@aurostack/stacks 0.1.1 → 0.2.1

package/templates/node-worker/files/_gitignore

@@ -37,6 +37,7 @@ lerna-debug.log*
 .env
 .env.test
 .env.production
+.env.staging
 .npmrc
 docker-compose.dev.yaml
 

package/templates/node-worker/files/ecosystem.config.cjs

@@ -3,6 +3,8 @@ module.exports = {
 		{
 			name: 'collector',
 			script: 'dist/src/index.js',
+			// Preload src/instrumentation.ts (OpenTelemetry) before the worker's modules.
+			node_args: '--import ./dist/src/instrumentation.js',
 			watch: false,
 			autorestart: false,
 		}

package/templates/node-worker/files/package.json

@@ -24,10 +24,10 @@
 		}
 	},
 	"scripts": {
-		"dev": "tsx --conditions=development src/index.ts",
-		"dev:watch": "tsx watch --conditions=development src/index.ts",
+		"dev": "tsx --conditions=development --import ./src/instrumentation.ts src/index.ts",
+		"dev:watch": "tsx watch --conditions=development --import ./src/instrumentation.ts src/index.ts",
 		"build": "tsc",
-		"start": "node dist/src/index.js",
+		"start": "node --import ./dist/src/instrumentation.js dist/src/index.js",
 		"secrets": "tsx --conditions=development .bin/secrets",
 		"db:generate": "tsx --conditions=development ./.bin/db.ts",
 		"typecheck": "tsc --noEmit",
@@ -37,11 +37,30 @@
 		"format:check": "prettier --check ."
 	},
 	"dependencies": {
+		"@opentelemetry/api": "^1.9.1",
+		"@opentelemetry/auto-instrumentations-node": "^0.80.0",
+		"@opentelemetry/core": "^2.11.0",
+		"@opentelemetry/exporter-logs-otlp-proto": "^0.222.0",
+		"@opentelemetry/exporter-metrics-otlp-proto": "^0.222.0",
+		"@opentelemetry/exporter-trace-otlp-proto": "^0.222.0",
+		"@opentelemetry/instrumentation": "^0.222.0",
+		"@opentelemetry/resources": "^2.11.0",
+		"@opentelemetry/sdk-logs": "^0.222.0",
+		"@opentelemetry/sdk-metrics": "^2.11.0",
+		"@opentelemetry/sdk-node": "^0.222.0",
+		"@opentelemetry/semantic-conventions": "^1.43.0",
 		"@paralleldrive/cuid2": "^3.3.0",
 		"@prisma/adapter-pg": "^7.8.0",
 		"@prisma/client": "^7.8.0",
-		"bullmq": "^5.79.2",
+		"@prisma/instrumentation": "^7.10.0",
+		"@temporalio/activity": "^1.24.0",
+		"@temporalio/worker": "^1.24.0",
+		"@temporalio/workflow": "^1.24.0",
+		"bullmq": "^6.3.9",
+		"bullmq-otel": "^2.0.1",
 		"dotenv": "^17.4.2",
+		"import-in-the-middle": "^3.5.1",
+		"ioredis": "^5.4.1",
 		"moment": "^2.30.1",
 		"pino": "^10.3.1",
 		"puppeteer": "^25.3.0",
@@ -53,6 +72,7 @@
 		"@types/node": "^26.1.0",
 		"@types/shelljs": "^0.10.0",
 		"@types/yargs": "^17.0.35",
+		"dotenv-cli": "^7.2.1",
 		"eslint": "^10.6.0",
 		"eslint-config-prettier": "^10.1.8",
 		"globals": "^17.7.0",

package/templates/node-worker/files/src/config.ts

@@ -16,6 +16,16 @@ interface Redis {
 	password?: string | undefined;
 }
 
+// @feature:start temporal
+interface Temporal {
+	address: string;
+	namespace: string;
+	taskQueue: string;
+	/** PEM; all empty means plaintext (the local dev server). */
+	tls: { ca: string; cert: string; key: string };
+}
+// @feature:end
+
 // @feature:start browser
 interface Puppeteer {
 	executablePath: string;
@@ -26,6 +36,7 @@ interface Config {
 	app: App;
 	database: Database;
 	redis: Redis;
+	temporal: Temporal; // @feature temporal
 	puppeteer: Puppeteer; // @feature browser
 }
 
