mirror of
https://github.com/hanzoai/o11y.git
synced 2026-10-15 12:58:33 +00:00
zeekayandHanzo Dev
3e4cc43959
iamidentn auto-provisioned the o11y organization for a Hanzo IAM session and stopped there, so the tenant had no members. o11y stores per-user rows — a dashboard's author, a saved view, a preference — keyed by user id, and GET /v1/o11y/users/me reads one by (orgID, claims.UserID). A gateway-asserted session had no such row, so the console's app-wide identity provider answered user_not_found on the very first call, and a person the edge had already authenticated could not open a single Observe view. Provisioning the org and not the user is not a smaller grant; it is a tenant nobody can enter. The row is a PROJECTION of the IAM identity, not an identity: keyed by IAM's own subject, no password, no invite, no SSO domain, nothing authenticates against it. It exists so the foreign keys have something to point at. types.NewUserWithID is the twin of the existing NewOrganizationWithID and for the same reason — a row minted with a generated id is a SECOND identity for the same human, and every lookup keyed on the asserted subject misses it. The founding grant moves onto user.Setter.CreateUser, which performs the Hanzo IAM grant AND the local user_role rows in one call. It was stated here as a bare Grant, which wrote the IAM side only, so GetRolesByUserID — reading o11y's own table — would have returned nothing and the console would have rendered a person with no role. One call, one place, both halves. The address is load-bearing at this seam and nowhere else: a user row must carry one and o11y must not invent an address for a person, so a session asserting an org and a subject with no X-User-Email is refused HERE, where the reason is legible, instead of seating a half-built identity that fails later and further away. Frontend: pre-flight ASKS THE SERVER whether this browser has a session instead of asking localStorage whether it once had one. With identity terminated at the edge the browser holds a session cookie and is never handed a token to write, so localStorage is empty for a fully authenticated person and the app bounced them to its own /login — a login page in front of a session that already exists. Only the server sees the headers, so only the server can answer. Raw fetch on purpose, the same seam as TenantProvider: this runs before the identity the axios interceptors assume, so a 401 must be an ANSWER, not a trigger for the rotate-then-logout chain. Co-authored-by: Hanzo Dev <[email protected]>
o11y
Metrics, traces and logs for the Hanzo platform, in one place. OpenTelemetry on the wire, Hanzo Datastore — an OLAP column store — on disk.
Run it
cd deploy/docker
docker compose up -d
Open http://localhost:8080. deploy/install.sh does the same thing with a few more
checks, and deploy/docker/docker-compose.ha.yaml is the multi-replica variant.
Send it data
The collector listens for OTLP on 4317 (gRPC) and 4318 (HTTP). Point any
OpenTelemetry SDK or the OTel Collector at it:
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
Traces, metrics and logs land in Datastore and show up under APM, Logs, Traces, Metrics and Exceptions in the UI. Dashboards and alerting are built on the same queries.
What it is for
Every Hanzo service emits here. It is multi-tenant by design: queries scope by org from
the X-Org-Id claim in the JWT, on every panel. It sits behind gateway like the other
Hanzo subsystems, and mounts under the unified cloud binary per HIP-0106.
instrumented app -> OTLP -> o11y collector
|
Hanzo Datastore
|
APM | logs | traces | metrics
|
queries scoped by X-Org-Id from JWT
|
dashboards | alerting | exceptions
Docs
deploy/README.md— every deployment path in detaildocs/— configuration, contributing notes, the OTel demo walkthroughLLM.md— architecture and the conventions that apply in this repoCONTRIBUTING.md
Lineage
Forked from SigNoz (MIT Expat, copyright
2020–present SigNoz Inc.), synced to upstream main at commit 3e6339019. The import
history was squashed, so the root commit here is a Hanzo branding commit rather than
upstream's history. See NOTICE.
License
MIT — see LICENSE.