@aurostack/stacks 0.1.1 → 0.2.1

package/templates/py-worker/files/requirements.txt

@@ -4,15 +4,31 @@ certifi==2026.5.20
 charset-normalizer==3.4.7
 cuid2==2.0.1
 dotenv==0.9.9
+googleapis-common-protos==1.75.4
 greenlet==3.5.1
 idna==3.18
 msgpack==1.1.2
+nexus-rpc==1.4.0
+opentelemetry-api==1.45.0
+opentelemetry-exporter-http-transport==0.66b0
+opentelemetry-exporter-otlp-common==0.66b0
+opentelemetry-exporter-otlp-proto-common==1.45.0
+opentelemetry-exporter-otlp-proto-http==1.45.0
+opentelemetry-instrumentation==0.66b0
+opentelemetry-instrumentation-redis==0.66b0
+opentelemetry-proto==1.45.0
+opentelemetry-sdk==1.45.0
+opentelemetry-semantic-conventions==0.66b0
+protobuf==7.36.2
 psycopg2-binary==2.9.12
 python-dotenv==1.2.2
 redis==6.4.0
 requests==2.34.2
 semver==3.0.4
 SQLAlchemy==2.0.50
+temporalio==1.33.0
+types-protobuf==7.35.1.20260906
 typing_extensions==4.15.0
 urllib3==2.7.0
 websockets==16.0
+wrapt==2.5.0

package/templates/py-worker/files/temporal/activities.py

@@ -0,0 +1,13 @@
+from temporalio import activity
+
+
+@activity.defn
+async def greet(name: str) -> str:
+    """
+    Activities do the real work: I/O, database writes, calls to other
+    services. Temporal retries a failed activity on its own (per the retry
+    policy set in the workflow), so raise on failure and make each one safe to
+    run twice.
+    """
+    activity.logger.info("Greeting %s", name)
+    return f"Hello, {name}!"

package/templates/py-worker/files/temporal/workflows.py

@@ -0,0 +1,38 @@
+from dataclasses import dataclass
+from datetime import timedelta
+
+from temporalio import workflow
+from temporalio.common import RetryPolicy
+
+# Workflows run in a sandbox that re-imports modules for each run; activities
+# are only referenced here, never executed, so pass them straight through.
+with workflow.unsafe.imports_passed_through():
+    from temporal.activities import greet
+
+
+@dataclass
+class ExampleInput:
+    name: str
+
+
+@workflow.defn(name="example")
+class Example:
+    """
+    Workflows orchestrate; activities act. This code is replayed from history
+    to rebuild state, so it must be deterministic: no I/O, no datetime.now() or
+    random of its own (use workflow.now() and workflow.random()), nothing that
+    touches the network or filesystem. Anything like that belongs in an
+    activity.
+    """
+
+    @workflow.run
+    async def run(self, input: ExampleInput) -> str:
+        # A durable timer: survives worker restarts and deploys, for as long
+        # as you like (timedelta(days=30) works the same way).
+        await workflow.sleep(timedelta(seconds=1))
+        return await workflow.execute_activity(
+            greet,
+            input.name,
+            start_to_close_timeout=timedelta(minutes=1),
+            retry_policy=RetryPolicy(maximum_attempts=5),
+        )

package/templates/py-worker/files/utils/db.py

@@ -1,37 +1,22 @@
 """
-@File: db.py
-@Version: 1.0
+Database access over SQLAlchemy, with the connection settings from config
+(DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME).
 
