Observability: optional OpenObserve/OTLP diagnostics via config #173

New issue

Open

opened 2026-08-26 07:47:15 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-26 07:47:15 +00:00

(Migrated from github.com)

Coordinate with https://github.com/lost-rob0t/starintel-server/issues/128.

Add optional operator-controlled observability/diagnostics for Quasar UI using OpenTelemetry-compatible instrumentation, with OpenObserve as a supported backend.

Client security constraint

A browser bundle MUST NOT contain OpenObserve Basic Auth credentials or other reusable ingestion secrets. If export is enabled, send through an operator-controlled same-origin/server-side ingest proxy or another credential-safe OTLP path.

Requirements

Add optional observability config to the UI init/runtime configuration.
Default OFF; absent config means no exporter, no tracking requests, and no required observability backend.
Support safe service/environment/build identity and individually enabled signals where the browser SDK supports them.
Instrument app startup, API/WebSocket boundaries, graph/render performance, major UI errors, and request latency using bounded-cardinality attributes.
Do not export document contents, target data, search text, auth tokens, URLs containing secrets, or user-entered investigation data by default.
Exporter failure is silent/non-fatal to the UI.
Tests prove disabled mode emits zero observability requests.
Tests prove configured routing uses the safe proxy/endpoint and redaction rules.
Document OpenObserve-compatible setup and the credential boundary.

Docs: https://openobserve.ai/docs/ingestion/

Exclusion

This is operator deployment diagnostics. Do not add anonymous product analytics, fingerprinting, persistent installation IDs, or StarIntel-owned telemetry collection in this issue.

Coordinate with https://github.com/lost-rob0t/starintel-server/issues/128. Add optional operator-controlled observability/diagnostics for Quasar UI using OpenTelemetry-compatible instrumentation, with OpenObserve as a supported backend. ## Client security constraint A browser bundle MUST NOT contain OpenObserve Basic Auth credentials or other reusable ingestion secrets. If export is enabled, send through an operator-controlled same-origin/server-side ingest proxy or another credential-safe OTLP path. ## Requirements - [ ] Add optional observability config to the UI init/runtime configuration. - [ ] Default OFF; absent config means no exporter, no tracking requests, and no required observability backend. - [ ] Support safe service/environment/build identity and individually enabled signals where the browser SDK supports them. - [ ] Instrument app startup, API/WebSocket boundaries, graph/render performance, major UI errors, and request latency using bounded-cardinality attributes. - [ ] Do not export document contents, target data, search text, auth tokens, URLs containing secrets, or user-entered investigation data by default. - [ ] Exporter failure is silent/non-fatal to the UI. - [ ] Tests prove disabled mode emits zero observability requests. - [ ] Tests prove configured routing uses the safe proxy/endpoint and redaction rules. - [ ] Document OpenObserve-compatible setup and the credential boundary. Docs: https://openobserve.ai/docs/ingestion/ ## Exclusion This is operator deployment diagnostics. Do not add anonymous product analytics, fingerprinting, persistent installation IDs, or StarIntel-owned telemetry collection in this issue.