feat(otel): add OpenTelemetry ingest, query, and frontend traces UI

.github/workflows/rust-tests.yml

@@ -30,6 +30,9 @@ jobs:
       - name: Cache dependencies
         uses: Swatinem/rust-cache@v2
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install wasm-pack and Build WASM
         run: |
           cargo install wasm-pack
@@ -76,6 +79,9 @@ jobs:
       - name: Cache dependencies
         uses: Swatinem/rust-cache@v2
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install wasm-pack and Build WASM
         run: |
           cargo install wasm-pack
@@ -116,6 +122,9 @@ jobs:
           shared-key: test-build
           save-if: true
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install wasm-pack and Build WASM
         run: |
           cargo install wasm-pack
@@ -176,6 +185,7 @@ jobs:
               -p temps-email
               -p temps-analytics
               -p temps-analytics-events
+              -p temps-otel
 
     steps:
       - name: Checkout code
@@ -195,6 +205,9 @@ jobs:
           shared-key: test-build
           save-if: false
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install wasm-pack and Build WASM
         run: |
           cargo install wasm-pack
@@ -327,6 +340,9 @@ jobs:
           shared-key: test-build
           save-if: false
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
       - name: Install wasm-pack and Build WASM
         run: |
           cargo install wasm-pack

CHANGELOG.md

@@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- OpenTelemetry (OTel) ingest and query system (`temps-otel` crate) with OTLP/protobuf support for traces, metrics, and logs; header-based and path-based ingest routes; `tk_` API key and `dt_` deployment token authentication; `OtelRead`/`OtelWrite` permissions; TimescaleDB storage with hypertables; OpenAPI-documented query endpoints for traces, spans, metrics, and logs; web UI with filterable trace list, waterfall span visualization, and setup instructions
+- `deployment_id` field on deployment tokens, allowing OTel ingest to associate telemetry with specific deployments
+- `protobuf-compiler` installation in CI workflow for `temps-otel` proto compilation
 - PostgreSQL backup now runs `pg_dump` inside a disposable sidecar container (same image as the service) attached to the shared Docker network, eliminating OOM kills (exit code 137) that occurred when `pg_dumpall` was exec'd inside the live service container; TimescaleDB databases are supported via `--format=custom` with advisory circular-FK warnings suppressed
 - All preset providers (Next.js, Vite, Rsbuild, Docusaurus v1/v2, NestJS, Angular, Astro, Dockerfile, Nixpacks) are now registered in `PresetProviderRegistry::new()`; Dockerfile and Nixpacks are registered first to take detection precedence
 - Proxy now converts HTML responses to Markdown on the fly when clients send `Accept: text/markdown`, compatible with Cloudflare's Markdown for Agents standard; responses include `Content-Type: text/markdown`, `Vary: Accept`, and `X-Markdown-Tokens` headers; SSE, WebSocket, and responses over 2 MB pass through unchanged

CONTRIBUTING.md

@@ -18,12 +18,41 @@ Thank you for your interest in contributing to Temps. Whether you are reporting
 - **PostgreSQL** with TimescaleDB extension
 - **Bun** (for frontend development)
 - **Node.js** 18+
+- **protobuf compiler** (`protoc`) -- required by the `temps-otel` crate to compile OpenTelemetry `.proto` files
+- **wasm-pack** -- required to build the `temps-captcha-wasm` crate
+
+#### Installing protoc
+
+```bash
+# macOS
+brew install protobuf
+
+# Debian/Ubuntu
+sudo apt-get install -y protobuf-compiler
+
+# Fedora
+sudo dnf install -y protobuf-compiler
+
+# Or download from https://github.com/protocolbuffers/protobuf/releases
+```
+
+#### Installing wasm-pack
+
+```bash
+cargo install wasm-pack
+```
 
 ### Clone and Build
 
 ```bash
 git clone https://github.com/gotempsh/temps.git
 cd temps
+
+# Build the WASM captcha module (required before workspace compilation)
+cd crates/temps-captcha-wasm
+bun run build
+cd ../..
+
 cargo build --release
 ```
 