@@ -43,6 +54,18 @@ const config: Config = {
 		user: process.env.REDIS_USER,
 		password: process.env.REDIS_PASSWORD
 	},
+	// @feature:start temporal
+	temporal: {
+		address: process.env.TEMPORAL_ADDRESS || 'localhost:7233',
+		namespace: process.env.TEMPORAL_NAMESPACE || 'default',
+		taskQueue: process.env.TEMPORAL_TASK_QUEUE || 'main',
+		tls: {
+			ca: process.env.TEMPORAL_TLS_CA ?? '',
+			cert: process.env.TEMPORAL_TLS_CERT ?? '',
+			key: process.env.TEMPORAL_TLS_KEY ?? ''
+		}
+	},
+	// @feature:end
 	// @feature:start browser
 	// Empty means "let Puppeteer use its bundled Chromium". In a slim container
 	// image you install Chromium separately and point this at it.

package/templates/node-worker/files/src/index.ts

@@ -1,7 +1,43 @@
 import logger from '#app/logger.js';
 import * as Workers from '#app/workers/index.js'; // @feature queue
+import { createTemporalWorker } from '#app/temporal/worker.js'; // @feature temporal
 
-(() => {
-	logger.info('Worker started');
-	void Workers.example.run(); // @feature queue
-})();
+// Everything still running when a shutdown starts: each entry settles once its
+// worker has stopped taking new work and finished what it had.
+const running: Promise<unknown>[] = [];
+
+logger.info('Worker started');
+
+// @feature:start queue
+// Add each new BullMQ worker to this list: it is started here and closed on
+// shutdown (close() stops fetching and waits for the active job).
+const queueWorkers = [Workers.example];
+for (const worker of queueWorkers) void worker.run();
+// @feature:end
+
+// @feature:start temporal
+// Temporal handles SIGINT/SIGTERM itself: it stops polling and lets running
+// tasks finish, and then run() resolves.
+const temporal = createTemporalWorker().then((worker) => worker.run());
+temporal.catch((err: unknown) => {
+	logger.fatal({ err }, 'Temporal worker failed');
+	process.exit(1);
+});
+running.push(temporal);
+// @feature:end
+
+let stopping = false;
+const shutdown = (signal: NodeJS.Signals) => {
+	// `on` rather than `once`, and idempotent: the telemetry preload re-raises
+	// the signal after flushing, and that second delivery must not kill the
+	// process while jobs are still finishing.
+	if (stopping) return;
+	stopping = true;
+	logger.info({ signal }, 'Shutting down');
+	void Promise.allSettled([
+		...queueWorkers.map((worker) => worker.close()), // @feature queue
+		...running
+	]).then(() => process.exit(0));
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);