-Database wrapper to manage PostgreSQL connections using SQLAlchemy
+Usage:
 
-DB('my_database') will create a connection to the specified PostgreSQL database
-using credentials from the .env file (user, password, host, port).
+from utils.db import DB
 
-Usage example:
-
-from utils import DB
-
-db = DB('my_database')
-
-# Read data
-df = db.read_sql('SELECT * FROM my_table')
-
-# Write data
-db.write_sql(df, 'my_table', if_exists='append')
-
-# Use engine or session without having to create a new connection or variable
-db.session.query(...)
-db.engine.execute(...)
-# ... perform operations ...
+db = DB()
+rows = db.session.execute(select(MyModel)).scalars().all()
 db.session.commit()
-
-# Close the connection when done
 db.close()
 
+The models under models/ are hand-written to match the API's Prisma schema:
+the API owns the tables and their migrations.
 """
 
 from sqlalchemy import create_engine
-from sqlalchemy.engine import Connection
+from sqlalchemy.engine import URL, Connection
 from sqlalchemy.orm import sessionmaker, Session
 
 from config import CONFIG
@@ -40,9 +25,17 @@ from config import CONFIG
 class DB:
     def __init__(self):
         db = CONFIG.env.db
-        self._engine = create_engine(
-            f"postgresql://{db.user}:{db.password}@{db.host}:{db.port}/{db.name}"
-        ).connect()
+        # URL.create escapes the credentials, so a password with @, / or : in it
+        # can't break the connection string.
+        url = URL.create(
+            "postgresql",
+            username=db.user,
+            password=db.password,
+            host=db.host,
+            port=db.port,
+            database=db.name,
+        )
+        self._engine = create_engine(url).connect()
         Session = sessionmaker(bind=self.engine)
         self._session = Session()
 

package/templates/py-worker/files/utils/logger.py

@@ -2,7 +2,8 @@
 @File: logger.py
 @Version: 1.1
 
-Logger wrapper to manage logs in one place with log rotate
+Logger wrapper to manage logs in one place with log rotate. Records also go to
+stdout, so `docker logs` shows them.
 
 Logger('daily') will create daily.log file in the logs folder
 Logger('my.daily') will create my.daily.log file in the logs folder
@@ -35,6 +36,7 @@ except Exception as e:
 import logging
 import os
 import pathlib
+import sys
 from logging import handlers
 
 from config import CONFIG
@@ -49,7 +51,7 @@ class Logger(object):
         if module is not None:
             directory = f"{directory}/{module}"
             logger_name = f"{module}_{name}"
-            pathlib.Path(directory).mkdir(parents=True, exist_ok=True)
+        pathlib.Path(directory).mkdir(parents=True, exist_ok=True)
 
         filename = f"{directory}/{name}.log"
         formatter = "%(asctime)s %(levelname)-10s %(message)s"
@@ -74,6 +76,11 @@ class Logger(object):
             handler.setFormatter(formatter)
             self.logger.addHandler(handler)
 
+            console = logging.StreamHandler(sys.stdout)
+            console.setLevel(logging.INFO)
+            console.setFormatter(formatter)
+            self.logger.addHandler(console)
+
     def debug(self, message, exc_info=None):
         self.__call(self.logger.debug, message, exc_info)
 