@@ -97,6 +126,7 @@ HTTP Handlers  ->  Service Layer  ->  Data Access (Sea-ORM)
 - `temps-proxy` -- reverse proxy with TLS/ACME support
 - `temps-auth` -- authentication and permission system
 - `temps-providers` -- external service providers (PostgreSQL, Redis, S3)
+- `temps-otel` -- OpenTelemetry ingest and query (OTLP/protobuf, requires `protoc`)
 
 ## Coding Standards
 
@@ -170,6 +200,7 @@ Pre-commit hooks run automatically on each commit to check formatting (`cargo fm
 - [ ] New functionality includes tests
 - [ ] Commit messages follow Conventional Commits
 - [ ] PR description explains the change
+- [ ] `CHANGELOG.md` updated under `[Unreleased]` (or add `skip-changelog` label)
 
 ## Good First Issues
 

Cargo.toml

@@ -51,6 +51,7 @@ members = [
     "crates/temps-vulnerability-scanner",
     "crates/temps-kv",
     "crates/temps-blob",
+    "crates/temps-otel",
     "crates/temps-environments",
     "crates/temps-screenshots",
     "crates/temps-embeddings",

crates/temps-auth/src/context.rs

@@ -4,6 +4,16 @@ use temps_entities::deployment_tokens::DeploymentTokenPermission;
 use temps_entities::users;
 use utoipa::ToSchema;
 
+/// Info extracted from a deployment token auth source.
+#[derive(Debug, Clone)]
+pub struct DeploymentTokenInfo {
+    pub project_id: i32,
+    pub environment_id: Option<i32>,
+    pub deployment_id: Option<i32>,
+    pub token_id: i32,
+    pub token_name: String,
+}
+
 // Simplified user schema for OpenAPI documentation
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct UserSchema {
@@ -37,6 +47,7 @@ pub enum AuthSource {
     DeploymentToken {
         project_id: i32,
         environment_id: Option<i32>,
+        deployment_id: Option<i32>,
         token_id: i32,
         token_name: String,
         permissions: Vec<DeploymentTokenPermission>,
@@ -65,6 +76,7 @@ pub enum AuthSourceSchema {
     DeploymentToken {
         project_id: i32,
         environment_id: Option<i32>,
+        deployment_id: Option<i32>,
         token_id: i32,
         token_name: String,
         permissions: Vec<String>,
@@ -152,6 +164,7 @@ impl AuthContext {
     pub fn new_deployment_token(
         project_id: i32,
         environment_id: Option<i32>,
+        deployment_id: Option<i32>,
         token_id: i32,
         token_name: String,
         permissions: Vec<DeploymentTokenPermission>,
@@ -161,6 +174,7 @@ impl AuthContext {
             source: AuthSource::DeploymentToken {
                 project_id,
                 environment_id,
+                deployment_id,
                 token_id,
                 token_name,
                 permissions: permissions.clone(),
@@ -266,15 +280,22 @@ impl AuthContext {
     }
 
     /// Get deployment token info if this is a deployment token auth
-    pub fn deployment_token_info(&self) -> Option<(i32, Option<i32>, i32, String)> {
+    pub fn deployment_token_info(&self) -> Option<DeploymentTokenInfo> {
         match &self.source {
             AuthSource::DeploymentToken {
                 project_id,
                 environment_id,
+                deployment_id,
                 token_id,
                 token_name,
                 ..
-            } => Some((*project_id, *environment_id, *token_id, token_name.clone())),
+            } => Some(DeploymentTokenInfo {
+                project_id: *project_id,
+                environment_id: *environment_id,
+                deployment_id: *deployment_id,
+                token_id: *token_id,
+                token_name: token_name.clone(),
+            }),
             _ => None,
         }
     }
@@ -287,6 +308,14 @@ impl AuthContext {
         }
     }
 
+    /// Get the deployment ID for deployment tokens
+    pub fn deployment_id(&self) -> Option<i32> {
+        match &self.source {
+            AuthSource::DeploymentToken { deployment_id, .. } => *deployment_id,
+            _ => None,
+        }
+    }
+
     /// Get the user, returning an error if this is a deployment token auth
     /// Use this for handlers that require a user
     pub fn require_user(&self) -> Result<&users::Model, &'static str> {