package/templates/node-worker/files/src/instrumentation.ts

@@ -0,0 +1,110 @@
+/**
+ * Preloaded with `node --import` ahead of the worker (see the start scripts,
+ * ecosystem.config.cjs and the Dockerfile), for anything that has to run before
+ * the worker's own modules load.
+ */
+// @feature:start telemetry
+// OpenTelemetry: traces, logs and metrics over OTLP. It has to be preloaded
+// because ESM links the whole import graph before running any of it, so
+// patching modules from inside src/index.ts would be too late. Connection
+// settings are in src/telemetry/config.ts; without them this does nothing.
+import fs from 'node:fs';
+import path from 'node:path';
+import { register } from 'node:module';
+import { resolveTelemetry } from '#app/telemetry/config.js';
+
+// config.ts loads .env later; the connection settings are needed now.
+// Already-set variables are never overridden.
+try {
+	process.loadEnvFile();
+} catch {
+	// no .env — the environment is configured some other way
+}
+
+const telemetry = resolveTelemetry();
+
+if (telemetry.enabled) {
+	register('import-in-the-middle/hook.mjs', import.meta.url);
+
+	// Imported only when enabled, so a worker without telemetry never loads the SDK.
+	const [
+		{ NodeSDK },
+		{ getNodeAutoInstrumentations },
+		{ OTLPTraceExporter },
+		{ OTLPLogExporter },
+		{ OTLPMetricExporter },
+		{ BatchLogRecordProcessor },
+		{ PeriodicExportingMetricReader },
+		{ resourceFromAttributes },
+		{ ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION },
+		{ PrismaInstrumentation }
+	] = await Promise.all([
+		import('@opentelemetry/sdk-node'),
+		import('@opentelemetry/auto-instrumentations-node'),
+		import('@opentelemetry/exporter-trace-otlp-proto'),
+		import('@opentelemetry/exporter-logs-otlp-proto'),
+		import('@opentelemetry/exporter-metrics-otlp-proto'),
+		import('@opentelemetry/sdk-logs'),
+		import('@opentelemetry/sdk-metrics'),
+		import('@opentelemetry/resources'),
+		import('@opentelemetry/semantic-conventions'),
+		import('@prisma/instrumentation')
+	]);
+
+	const { urls, headers } = telemetry;
+	// Explicit URLs always come with their headers; without them the SDK reads
+	// OTEL_EXPORTER_OTLP_* itself.
+	const exporter = (url?: string) => (url && headers ? { url, headers } : {});
+
+	const sdk = new NodeSDK({
+		resource: resourceFromAttributes({
+			[ATTR_SERVICE_NAME]: telemetry.serviceName,
+			[ATTR_SERVICE_VERSION]: packageVersion(),
+			'deployment.environment.name': telemetry.environment
+		}),
+		traceExporter: new OTLPTraceExporter(exporter(urls?.traces)),
+		logRecordProcessors: [
+			new BatchLogRecordProcessor({
+				exporter: new OTLPLogExporter(exporter(urls?.logs))
+			})
+		],
+		metricReaders: [
+			new PeriodicExportingMetricReader({
+				exporter: new OTLPMetricExporter(exporter(urls?.metrics)),
+				exportIntervalMillis:
+					Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) || 60_000
+			})
+		],
+		instrumentations: [
+			getNodeAutoInstrumentations({
+				// Every file read and DNS lookup as a span is noise, not signal.
+				'@opentelemetry/instrumentation-fs': { enabled: false },
+				'@opentelemetry/instrumentation-dns': { enabled: false },
+				'@opentelemetry/instrumentation-net': { enabled: false }
+			}),
+			new PrismaInstrumentation()
+		]
+	});
+	sdk.start();
+
+	// Flush what is buffered on the way out, then let the signal do what it
+	// would have done without a handler.
+	for (const signal of ['SIGTERM', 'SIGINT'] as const) {
+		process.once(signal, () => {
+			void sdk.shutdown().finally(() => process.kill(process.pid, signal));
+		});
+	}
+}
+
+function packageVersion(): string | undefined {
+	try {
+		const file = path.join(process.cwd(), 'package.json');
+		return (JSON.parse(fs.readFileSync(file, 'utf8')) as { version?: string })
+			.version;
+	} catch {
+		return undefined;
+	}
+}
+// @feature:end
+
+export {};

package/templates/node-worker/files/src/logger.ts

@@ -1,3 +1,4 @@
+import { createRequire } from 'node:module';
 import pino, { stdTimeFunctions, levels } from 'pino';
 import config from '#app/config.js';
 
@@ -26,10 +27,22 @@ const PINO_CONSOLE_TARGET_PROD = {
 	}
 };
 
+// pino-pretty is a dev dependency, so the production image doesn't have it.
+// Pretty-print only where it's installed; anywhere else (an image run with an
+// APP_ENV other than production, say) log JSON to stdout instead of crashing.
+const prettyAvailable = (() => {
+	try {
+		createRequire(import.meta.url).resolve('pino-pretty');
+		return true;
+	} catch {
+		return false;
+	}
+})();
+
 const logger = pino({
 	level: config.app.logLevel,
 	transport:
-		config.app.env === 'production'
+		config.app.env === 'production' || !prettyAvailable
 			? { targets: [PINO_CONSOLE_TARGET_PROD, PINO_FILE_TARGET] }
 			: { targets: [PINO_CONSOLE_TARGET, PINO_FILE_TARGET] },
 	base: {

