Forward OTLP headers on browser trace proxy

Author: julianknutsen

README.md

@@ -522,9 +522,27 @@ All commands accept `--wasteland <org/db>` when multiple wastelands are joined a
 | `DOLTHUB_ORG` | Your DoltHub org/username (required for DoltHub provider) |
 | `DOLTHUB_SESSION_TOKEN` | DoltHub session token (alternative auth for REST fork API) |
 | `PORT` | Override default listen port for `wl serve` |
+| `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` | Hosted OTLP HTTP traces endpoint, e.g. `https://otel.cloud.gascityhall.com/v1/traces` |
+| `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT` | Hosted OTLP HTTP metrics endpoint, e.g. `https://otel.cloud.gascityhall.com/v1/metrics` |
+| `OTEL_EXPORTER_OTLP_HEADERS` | Static OTLP headers for hosted exporters, e.g. `X-OTLP-Shared-Token=<token>` |
+| `WL_BROWSER_OTLP_TRACES_TARGET` | Optional override for the server-side browser trace proxy target |
+| `WL_BROWSER_OTLP_HEADERS` | Optional override for static headers added by the browser trace proxy |
 | `XDG_CONFIG_HOME` | Override config dir (default `~/.config`) |
 | `XDG_DATA_HOME` | Override data dir (default `~/.local/share`) |
 
