fix(tracing): add OTEL_SDK_DISABLED guard and cap shutdown timeout to 5s

initTracer() in the Go ingest service unconditionally constructed an
OTLP gRPC exporter, mirroring the same design flaw fixed in Python
tracing.py (0b4e416). With OTEL_SDK_DISABLED=true the function now
returns a no-op shutdown function before any exporter or provider is
created, matching the Python guard exactly.

defer shutdownTracer(context.Background()) had no deadline, so the
BatchSpanProcessor flush could hang silently on service shutdown when
Jaeger is unreachable. The defer now uses context.WithTimeout(5s) to
bound the worst-case hang.

Adds four regression tests: skip registration when disabled, four
case/whitespace variants, and shutdown-respects-timeout.

Author: Romil2112

README.md

@@ -141,6 +141,7 @@ Copy `.env.example` to `.env` and fill these in. The two required ones make the
 | `REDIS_URL` | — | unset | Redis connection string; enables multi-worker SSE pub/sub |
 | `KAFKA_BROKER` | — | unset | Bootstrap servers; starts the Kafka consumer when set |
 | `OTEL_EXPORTER_OTLP_ENDPOINT` | — | unset | OTLP endpoint for Go ingest service distributed tracing |
+| `OTEL_SDK_DISABLED` | — | unset | Set to `true` to skip tracer initialisation in the Go ingest service. Without a reachable OTLP collector (e.g. Jaeger), leaving this unset causes a silent hang of up to 5 s on service shutdown while the `BatchSpanProcessor` tries to flush buffered spans. |
 
 ## Architecture diagram
 

cmd/ingest-service/main.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/signal"
 	"syscall"
+	"time"
 
 	"github.com/Romil2112/SOC-Dashboard/internal/ingest"
 )
@@ -31,7 +32,11 @@ func main() {
 	defer stop()
 
 	shutdownTracer := initTracer(ctx)
-	defer shutdownTracer(context.Background())
+	defer func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		shutdownTracer(ctx)
+	}()
 
 	svc, err := ingest.NewService(ctx, cfg)
 	if err != nil {

cmd/ingest-service/tracing.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"log/slog"
 	"os"
+	"strings"
 
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
@@ -19,6 +20,11 @@ const _serviceName = "soc-ingest"
 // function to flush pending spans on exit. Tracing failures are logged but do
 // not prevent the service from starting — spans are simply dropped.
 func initTracer(ctx context.Context) func(context.Context) {
+	if strings.EqualFold(strings.TrimSpace(os.Getenv("OTEL_SDK_DISABLED")), "true") {
+		slog.Info("OTel tracing disabled via OTEL_SDK_DISABLED")
+		return func(context.Context) {}
+	}
+
 	endpoint := os.Getenv("OTEL_EXPORTER_OTLP_ENDPOINT")
 	if endpoint == "" {
 		endpoint = "localhost:4317"

cmd/ingest-service/tracing_test.go

@@ -3,8 +3,11 @@ package main
 import (
 	"context"
 	"testing"
+	"time"
 
 	"go.opentelemetry.io/otel"
+	oteltrace "go.opentelemetry.io/otel/trace"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 )
 
 func TestInitTracerDoesNotPanicWithUnreachableEndpoint(t *testing.T) {
@@ -36,3 +39,62 @@ func TestInitTracerSpanDoesNotPanic(t *testing.T) {
 	}
 	span.End()
 }
+
+func TestInitTracerSkipsProviderWhenSDKDisabled(t *testing.T) {
+	// Reset the global provider so we can detect whether initTracer sets a new one.
+	otel.SetTracerProvider(oteltrace.NewNoopTracerProvider())
+	t.Setenv("OTEL_SDK_DISABLED", "true")
+
+	shutdown := initTracer(context.Background())
+	if shutdown == nil {
+		t.Fatal("initTracer returned nil shutdown function")
+	}
+
+	// Global must NOT have been upgraded to a real TracerProvider.
+	if _, ok := otel.GetTracerProvider().(*sdktrace.TracerProvider); ok {
+		t.Fatal("initTracer with OTEL_SDK_DISABLED=true must not register a TracerProvider")
+	}
+
+	// Shutdown must return promptly — it is a no-op, not a flush.
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	shutdown(ctx)
+}
+
+func TestInitTracerSDKDisabledCaseInsensitive(t *testing.T) {
+	for _, val := range []string{"TRUE", "True", " true ", "TRUE "} {
+		val := val
+		t.Run(val, func(t *testing.T) {
+			otel.SetTracerProvider(oteltrace.NewNoopTracerProvider())
+			t.Setenv("OTEL_SDK_DISABLED", val)
+			_ = initTracer(context.Background())
+			if _, ok := otel.GetTracerProvider().(*sdktrace.TracerProvider); ok {
+				t.Fatalf("OTEL_SDK_DISABLED=%q should skip provider registration", val)
+			}
+		})
+	}
+}
+
+func TestShutdownRespectsTimeout(t *testing.T) {
+	// Verify the shutdown function exits when its context deadline fires,
+	// not when the underlying flush gives up on its own schedule.
+	t.Setenv("OTEL_SDK_DISABLED", "true")
+	shutdown := initTracer(context.Background())
+
+	// A 50ms deadline is far shorter than any real flush timeout.
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	done := make(chan struct{})
+	go func() {
+		shutdown(ctx)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// returned within deadline — correct
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("shutdown did not return within deadline — no-op guard may not be working")
+	}
+}