error;
 
 use crate::PgConnectionPool;
 
@@ -142,7 +143,8 @@ pub async fn read_and_insert(
     let mut client = pool.get().await.expect("couldn't connect to database");
     while let Some(msg) = rx.recv().await {
         if let Err(e) = insert_kvdata(&mut client, msg).await {
-            eprintln!("Database insert error: {e}");
+            metrics::counter!("kafka_failures").increment(1);
+            error!("Database insert error: {e}");
         }
     }
 }
@@ -180,7 +182,8 @@ pub async fn parse_message(message: &[u8], tx: &mpsc::Sender<Msg>) -> Result<(),
                     match NaiveDateTime::parse_from_str(&obstime.val, "%Y-%m-%d %H:%M:%S") {
                         Ok(time) => time.and_utc(),
                         Err(e) => {
-                            eprintln!("{}", Error::IssueParsingTime(e));
+                            metrics::counter!("kafka_failures").increment(1);
+                            error!("{}", Error::IssueParsingTime(e));
                             continue;
                         }
                     };
@@ -244,21 +247,33 @@ async fn read_kafka(group_name: String, tx: mpsc::Sender<Msg>, cancel_token: Can
             poll_result = async { consumer.poll() } => {
                 match poll_result {
                     Ok(sets) => {
+                        // used for metrics
+                        let mut num_messages = 0;
+
                         for msgset in sets.iter() {
                             for msg in msgset.messages() {
+                                num_messages += 1;
                                 if let Err(e) = parse_message(msg.value, &tx).await {
-                                    eprintln!("{}", e);
+                                    metrics::counter!("kafka_failures").increment(1);
+                                    error!("{}", e);
                                 }
                             }
                             if let Err(e) = consumer.consume_messageset(msgset) {
-                                eprintln!("{}", e);
+                                metrics::counter!("kafka_failures").increment(1);
+                                error!("{}", e);
                             }
                         }
+
+                        metrics::counter!("kafka_messages_received").increment(num_messages);
+
                         consumer
                             .commit_consumed()
+                            // FIXME: I wonder if an expect is too harsh here? we probably don't want to
+                            // crash the task
                             .expect("could not commit offset in consumer"); // ensure we keep offset
                     }
                     Err(e) => {
+                        metrics::counter!("kafka_failures").increment(1);
                         eprintln!("{}\nRetrying in 5 seconds...", Error::Kafka(e));
                         tokio::time::sleep(tokio::time::Duration::from_secs(5)).await;
                     }
diff --git a/ingestion/src/lib.rs b/ingestion/src/lib.rs
index 182d911d..5b00f832 100644
--- a/ingestion/src/lib.rs
+++ b/ingestion/src/lib.rs
@@ -1,6 +1,7 @@
 use axum::{
-    extract::{FromRef, State},
-    response::Json,
+    extract::{FromRef, MatchedPath, Request, State},
+    middleware::{self, Next},
+    response::{IntoResponse, Json},
     routing::post,
     Router,
 };
@@ -18,6 +19,7 @@ use std::{
 use thiserror::Error;
 use tokio_postgres::NoTls;
 use tokio_util::sync::CancellationToken;
+use tracing::info;
 
 #[cfg(feature = "kafka")]
 pub mod kvkafka;
@@ -366,6 +368,8 @@ async fn handle_kldata(
     State(qc_pipelines): State<Arc<HashMap<(i32, RelativeDuration), rove::Pipeline>>>,
     body: String,
 ) -> Json<KldataResp> {
+    metrics::counter!("kldata_messages_received").increment(1);
+
     let result: Result<usize, Error> = async {
         let mut conn = pool.get().await?;
 
@@ -391,12 +395,16 @@ async fn handle_kldata(
             res: 0,
             retry: false,
         }),
-        Err(e) => Json(KldataResp {
-            message: e.to_string(),
-            message_id: 0, // TODO: some clever way to get the message id still if possible?
-            res: 1,
-            retry: !matches!(e, Error::Parse(_)),
-        }),
+        Err(e) => {
+            metrics::counter!("kldata_failures").increment(1);
+            // TODO: log errors?
+            Json(KldataResp {
+                message: e.to_string(),
+                message_id: 0, // TODO: some clever way to get the message id still if possible?
+                res: 1,
+                retry: !matches!(e, Error::Parse(_)),
+            })
+        }
     }
 }
 
@@ -425,6 +433,32 @@ fn get_conversions(filename: &str) -> Result<ParamConversions, csv::Error> {
     ))
 }
 
