diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2233ed0..6c4eb43 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -129,6 +129,8 @@ set(requirements 1)
 require_lws_config(LWS_ROLE_H1				1 requirements)
 require_lws_config(LWS_ROLE_WS				1 requirements)
 require_lws_config(LWS_WITH_JOSE			1 requirements)
+require_lws_config(LWS_WITH_PLUGINS_BUILTIN		1 requirements)
+
 
 if (requirements)
 
diff --git a/READMEs/README-systemd-nspawn.md b/READMEs/README-systemd-nspawn.md
index 449bd03..720564b 100644
--- a/READMEs/README-systemd-nspawn.md
+++ b/READMEs/README-systemd-nspawn.md
@@ -328,7 +328,8 @@ Container # git clone https://libwebsockets.org/repo/libwebsockets
 Container # cd libwebsockets && mkdir build && cd build && \
   cmake .. -DLWS_WITH_JOSE=1 -DLWS_UNIX_SOCK=1 -DLWS_WITH_STRUCT_JSON=1 \
    -DLWS_WITH_STRUCT_SQLITE3=1 -DLWS_WITH_GENCRYPTO=1 -DLWS_WITH_SPAWN=1 \
-   -DLWS_WITH_SECURE_STREAMS=1 -DLWS_WITH_THREADPOOL=1 -DLWS_WITH_JOSE=1
+   -DLWS_WITH_SECURE_STREAMS=1 -DLWS_WITH_THREADPOOL=1 -DLWS_WITH_JOSE=1 \
+   -DLWS_WITH_PLUGINS_BUILTIN=1
 Container # make -j && make -j install && ldconfig
 ```
 
@@ -339,7 +340,8 @@ For newer M1 based OSX
 ```
 cmake .. -DLWS_OPENSSL_INCLUDE_DIRS=/opt/homebrew/Cellar/openssl@1.1/1.1.1h/include '-DLWS_OPENSSL_LIBRARIES=/opt/homebrew/Cellar/openssl@1.1/1.1.1h/lib/libssl.dylib;/opt/homebrew/Cellar/openssl@1.1/1.1.1h/lib/libcrypto.dylib' -DLWS_WITH_MINIMAL_EXAMPLES=0 -DLWS_WITH_JOSE=1 -DLWS_UNIX_SOCK=1 -DLWS_WITH_STRUCT_JSON=1 \
     -DLWS_WITH_GENCRYPTO=1 -DLWS_WITH_SPAWN=1 \
-   -DLWS_WITH_SECURE_STREAMS=1 -DLWS_WITH_THREADPOOL=1 -DLWS_WITH_JOSE=1
+   -DLWS_WITH_SECURE_STREAMS=1 -DLWS_WITH_THREADPOOL=1 -DLWS_WITH_JOSE=1 \
+   -DLWS_WITH_PLUGINS_BUILTIN=1
 ```
 
 ### Windows: build libgit2
diff --git a/src/builder/b-conf.c b/src/builder/b-conf.c
index 6479158..eb9e2c1 100644
--- a/src/builder/b-conf.c
+++ b/src/builder/b-conf.c
@@ -33,12 +33,18 @@ static const char * const paths_global[] = {
 	"home",
 	"perms",
 	"host",
+	"metrics_uri",
+	"metrics_path",
+	"metrics_secret"
 };
 
 enum enum_paths_global {
 	LEJPM_HOME,
 	LEJPM_PERMS,
 	LEJPM_HOST,
+	LEJPM_METRICS_URI,
+	LEJPM_METRICS_PATH,
+	LEJPM_METRICS_SECRET,
 };
 
 /* platform-related part */
@@ -267,6 +273,18 @@ saib_conf_global_cb(struct lejp_ctx *ctx, char reason)
 		pp = &a->builder->host;
 		break;
 
+	case LEJPM_METRICS_URI:
+		pp = &a->builder->metrics_uri;
+		break;
+
+	case LEJPM_METRICS_PATH:
+		pp = &a->builder->metrics_path;
+		break;
+
+	case LEJPM_METRICS_SECRET:
+		pp = &a->builder->metrics_secret;
+		break;
+
 	default:
 		return 0;
 	}
diff --git a/src/builder/b-private.h b/src/builder/b-private.h
index f63d02a..265838c 100644
--- a/src/builder/b-private.h
+++ b/src/builder/b-private.h
@@ -155,6 +155,10 @@ struct sai_builder {
 	struct lws_context	*context;
 	struct lws_vhost	*vhost;
 
+	const char		*metrics_uri;
+	const char		*metrics_path;
+	const char		*metrics_secret;
+
 	const char		*home;		/* home dir, usually /sai/home */
 	const char		*perms;		/* user:group */
 
diff --git a/src/builder/b-sai.c b/src/builder/b-sai.c
index b42a031..206173b 100644
--- a/src/builder/b-sai.c
+++ b/src/builder/b-sai.c
@@ -114,13 +114,39 @@ static const char * const default_ss_policy =
 static const struct lws_protocols *pprotocols[] = {
 	&protocol_stdxxx,
 	&protocol_logproxy,
+	&lws_openmetrics_export_protocols[LWSOMPROIDX_PROX_WS_CLIENT],
 	NULL
 };
 
 static int lpidx;
 static char vhnames[256], *pv = vhnames;
 
-static struct lws_protocol_vhost_options pvo = {
+static struct lws_protocol_vhost_options
+pvo1c = {
+        NULL,                  /* "next" pvo linked-list */
+        NULL,                 /* "child" pvo linked-list */
+        "ba-secret",        /* protocol name we belong to on this vhost */
+        "ok"                     /* set at runtime from conf */
+},
+pvo1b = {
+        &pvo1c,                  /* "next" pvo linked-list */
+        NULL,                 /* "child" pvo linked-list */
+        "metrics-proxy-path",        /* protocol name we belong to on this vhost */
+        "ok"                     /* set at runtime from conf */
+},
+pvo1a = {
+        &pvo1b,                  /* "next" pvo linked-list */
