shared: auto-emit Langfuse trace+span per HTTP request — closes OPEN #2 · 68d9e554b0 - golangLAKEHOUSE

shared: auto-emit Langfuse trace+span per HTTP request — closes OPEN #2

Adds langfuseMiddleware in internal/shared so every daemon's
shared.Run gets free production-traffic trace visibility when
LANGFUSE_URL + LANGFUSE_PUBLIC_KEY + LANGFUSE_SECRET_KEY are set.
Same env names + file shape as the multi_coord_stress driver, so
operators ship one /etc/lakehouse/langfuse.env across the deploy.

Wiring is auth-gated: middleware runs INSIDE the RequireAuth group,
so 401s from credential-stuffing don't pollute traces. /health is
exempt so LB probes don't either. Missing env vars → nil client →
middleware is a passthrough no-op (fail-open per ADR-005 5.1).

Bundled deploy:
- langfuse.env.example template (mode 0640, root:lakehouse)
- 11 systemd units gain `EnvironmentFile=-/etc/lakehouse/langfuse.env`
  (leading - so missing file = OK)
- REPLICATION.md bootstrap section documents setup

Tests (4): nil passthrough, /health bypass, real-request emission,
status-writer wrapping. All green.

STATE_OF_PLAY OPEN list: 5 rows → 4 rows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

This commit is contained in:

root

2026-04-30 19:55:42 -05:00

co-authored by

Claude Opus 4.7

parent 5a3364f539

commit 68d9e554b0

17 changed files with 311 additions and 5 deletions

									
										deploy/systemd/lakehouse-embedd.service
									
		+1
		
												View File
												
				@@ -18,6 +18,7 @@ Restart=on-failure

				RestartSec=5

				EnvironmentFile=-/etc/lakehouse/auth.env

				EnvironmentFile=-/etc/lakehouse/langfuse.env

				NoNewPrivileges=true

				ProtectSystem=strict