package/templates/py-worker/files/utils/telemetry.py

@@ -0,0 +1,154 @@
+"""
+OpenTelemetry: traces, logs and metrics over OTLP, built for OpenObserve.
+
+Two ways to connect, in order of precedence:
+- the standard OpenTelemetry variables (OTEL_EXPORTER_OTLP_ENDPOINT and
+  friends), which the exporters read themselves, for any OTLP backend;
+- OPENOBSERVE_URL + OPENOBSERVE_ORG + OPENOBSERVE_TOKEN, from which the
+  OpenObserve endpoints and the org ingestion-token header are built.
+With neither, setup_telemetry() does nothing and job_span() is a no-op.
+"""
+import base64
+import logging
+import os
+from contextlib import contextmanager
+from dataclasses import dataclass, field
+
+from opentelemetry import trace
+
+DEFAULT_SERVICE_NAME = "acme-py"
+
+_providers: list = []
+
+
+@dataclass
+class TelemetryConfig:
+    enabled: bool
+    service_name: str
+    environment: str
+    # Signal URLs; empty means the exporters resolve them from OTEL_* vars.
+    urls: dict = field(default_factory=dict)
+    headers: dict = field(default_factory=dict)
+
+
+def resolve_telemetry(env=os.environ) -> TelemetryConfig:
+    service_name = env.get("OTEL_SERVICE_NAME") or DEFAULT_SERVICE_NAME
+    environment = env.get("APP_ENV") or "development"
+    off = TelemetryConfig(False, service_name, environment)
+
+    if env.get("OTEL_SDK_DISABLED") == "true":
+        return off
+    if env.get("OTEL_EXPORTER_OTLP_ENDPOINT"):
+        return TelemetryConfig(True, service_name, environment)
+
+    url, org, token = (
+        env.get("OPENOBSERVE_URL"),
+        env.get("OPENOBSERVE_ORG"),
+        env.get("OPENOBSERVE_TOKEN"),
+    )
+    if not (url and org and token):
+        return off
+
+    # OTLP/HTTP endpoints live under /api/<org>; an org ingestion token
+    # authenticates as `<org>:<token>`. Logs and traces land in the stream
+    # named here, one per service.
+    base = f"{url.rstrip('/')}/api/{org}"
+    credentials = base64.b64encode(f"{org}:{token}".encode()).decode()
+    return TelemetryConfig(
+        True,
+        service_name,
+        environment,
+        urls={
+            "traces": f"{base}/v1/traces",
+            "logs": f"{base}/v1/logs",
+            "metrics": f"{base}/v1/metrics",
+        },
+        headers={
+            "Authorization": f"Basic {credentials}",
+            "stream-name": env.get("OPENOBSERVE_STREAM") or service_name,
+        },
+    )
+
+
+def setup_telemetry() -> bool:
+    """Start exporting, if connection settings are present. Call once, first."""
+    config = resolve_telemetry()
+    if not config.enabled:
+        return False
+
+    # Imported here so a worker without telemetry never loads the SDK.
+    from opentelemetry._logs import set_logger_provider
+    from opentelemetry.exporter.otlp.proto.http._log_exporter import OTLPLogExporter
+    from opentelemetry.exporter.otlp.proto.http.metric_exporter import OTLPMetricExporter
+    from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+    from opentelemetry.instrumentation.redis import RedisInstrumentor
+    from opentelemetry.metrics import set_meter_provider
+    from opentelemetry.sdk._logs import LoggerProvider, LoggingHandler
+    from opentelemetry.sdk._logs.export import BatchLogRecordProcessor
+    from opentelemetry.sdk.metrics import MeterProvider
+    from opentelemetry.sdk.metrics.export import PeriodicExportingMetricReader
+    from opentelemetry.sdk.resources import Resource
+    from opentelemetry.sdk.trace import TracerProvider
+    from opentelemetry.sdk.trace.export import BatchSpanProcessor
+
+    def exporter_args(signal: str) -> dict:
+        if not config.urls:
+            return {}
+        return {"endpoint": config.urls[signal], "headers": config.headers}
+
+    resource = Resource.create(
+        {
+            "service.name": config.service_name,
+            "deployment.environment.name": config.environment,
+        }
+    )
+
+    tracer_provider = TracerProvider(resource=resource)
+    tracer_provider.add_span_processor(
+        BatchSpanProcessor(OTLPSpanExporter(**exporter_args("traces")))
+    )
+    trace.set_tracer_provider(tracer_provider)
+
+    logger_provider = LoggerProvider(resource=resource)
+    logger_provider.add_log_record_processor(
+        BatchLogRecordProcessor(OTLPLogExporter(**exporter_args("logs")))
+    )
+    set_logger_provider(logger_provider)
+    # Every utils.logger.Logger propagates to the root logger.
+    logging.getLogger().addHandler(LoggingHandler(logger_provider=logger_provider))
+
+    meter_provider = MeterProvider(
+        resource=resource,
+        metric_readers=[
+            PeriodicExportingMetricReader(
+                OTLPMetricExporter(**exporter_args("metrics"))
+            )
+        ],
+    )
+    set_meter_provider(meter_provider)
+
+    RedisInstrumentor().instrument()
+    _providers.extend([tracer_provider, logger_provider, meter_provider])
+    return True
+
+
+def shutdown_telemetry() -> None:
+    """Flush whatever is buffered. Safe to call when telemetry is off."""
+    for provider in _providers:
+        provider.shutdown()
+
+
+@contextmanager
+def job_span(queue_name: str, job):
+    """One span per job, so each job is its own trace in OpenObserve."""
+    tracer = trace.get_tracer("worker")
+    with tracer.start_as_current_span(
+        f"process {queue_name}",
+        attributes={"messaging.system": "bullmq", "messaging.destination.name": queue_name, "bullmq.job.id": str(job.id)},
+    ) as span:
+        try:
+            yield span
+        except Exception as error:
+            span.record_exception(error)
+            span.set_status(trace.Status(trace.StatusCode.ERROR, str(error)))
+            raise

