From 9ee5a94d50e2d79a8b37c5d58bd7c3d7f3b06a32 Mon Sep 17 00:00:00 2001 From: damocles Date: Tue, 23 Jun 2026 13:44:51 +0200 Subject: [PATCH] fix(#1930): headersCredential str type (no nix-store copy) + route traces to otlp --- nix/templates/harness-base.nix | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix index 59f29d0d..dae0e750 100644 --- a/nix/templates/harness-base.nix +++ b/nix/templates/harness-base.nix @@ -207,17 +207,23 @@ in }; headersCredential = lib.mkOption { - type = lib.types.nullOr lib.types.path; + # `str`, not `path`: a `path`-typed *relative* literal (e.g. + # `./otel-headers`) is hash-copied into the world-readable nix store + # at eval time, which would defeat the whole point of this option. + # Keep it a string and require an absolute runtime path so the secret + # is only ever read from disk by systemd at start, never nix-stored. + type = lib.types.nullOr lib.types.str; default = null; example = "/run/secrets/otel-headers"; description = '' - Path to an operator-provided secret file whose contents become - `OTEL_EXPORTER_OTLP_HEADERS` (e.g. + Absolute path to an operator-provided secret file whose contents + become `OTEL_EXPORTER_OTLP_HEADERS` (e.g. `Authorization=Bearer `). Loaded via systemd `LoadCredential` into the unit-private credential store at runtime, so the token is never copied into the nix store or - exposed in the process argv. Leave null if the endpoint needs no - auth header. + exposed in the process argv. Must be an absolute path (systemd + `LoadCredential` requires one). Leave null if the endpoint needs + no auth header. ''; }; @@ -1712,6 +1718,9 @@ in CLAUDE_CODE_ENABLE_TELEMETRY = "1"; OTEL_METRICS_EXPORTER = "otlp"; OTEL_LOGS_EXPORTER = "otlp"; + # Route traces to OTLP too so any spans Claude Code emits land + # at the configured collector rather than a default exporter. + OTEL_TRACES_EXPORTER = "otlp"; OTEL_EXPORTER_OTLP_PROTOCOL = otel.protocol; OTEL_EXPORTER_OTLP_ENDPOINT = otel.endpoint; };