package/templates/node-worker/files/src/telemetry/config.ts

@@ -0,0 +1,61 @@
+/**
+ * Where telemetry goes, resolved from the environment before anything else
+ * loads (instrumentation is preloaded with `node --import`, ahead of config.ts).
+ *
+ * Two ways to connect, in order of precedence:
+ * - standard OpenTelemetry variables (OTEL_EXPORTER_OTLP_ENDPOINT and friends),
+ *   which the SDK reads itself, for any OTLP backend;
+ * - OPENOBSERVE_URL + OPENOBSERVE_ORG + OPENOBSERVE_TOKEN, from which the
+ *   OpenObserve endpoint and auth header are built.
+ * With neither, telemetry stays off and the SDK is never started.
+ */
+export interface TelemetryConfig {
+	enabled: boolean;
+	serviceName: string;
+	environment: string;
+	/** Signal URLs; undefined means the SDK resolves them from OTEL_* vars. */
+	urls?: { traces: string; logs: string; metrics: string };
+	headers?: Record<string, string>;
+}
+
+type Env = Record<string, string | undefined>;
+
+export function resolveTelemetry(
+	env: Env = process.env,
+	defaultServiceName = 'collector'
+): TelemetryConfig {
+	const serviceName = env.OTEL_SERVICE_NAME || defaultServiceName;
+	const environment = env.APP_ENV || 'development';
+	const off = { enabled: false, serviceName, environment };
+
+	if (env.OTEL_SDK_DISABLED === 'true') return off;
+	if (env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+		return { enabled: true, serviceName, environment };
+	}
+
+	const {
+		OPENOBSERVE_URL: url,
+		OPENOBSERVE_ORG: org,
+		OPENOBSERVE_TOKEN: token
+	} = env;
+	if (!url || !org || !token) return off;
+
+	// OTLP/HTTP endpoints live under /api/<org>; an org ingestion token
+	// authenticates as `<org>:<token>`. Logs and traces land in the stream
+	// named here — one per service keeps an API and its workers apart.
+	const base = `${url.replace(/\/+$/, '')}/api/${org}`;
+	return {
+		enabled: true,
+		serviceName,
+		environment,
+		urls: {
+			traces: `${base}/v1/traces`,
+			logs: `${base}/v1/logs`,
+			metrics: `${base}/v1/metrics`
+		},
+		headers: {
+			Authorization: `Basic ${Buffer.from(`${org}:${token}`).toString('base64')}`,
+			'stream-name': env.OPENOBSERVE_STREAM || serviceName
+		}
+	};
+}

package/templates/node-worker/files/src/temporal/activities/index.ts

@@ -0,0 +1,14 @@
+import { Context, log } from '@temporalio/activity';
+
+/**
+ * Activities do the real work: I/O, database writes, calls to other services.
+ * Temporal retries a failed activity on its own (per the retry policy set in
+ * the workflow), so throw on failure and make each one safe to run twice.
+ */
+export async function greet(name: string): Promise<string> {
+	log.info('Greeting', { name });
+	// Stand-in for real work. The context's sleep is cancellation-aware: it
+	// rejects if the workflow cancels this activity.
+	await Context.current().sleep(100);
+	return `Hello, ${name}!`;
+}

