metrics: add observe_catchall_hosts docs

src/docs/markdown/caddyfile/options.md

@@ -78,6 +78,7 @@ Possible options are (click on each option to jump to its documentation):
 	shutdown_delay <duration>
 	metrics {
 		per_host
+		observe_catchall_hosts
 	}
 
 	# TLS Options
@@ -1057,6 +1058,17 @@ You can add the `per_host` option to label metrics with the host name of the met
 }
 ```
 
+Due to the infinite cardinality potential in observing all possible hosts may be sent by clients, Caddy will only record metrics for configured hosts, while all other hosts (e.g., attacker.com) are aggregated under "_other" label. To force observation of all hosts, and where potential infinite cardinality is an acceptable risk, you add `observe_catchall_hosts`. Note that adding `observe_catchall_hosts` will not enable `per_host`. However, this is automatically enabled for HTTPS servers (since certificates provide some protection against unbounded cardinality), but disabled for HTTP servers by default to prevent cardinality attacks from arbitrary Host headers.
+
+```caddy
+{
+	metrics {
+		per_host
+		observe_catchall_hosts
+	}
+}
+```
+
 ##### `trace`
 
 Log each individual handler that is invoked. Requires that the log emit at `DEBUG` level ( You may do so with the [`debug` global option](#debug)).

src/docs/markdown/metrics.md

@@ -33,6 +33,17 @@ To add per-host metrics you can insert the `per_host` option. Host specific metr
 }
 ```
 
+This configuration will observe configured hosts. If an HTTPS server is configured, the host is observed, even if not explicitly configured, e.g. on-demand TLS setup. If HTTPS is disbaled, the only configured hosts are enabled due to potential infinite cardinality risk. To observe all hosts in HTTP setup, even unconfigured ones, use `observe_catchall_hosts` option.
+
+```caddy
+{
+	metrics {
+		per_host
+		observe_catchall_hosts
+	}
+}
+```
+
 ## Prometheus
 
 [Prometheus](https://prometheus.io) is a monitoring platform that collects