+/// Middleware function that runs around a request, so we can record how long it took
+async fn track_request_duration(req: Request, next: Next) -> impl IntoResponse {
+    let start = std::time::Instant::now();
+    let path = if let Some(matched_path) = req.extensions().get::<MatchedPath>() {
+        matched_path.as_str().to_owned()
+    } else {
+        req.uri().path().to_owned()
+    };
+    let method = req.method().clone();
+
+    let response = next.run(req).await;
+
+    let latency = start.elapsed().as_secs_f64();
+    let status = response.status().as_u16().to_string();
+
+    let labels = [
+        ("method", method.to_string()),
+        ("path", path),
+        ("status", status),
+    ];
+
+    metrics::histogram!("http_requests_duration_seconds", &labels).record(latency);
+
+    response
+}
+
 pub async fn run(
     db_pool: PgConnectionPool,
     param_conversion_path: &str,
@@ -444,6 +478,7 @@ pub async fn run(
     // build our application with a single route
     let app = Router::new()
         .route("/kldata", post(handle_kldata))
+        .route_layer(middleware::from_fn(track_request_duration))
         .with_state(IngestorState {
             db_pool,
             param_conversions,
@@ -454,6 +489,7 @@ pub async fn run(
 
     // run our app with hyper, listening globally on port 3001
     let listener = tokio::net::TcpListener::bind("0.0.0.0:3001").await?;
+    info!("Ingestion server started!");
     axum::serve(listener, app)
         .with_graceful_shutdown(async move { cancel_token.cancelled().await })
         .await?;
diff --git a/ingestion/src/main.rs b/ingestion/src/main.rs
index 03802147..e3b1b2bf 100644
--- a/ingestion/src/main.rs
+++ b/ingestion/src/main.rs
@@ -1,17 +1,20 @@
 use bb8_postgres::PostgresConnectionManager;
-use lard_ingestion::qc_pipelines::load_pipelines;
+use metrics_exporter_prometheus::{Matcher, PrometheusBuilder};
 use rove_connector::Connector;
 use std::sync::{Arc, RwLock};
 use tokio_postgres::NoTls;
 use tokio_util::sync::CancellationToken;
+use tracing::{debug, info};
 
-use lard_ingestion::{getenv, permissions};
+use lard_ingestion::{getenv, permissions, qc_pipelines::load_pipelines};
 
 const PARAMCONV: &str = "resources/paramconversions.csv";
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    println!("LARD ingestion service starting up...");
+    tracing_subscriber::fmt::init();
+
+    info!("LARD ingestion service starting up...");
     // TODO: use clap for argument parsing
     let args: Vec<String> = std::env::args().collect();
 
@@ -48,13 +51,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
 
     let qc_pipelines = load_pipelines("qc_pipelines/fresh")?;
 
-    println!("Spawning task to fetch permissions from StInfoSys...");
+    debug!("Spawning task to fetch permissions from StInfoSys...");
     // background task to refresh permit tables every 30 mins
     tokio::task::spawn(async move {
         let mut interval = tokio::time::interval(tokio::time::Duration::from_secs(30 * 60));
 
         loop {
             interval.tick().await;
+            info!("Refreshing permit tables");
             async {
                 // TODO: better error handling here? Nothing is listening to what returns on this task
                 // but we could surface failures in metrics. Also we maybe don't want to bork the task
@@ -71,8 +75,28 @@ async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let cancel_token = CancellationToken::new();
     tokio::spawn(util::signal_catcher(cancel_token.clone()));
 
+    // Set up prometheus metrics exporter
+    PrometheusBuilder::new()
+        .set_buckets_for_metric(
+            Matcher::Full("http_requests_duration_seconds".to_string()),
+            &[
+                0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0,
+            ],
+        )
+        .expect("Failed to set metric buckets")
+        .install()
+        .expect("Failed to set up metrics exporter");
+
+    // Register metrics so they're guaranteed to show in exporter output
+    let _ = metrics::histogram!("http_requests_duration_seconds");
+    let _ = metrics::counter!("kldata_messages_received");
+    let _ = metrics::counter!("kldata_failures");
+    let _ = metrics::counter!("kafka_messages_received");
+    let _ = metrics::counter!("kafka_failures");
+    let _ = metrics::counter!("scalar_datapoints");
+    let _ = metrics::counter!("nonscalar_datapoints");
+
     // Set up and run our server + database
-    println!("Ingestion server started!");
     let ingestor = tokio::spawn(lard_ingestion::run(
         db_pool.clone(),
         PARAMCONV,
@@ -86,7 +110,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     // Spawn kvkafka reader
     {
         let kafka_group = args[1].to_string();
-        println!("Spawning kvkafka reader...");
+        debug!("Spawning kvkafka reader...");
         let kvkafka_reader = tokio::spawn(lard_ingestion::kvkafka::read_and_insert(
             db_pool,
             kafka_group,
diff --git a/ingestion/src/permissions.rs b/ingestion/src/permissions.rs
index 277325c3..185a17c0 100644
--- a/ingestion/src/permissions.rs
+++ b/ingestion/src/permissions.rs
@@ -4,6 +4,7 @@ use std::{
     sync::{Arc, RwLock},
 };
 use tokio_postgres::NoTls;
+use tracing::error;
 
 #[derive(Debug, Clone)]
 pub struct ParamPermit {
@@ -47,7 +48,7 @@ pub async fn fetch_permits() -> Result<(ParamPermitTable, StationPermitTable), E
     // it will return when the client is dropped
     tokio::spawn(async move {
         if let Err(e) = conn.await {
-            eprintln!("connection error: {}", e); // TODO: trace this?
+            error!("connection error: {}", e); // TODO: should we include this in a metric for alerting?
         }
     });