package/templates/node-worker/files/src/temporal/worker.ts

@@ -0,0 +1,84 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+	DefaultLogger,
+	NativeConnection,
+	Runtime,
+	Worker,
+	type LogLevel,
+	type TLSConfig
+} from '@temporalio/worker';
+import config from '#app/config.js';
+import logger from '#app/logger.js';
+import * as activities from './activities/index.js';
+
+const here = fileURLToPath(import.meta.url);
+
+const PINO_LEVEL = {
+	TRACE: 'trace',
+	DEBUG: 'debug',
+	INFO: 'info',
+	WARN: 'warn',
+	ERROR: 'error'
+} as const satisfies Record<LogLevel, string>;
+
+/**
+ * Connects to Temporal and returns a worker for TEMPORAL_TASK_QUEUE, running
+ * the workflows in ./workflows and the activities in ./activities. Temporal's
+ * own logs go through pino, like everything else here.
+ */
+export async function createTemporalWorker(): Promise<Worker> {
+	Runtime.install({
+		logger: new DefaultLogger(runtimeLogLevel(), ({ level, message, meta }) =>
+			logger[PINO_LEVEL[level]](meta ?? {}, message)
+		)
+	});
+
+	const { address, namespace, taskQueue, tls } = config.temporal;
+	const connection = await NativeConnection.connect({
+		address,
+		tls: temporalTls(tls)
+	});
+
+	return Worker.create({
+		connection,
+		namespace,
+		taskQueue,
+		// Workflows run in a sandbox from their own bundle, built from this
+		// entry point when the worker starts: index.ts under tsx, index.js in dist.
+		workflowsPath: path.join(
+			path.dirname(here),
+			'workflows',
+			`index${path.extname(here)}`
+		),
+		activities
+	});
+}
+
+/**
+ * mTLS settings from PEM strings; none at all means plaintext (`null`).
+ * Escaped `\n` are unescaped, so a certificate fits on one line of an env
+ * file.
+ */
+export function temporalTls({
+	ca,
+	cert,
+	key
+}: typeof config.temporal.tls): TLSConfig | null {
+	if (!ca && !cert && !key) return null;
+	if (!cert || !key) {
+		throw new Error('TEMPORAL_TLS_CERT and TEMPORAL_TLS_KEY must be set together');
+	}
+	const pem = (value: string) => Buffer.from(value.replace(/\\n/g, '\n'));
+	return {
+		...(ca ? { serverRootCACertificate: pem(ca) } : {}),
+		clientCertPair: { crt: pem(cert), key: pem(key) }
+	};
+}
+
+/** LOG_LEVEL as Temporal's level; pino's fatal/silent map to ERROR. */
+function runtimeLogLevel(): LogLevel {
+	const level = config.app.logLevel.toUpperCase();
+	if (level in PINO_LEVEL) return level as LogLevel;
+	return level === 'FATAL' || level === 'SILENT' ? 'ERROR' : 'INFO';
+}

package/templates/node-worker/files/src/temporal/workflows/index.ts

@@ -0,0 +1,23 @@
+import { proxyActivities, sleep } from '@temporalio/workflow';
+import type * as activities from '../activities/index.js';
+
+/**
+ * Workflows orchestrate; activities act. This code is replayed from history to
+ * rebuild state, so it must be deterministic: no I/O, no Date.now() or
+ * Math.random() of its own (the SDK makes both replay-safe), no imports that
+ * touch the network or filesystem. Anything like that belongs in an activity.
+ *
+ * Every function exported from this module is a workflow type, started by name
+ * (see the API's TemporalService).
+ */
+const { greet } = proxyActivities<typeof activities>({
+	startToCloseTimeout: '1 minute',
+	retry: { maximumAttempts: 5 }
+});
+
+export async function example(input: { name: string }): Promise<string> {
+	// A durable timer: survives worker restarts and deploys, for as long as
+	// you like ('30 days' works the same way).
+	await sleep('1 second');
+	return await greet(input.name);
+}

package/templates/node-worker/files/src/utils/worker.ts

@@ -1,4 +1,5 @@
 import { Worker, type WorkerOptions, type Processor } from 'bullmq';
+import { BullMQOtel } from 'bullmq-otel';
 import config from '#app/config.js';
 
 export const createWorker = <
@@ -13,13 +14,20 @@ export const createWorker = <
 	const connection = {
 		host: config.redis.host,
 		port: config.redis.port,
-		user: config.redis.user,
+		username: config.redis.user,
 		password: config.redis.password
 	};
 
 	const defaultOptions = {
 		concurrency: 1,
-		autorun: false
+		autorun: false,
+		// Job spans and metrics; a no-op unless the OpenTelemetry SDK is running
+		// (see src/instrumentation.ts).
+		telemetry: new BullMQOtel({
+			tracerName: 'collector',
+			meterName: 'collector',
+			enableMetrics: true
+		})
 	};
 