+        NULL,                 /* "child" pvo linked-list */
+        "ws-server-uri",        /* protocol name we belong to on this vhost */
+        "ok"                     /* set at runtime from conf */
+},
+pvo1 = {
+        NULL,                  /* "next" pvo linked-list */
+        &pvo1a,                 /* "child" pvo linked-list */
+        "lws-openmetrics-prox-client",        /* protocol name we belong to on this vhost */
+        "ok"                     /* ignored */
+},
+pvo = {
         NULL,                  /* "next" pvo linked-list */
         NULL,                 /* "child" pvo linked-list */
         "protocol-logproxy",        /* protocol name we belong to on this vhost */
@@ -368,6 +394,8 @@ int main(int argc, const char **argv)
 		return 1;
 	}
 
+	lwsl_notice("%s: parsed %s %s %s\n", __func__, builder.metrics_path, builder.metrics_uri, builder.metrics_secret);
+
 	/*
 	 * We need to sample the true uid / gid we should use inside
 	 * the mountpoint for sai:nobody or sai:sai, by looking at
@@ -434,6 +462,11 @@ int main(int argc, const char **argv)
 
 	/* ... and our vhost... */
 
+	pvo1a.value = builder.metrics_uri;
+	pvo1b.value = builder.metrics_path;
+	pvo1c.value = builder.metrics_secret;
+	info.pvo = &pvo1;
+
 	builder.vhost = lws_create_vhost(builder.context, &info);
 	if (!builder.vhost) {
 		lwsl_err("Failed to create tls vhost\n");
@@ -478,6 +511,24 @@ bail:
 
 	} lws_end_foreach_dll_safe(p, p1);
 
+	lws_start_foreach_dll_safe(struct lws_dll2 *, mp, mp1,
+			           builder.sai_plat_owner.head) {
+		struct sai_plat *sp = lws_container_of(mp, struct sai_plat,
+					sai_plat_list);
+
+		lws_dll2_remove(&sp->sai_plat_list);
+
+		lws_start_foreach_dll_safe(struct lws_dll2 *, p, p1,
+					   sp->nspawn_owner.head) {
+			struct sai_nspawn *ns = lws_container_of(p,
+						struct sai_nspawn, list);
+
+			sai_ns_destroy(ns);
+
+		} lws_end_foreach_dll_safe(p, p1);
+
+	} lws_end_foreach_dll_safe(mp, mp1);
+
 	saib_config_destroy(&builder);
 
 	/*
@@ -495,23 +546,7 @@ bail:
 	pthread_mutex_destroy(&builder.mi.mut);
 	pthread_cond_destroy(&builder.mi.cond);
 
-	lws_start_foreach_dll_safe(struct lws_dll2 *, mp, mp1,
-			           builder.sai_plat_owner.head) {
-		struct sai_plat *sp = lws_container_of(mp, struct sai_plat,
-					sai_plat_list);
-
-		lws_dll2_remove(&sp->sai_plat_list);
 
-		lws_start_foreach_dll_safe(struct lws_dll2 *, p, p1,
-					   sp->nspawn_owner.head) {
-			struct sai_nspawn *ns = lws_container_of(p,
-						struct sai_nspawn, list);
-
-			sai_ns_destroy(ns);
-
-		} lws_end_foreach_dll_safe(p, p1);
-
-	} lws_end_foreach_dll_safe(mp, mp1);
 
 	lws_context_destroy(builder.context);
 
diff --git a/src/server/s-comms.c b/src/server/s-comms.c
index b3cc6e6..e83df12 100644
--- a/src/server/s-comms.c
+++ b/src/server/s-comms.c
@@ -279,7 +279,9 @@ sai_destroy_builder(struct lws_dll2 *d, void *user)
 static void
 sais_server_destroy(struct vhd *vhd, sais_t *server)
 {
-	lws_dll2_foreach_safe(&server->builder_owner, NULL, sai_destroy_builder);
+	lwsl_notice("%s: server %p\n", __func__, server);
+	if (server)
+		lws_dll2_foreach_safe(&server->builder_owner, NULL, sai_destroy_builder);
 
 	sais_event_db_close_all_now(vhd);
 
@@ -354,7 +356,7 @@ callback_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 		if (lws_pvo_get_str(in, "notification-key",
 				    &vhd->notification_key)) {
-			lwsl_err("%s: notification_key pvo required\n", __func__);
+			lwsl_warn("%s: notification_key pvo required\n", __func__);
 			return -1;
 		}
 
diff --git a/src/server/s-sai.c b/src/server/s-sai.c
index df6ca96..a3d90c1 100644
--- a/src/server/s-sai.c
+++ b/src/server/s-sai.c
@@ -1,7 +1,7 @@
 /*
  * Sai server
  *
- * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2019 - 2021 Andy Green <andy@warmcat.com>
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -53,7 +53,12 @@ static const char * const default_ss_policy =
 ;
 
 static const struct lws_protocols
-	*pprotocols[] = { &protocol_ws, NULL };
+	*pprotocols[] = {
+		&protocol_ws,
+		&lws_openmetrics_export_protocols[LWSOMPROIDX_PROX_HTTP_SERVER],
+		&lws_openmetrics_export_protocols[LWSOMPROIDX_PROX_WS_SERVER],
+		NULL
+	};
 
 static void sigint_handler(int sig)
 {