package/templates/py-worker/files/utils/temporal.py

@@ -0,0 +1,55 @@
+from temporalio.client import Client, TLSConfig
+from temporalio.worker import Worker
+
+from config import CONFIG, TemporalTLS
+from temporal.activities import greet
+from temporal.workflows import Example
+
+
+def temporal_tls(tls: TemporalTLS) -> TLSConfig | bool:
+    """
+    mTLS settings from PEM strings; none at all means plaintext (False).
+    Escaped \\n are unescaped, so a certificate fits on one line of an env file.
+    """
+    if not (tls.ca or tls.cert or tls.key):
+        return False
+    if not (tls.cert and tls.key):
+        raise ValueError("TEMPORAL_TLS_CERT and TEMPORAL_TLS_KEY must be set together")
+
+    def pem(value: str) -> bytes:
+        return value.replace("\\n", "\n").encode()
+
+    return TLSConfig(
+        server_root_ca_cert=pem(tls.ca) if tls.ca else None,
+        client_cert=pem(tls.cert),
+        client_private_key=pem(tls.key),
+    )
+
+
+async def create_temporal_worker() -> Worker:
+    """
+    Connect to Temporal and build a worker for TEMPORAL_TASK_QUEUE, running the
+    workflows and activities in temporal/. Register new ones in the lists below.
+    """
+    settings = CONFIG.env.temporal
+    interceptors = []
+    # @feature:start telemetry
+    # A span per workflow and activity, continuing the trace of whatever
+    # started the workflow; a no-op while telemetry is off.
+    from temporalio.contrib.opentelemetry import TracingInterceptor
+
+    interceptors.append(TracingInterceptor())
+    # @feature:end
+
+    client = await Client.connect(
+        settings.address,
+        namespace=settings.namespace,
+        tls=temporal_tls(settings.tls),
+        interceptors=interceptors,
+    )
+    return Worker(
+        client,
+        task_queue=settings.task_queue,
+        workflows=[Example],
+        activities=[greet],
+    )

package/templates/py-worker/files/utils/worker.py

@@ -3,8 +3,9 @@ from bullmq import Worker, Job
 from urllib.parse import urlparse, quote, urlencode
 
 from config import CONFIG, Redis
-from utils.db import DB
+from utils.db import DB  # @feature database
 from utils.logger import Logger
+from utils.telemetry import job_span  # @feature telemetry
 
 
 def build_redis_url(options: Redis):
@@ -39,9 +40,19 @@ def create_worker(queue_name: str, process_function: Callable, concurrency: int
         An instance of BullMQ Worker.
     """
     connection = build_redis_url(CONFIG.env.redis)
+
+    processor = process_function
+    # @feature:start telemetry
+    async def traced(job: Job, token: str):
+        with job_span(queue_name, job):
+            return await process_function(job, token)
+
+    processor = traced
+    # @feature:end
+
     worker = Worker(
         queue_name,
-        process_function,
+        processor,
         {
             "connection": connection,
             "autorun": True,
@@ -73,7 +84,7 @@ class JobUtil:
             await self._job.updateProgress(progress)
         await self._job.log(message)
 
-    async def finalize(self, db: DB | None = None):
+    async def finalize(self, db: "DB | None" = None):
         if db:
             db.close()
         await self._job.updateProgress(100)

package/templates/py-worker/files/worker.py

@@ -4,6 +4,8 @@ import asyncio
 import signal
 from utils.logger import Logger
 from utils.worker import create_worker
+from utils.telemetry import setup_telemetry, shutdown_telemetry  # @feature telemetry
+from utils.temporal import create_temporal_worker  # @feature temporal
 