 	const options = !opts

package/templates/node-worker/template.json

@@ -47,7 +47,49 @@
 			],
 			"packageJson": {
 				"dependencies": [
-					"bullmq"
+					"bullmq",
+					"bullmq-otel",
+					"ioredis"
+				]
+			}
+		},
+		"temporal": {
+			"title": "Temporal worker",
+			"description": "Runs durable workflows and activities from src/temporal (an example of each included) on TEMPORAL_TASK_QUEUE, next to the BullMQ consumers. Pair with the API's temporal feature, which starts them.",
+			"files": [
+				"src/temporal/**"
+			],
+			"packageJson": {
+				"dependencies": [
+					"@temporalio/activity",
+					"@temporalio/worker",
+					"@temporalio/workflow"
+				]
+			}
+		},
+		"telemetry": {
+			"title": "OpenTelemetry → OpenObserve",
+			"description": "Traces, logs and metrics pushed over OTLP (set OPENOBSERVE_URL/ORG/TOKEN, or any OTEL_* backend). Off at runtime until connected.",
+			"default": true,
+			"files": [
+				"src/telemetry/**"
+			],
+			"packageJson": {
+				"dependencies": [
+					"@opentelemetry/api",
+					"@opentelemetry/core",
+					"@opentelemetry/sdk-node",
+					"@opentelemetry/auto-instrumentations-node",
+					"@opentelemetry/exporter-trace-otlp-proto",
+					"@opentelemetry/exporter-logs-otlp-proto",
+					"@opentelemetry/exporter-metrics-otlp-proto",
+					"@opentelemetry/sdk-logs",
+					"@opentelemetry/sdk-metrics",
+					"@opentelemetry/resources",
+					"@opentelemetry/semantic-conventions",
+					"@opentelemetry/instrumentation",
+					"import-in-the-middle",
+					"@prisma/instrumentation"
 				]
 			}
 		},

package/templates/py-worker/files/.env.example

@@ -18,3 +18,31 @@ REDIS_HOST="localhost"
 REDIS_PORT=6379
 REDIS_USER=
 REDIS_PASSWORD=""
+# @feature:start telemetry
+
+# OpenTelemetry → OpenObserve: traces, logs and metrics. Leave empty and
+# telemetry stays off. Per project: OPENOBSERVE_ORG is the organization
+# identifier, OPENOBSERVE_TOKEN its ingestion token (IAM → Ingestion Tokens).
+# Any other OTLP backend: set OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS instead.
+OPENOBSERVE_URL="https://o2.aurostack.co"
+OPENOBSERVE_ORG=""
+OPENOBSERVE_TOKEN=""
+OTEL_SERVICE_NAME="acme-py"
+# @feature:end
+
+# @feature:start temporal
+# Temporal: this process also runs the workflows in temporal/. Locally, the
+# API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In
+# production, the server address, the project's namespace and its mTLS client
+# certificate (plus the CA that signed the server's), as PEM. Escaped \n are
+# accepted, so each fits on one line.
+TEMPORAL_ADDRESS="localhost:7233"
+TEMPORAL_NAMESPACE="default"
+# The queue this worker polls. Its own, not the Node worker's: a workflow task
+# handed to a worker that doesn't know the type fails and retries. Start
+# Python workflows on this queue.
+TEMPORAL_TASK_QUEUE="python"
+TEMPORAL_TLS_CA=""
+TEMPORAL_TLS_CERT=""
+TEMPORAL_TLS_KEY=""
+# @feature:end

package/templates/py-worker/files/config.py

@@ -30,11 +30,30 @@ class Redis:
     password: str | None
 
 
+# @feature:start temporal
+@dataclass
+class TemporalTLS:
+    # PEM; all empty means plaintext (the local dev server).
+    ca: str
+    cert: str
+    key: str
+
+
+@dataclass
+class Temporal:
+    address: str
+    namespace: str
+    task_queue: str
+    tls: TemporalTLS
+# @feature:end
+
+
 @dataclass
 class Env:
     path: ProjectPath
     db: DB
     redis: Redis
+    temporal: Temporal  # @feature temporal
 
 
 class Config:
@@ -67,7 +86,19 @@ class Config:
                     port=int(os.getenv('REDIS_PORT', 0)),
                     user=os.getenv('REDIS_USER'),
                     password=os.getenv('REDIS_PASSWORD')
-                )
+                ),
+                # @feature:start temporal
+                temporal=Temporal(
+                    address=os.getenv('TEMPORAL_ADDRESS') or 'localhost:7233',
+                    namespace=os.getenv('TEMPORAL_NAMESPACE') or 'default',
+                    task_queue=os.getenv('TEMPORAL_TASK_QUEUE') or 'python',
+                    tls=TemporalTLS(
+                        ca=os.getenv('TEMPORAL_TLS_CA', ''),
+                        cert=os.getenv('TEMPORAL_TLS_CERT', ''),
+                        key=os.getenv('TEMPORAL_TLS_KEY', '')
+                    )
+                ),
+                # @feature:end
             )
 
             cls._instance = instance