@fluffy yeah, that would be a handy overview to have! I feel like running goaccess in multi-vhost mode would get close as far as https traffic goes, but i'd still need a separate monitor for non-http traffic through the vpn (like outgoing activitypub/redundancy.. i've had trouble with that in the past)
@scanlime yeah now that I have nginx correctly configured to log the remote address and vhost it'll be a lot easier in the future, at least for the things that get proxied through nginx (which is most of my stuff but not everything)