[spoiler]

The `tracing` ecosystem is IMO pretty good, and even works with Sentry for various frameworks (well largely it's all tower based anyway)

Not sure what you mean by monitoring. What do you expect (and do you have any examples where other languages provide monitoring solutions?).

Security wise, I've not had any issues finding crates for specific things I needed either, but security is a broad domain (so what did you find lacking in particular?)

[ufmace]

Well that's the thing about it - it mostly appears to be there, but often proves to be immature. Meaning it technically works, but most of them are inflexible, single-person projects that occasionally completely redo their API. They work their way, and good luck if you want to do anything slightly different, and unpredictable things might happen if you try to combine several things together. Not exactly confidence-inspiring to base an important production web app upon.

Tracing appears to work, but I was trying to get OpenTelemetry trace IDs into our log messages with a custom layer, which I needed anyways to match our standardized output format that every other web app in every other language can be set up to log as. I still haven't figured out how to get the current OTel TraceID in the context of Layer.on_event - there's like 4 different ways that look like they ought to work, but none of them actually do.

I wanted to set up Prometheus metrics as well. I hadn't dug too deep into that one, but it didn't seem clear what the best / most mature crates were for that or how they'd integrate with everything else.

I was able to put together a Tower Layer for our custom internal request signing system - good on them for having a standardized middleware system, though it'd be nice if more of the Rust HTTP ecosystem actually used it. I think Rocket still doesn't. It was also rather a struggle to figure out how to do things I would expect to be basic, like process the request body in the context of a Layer middleware while still leaving it available to downstream Layers and the final request handler.

[inferiorhuman]

  custom layer

Tracing is extremely opinionated in the name of performance. In practice this means you can end up in a position where you've got to take some huge chunk of code to change a small part.

  Prometheus metrics

Prometheus should handle OT, no?