+For the shared Gas City collector, hosted Wasteland can use:
+
+```bash
+OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://otel.cloud.gascityhall.com/v1/traces
+OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://otel.cloud.gascityhall.com/v1/metrics
+OTEL_EXPORTER_OTLP_HEADERS=X-OTLP-Shared-Token=<shared-token>
+```
+
+The browser trace proxy reuses `OTEL_EXPORTER_OTLP_HEADERS` automatically, so
+browser and server telemetry can share the same ingress token. Use
+`WL_BROWSER_OTLP_TRACES_TARGET` or `WL_BROWSER_OTLP_HEADERS` only when the
+browser path needs different routing from the server exporters.
+
 ## Development
 
 ```bash

internal/api/browser_traces.go

@@ -61,6 +61,11 @@ func (s *Server) handleBrowserTraces(w http.ResponseWriter, r *http.Request) {
 	if enc := r.Header.Get("Content-Encoding"); enc != "" {
 		req.Header.Set("Content-Encoding", enc)
 	}
+	for name, values := range observability.BrowserTraceProxyHeaders() {
+		for _, value := range values {
+			req.Header.Add(name, value)
+		}
+	}
 
 	resp, err := browserTraceProxyClient.Do(req)
 	if err != nil {

internal/api/browser_traces_test.go

@@ -54,13 +54,15 @@ func TestBrowserTracesHandler_ProxiesPayload(t *testing.T) {
 		gotBody            []byte
 		gotContentType     string
 		gotContentEncoding string
+		gotSharedToken     string
 	)
 	collector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
 			t.Fatalf("collector method = %s, want POST", r.Method)
 		}
 		gotContentType = r.Header.Get("Content-Type")
 		gotContentEncoding = r.Header.Get("Content-Encoding")
+		gotSharedToken = r.Header.Get("X-OTLP-Shared-Token")
 		var err error
 		gotBody, err = io.ReadAll(r.Body)
 		if err != nil {
@@ -73,6 +75,7 @@ func TestBrowserTracesHandler_ProxiesPayload(t *testing.T) {
 	defer collector.Close()
 
 	t.Setenv("WL_BROWSER_OTLP_TRACES_TARGET", collector.URL+"/v1/traces")
+	t.Setenv("OTEL_EXPORTER_OTLP_HEADERS", "X-OTLP-Shared-Token=abc123TOKEN")
 
 	srv := New(nil)
 	ts := httptest.NewServer(srv)
@@ -101,6 +104,9 @@ func TestBrowserTracesHandler_ProxiesPayload(t *testing.T) {
 	if gotContentEncoding != "gzip" {
 		t.Fatalf("collector content-encoding = %q, want %q", gotContentEncoding, "gzip")
 	}
+	if gotSharedToken != "abc123TOKEN" {
+		t.Fatalf("collector shared token = %q, want %q", gotSharedToken, "abc123TOKEN")
+	}
 	if string(gotBody) != "trace-data" {
 		t.Fatalf("collector body = %q, want %q", string(gotBody), "trace-data")
 	}

internal/observability/browser.go

@@ -1,6 +1,7 @@
 package observability
 
 import (
+	"net/http"
 	"net/url"
 	"os"
 	"strconv"
@@ -12,6 +13,7 @@ const (
 	BrowserTraceIngressPath        = "/api/telemetry/v1/traces"
 	defaultBrowserTraceSampleRatio = 0.1
 	browserTraceProxyTargetEnvVar  = "WL_BROWSER_OTLP_TRACES_TARGET"
+	browserTraceHeadersEnvVar      = "WL_BROWSER_OTLP_HEADERS"
 	browserTraceSampleRatioEnvVar  = "WL_BROWSER_OTEL_TRACES_SAMPLE_RATIO"
 )
 
@@ -60,6 +62,22 @@ func BrowserTraceProxyTarget() string {
 	return ""
 }
 
+// BrowserTraceProxyHeaders resolves static headers that should be forwarded to
+// the upstream collector for browser OTLP traces.
+func BrowserTraceProxyHeaders() http.Header {
+	for _, raw := range []string{
+		strings.TrimSpace(os.Getenv(browserTraceHeadersEnvVar)),
+		strings.TrimSpace(os.Getenv("OTEL_EXPORTER_OTLP_TRACES_HEADERS")),
+		strings.TrimSpace(os.Getenv("OTEL_EXPORTER_OTLP_HEADERS")),
+	} {
+		if raw == "" {
+			continue
+		}
+		return parseOTLPHeaders(raw)
+	}
+	return nil
+}
+
 func appendTracePath(raw string) string {
 	u, err := url.Parse(raw)
 	if err != nil {
@@ -75,3 +93,30 @@ func appendTracePath(raw string) string {
 	u.Path = strings.TrimRight(u.Path, "/") + "/v1/traces"
 	return u.String()
 }
+
+func parseOTLPHeaders(raw string) http.Header {
+	headers := http.Header{}
+	for _, pair := range strings.Split(raw, ",") {
+		pair = strings.TrimSpace(pair)
+		if pair == "" {
+			continue
+		}
+		name, value, ok := strings.Cut(pair, "=")
+		if !ok {
+			continue
+		}
+		name = strings.TrimSpace(name)
+		value = strings.TrimSpace(value)
+		if name == "" || value == "" {
+			continue
+		}
+		if decoded, err := url.QueryUnescape(value); err == nil {
+			value = decoded
+		}
+		headers.Add(name, value)
+	}
+	if len(headers) == 0 {
+		return nil
+	}
+	return headers
+}

internal/observability/browser_test.go

@@ -67,3 +67,35 @@ func TestBrowserTraceSampleRatio(t *testing.T) {
 		}
 	})
 }
+
+func TestBrowserTraceProxyHeaders(t *testing.T) {
+	t.Run("prefers explicit browser headers", func(t *testing.T) {
+		t.Setenv(browserTraceHeadersEnvVar, "X-OTLP-Shared-Token=browser-token")
+		t.Setenv("OTEL_EXPORTER_OTLP_TRACES_HEADERS", "X-OTLP-Shared-Token=trace-token")
+		t.Setenv("OTEL_EXPORTER_OTLP_HEADERS", "X-OTLP-Shared-Token=generic-token")
+		headers := BrowserTraceProxyHeaders()
+		if got := headers.Get("X-OTLP-Shared-Token"); got != "browser-token" {
+			t.Fatalf("BrowserTraceProxyHeaders() = %q, want explicit browser token", got)
+		}
+	})
+
+	t.Run("falls back to trace-specific and decodes values", func(t *testing.T) {
+		t.Setenv(browserTraceHeadersEnvVar, "")
+		t.Setenv("OTEL_EXPORTER_OTLP_TRACES_HEADERS", "Authorization=Bearer%20trace-token")
+		t.Setenv("OTEL_EXPORTER_OTLP_HEADERS", "")
+		headers := BrowserTraceProxyHeaders()
+		if got := headers.Get("Authorization"); got != "Bearer trace-token" {
+			t.Fatalf("BrowserTraceProxyHeaders() = %q, want decoded trace header", got)
+		}
+	})
+
+	t.Run("falls back to generic otlp headers", func(t *testing.T) {
+		t.Setenv(browserTraceHeadersEnvVar, "")
+		t.Setenv("OTEL_EXPORTER_OTLP_TRACES_HEADERS", "")
+		t.Setenv("OTEL_EXPORTER_OTLP_HEADERS", "X-OTLP-Shared-Token=generic-token")
+		headers := BrowserTraceProxyHeaders()
+		if got := headers.Get("X-OTLP-Shared-Token"); got != "generic-token" {
+			t.Fatalf("BrowserTraceProxyHeaders() = %q, want generic header", got)
+		}
+	})
+}