 # import worker processes
 from workers.hello.process import hello_process
@@ -11,6 +13,7 @@ logger = Logger("worker")
 
 
 async def main():
+    setup_telemetry()  # @feature telemetry
     logger.info("Starting Python 3.14 Worker...")
     shutdown_event = asyncio.Event()
     loop = asyncio.get_running_loop()
@@ -27,6 +30,12 @@ async def main():
 
     # Add workers
     hello = create_worker("hello", hello_process)
+    # @feature:start temporal
+    temporal_worker = await create_temporal_worker()
+    temporal_run = asyncio.create_task(temporal_worker.run())
+    # If the Temporal worker stops on its own (a fatal error), stop everything.
+    temporal_run.add_done_callback(lambda _: shutdown_event.set())
+    # @feature:end
 
     logger.info("Workers started and waiting for jobs.")
     try:
@@ -35,7 +44,14 @@ async def main():
         logger.info("Cleaning up workers...")
         # Close workers gracefully
         await hello.close()
+        # @feature:start temporal
+        # Stops polling and waits for running activities to finish.
+        if not temporal_run.done():
+            await temporal_worker.shutdown()
+        await temporal_run
+        # @feature:end
         logger.info("Workers shut down successfully.")
+        shutdown_telemetry()  # @feature telemetry
 
 if __name__ == "__main__":
     asyncio.run(main())

package/templates/py-worker/template.json

@@ -55,6 +55,42 @@
 			"files": [
 				".forgejo/**"
 			]
+		},
+		"telemetry": {
+			"title": "OpenTelemetry → OpenObserve",
+			"description": "Traces, logs and metrics over OTLP (set OPENOBSERVE_URL/ORG/TOKEN, or any OTEL_* backend), with a span per job and Redis instrumentation. Off at runtime until connected.",
+			"default": true,
+			"files": [
+				"utils/telemetry.py"
+			],
+			"requirements": [
+				"googleapis-common-protos",
+				"opentelemetry-api",
+				"opentelemetry-exporter-http-transport",
+				"opentelemetry-exporter-otlp-common",
+				"opentelemetry-exporter-otlp-proto-common",
+				"opentelemetry-exporter-otlp-proto-http",
+				"opentelemetry-instrumentation",
+				"opentelemetry-instrumentation-redis",
+				"opentelemetry-proto",
+				"opentelemetry-sdk",
+				"opentelemetry-semantic-conventions",
+				"protobuf",
+				"wrapt"
+			]
+		},
+		"temporal": {
+			"title": "Temporal worker",
+			"description": "Runs durable workflows and activities from temporal/ (an example of each included) on its own TEMPORAL_TASK_QUEUE, next to the BullMQ consumers, with a span per workflow and activity when telemetry is on. Pair with the API's temporal feature, which starts them.",
+			"files": [
+				"utils/temporal.py",
+				"temporal/**"
+			],
+			"requirements": [
+				"nexus-rpc",
+				"temporalio",
+				"types-protobuf"
+			]
 		}
 	},
 	"hooks": [

package/templates/react-app/derive.sh

@@ -52,7 +52,7 @@ done
 
 echo "==> flattening packages -> src/shared"
 mkdir -p "$DST/src/shared"
-for pkg in ui api auth layouts hooks types; do
+for pkg in ui api auth layouts hooks types telemetry; do
 	cp -r "$SRC/packages/$pkg/src" "$DST/src/shared/$pkg"
 done
 # The brand tokens live in the config package in the monorepo because three
@@ -94,6 +94,7 @@ find "$DST/src" -type f \( -name '*.ts' -o -name '*.tsx' -o -name '*.css' \) -pr
 		-e "s#@acme/auth#@/shared/auth#g" \
 		-e "s#@acme/layouts#@/shared/layouts#g" \
 		-e "s#@acme/hooks#@/shared/hooks#g" \
+		-e "s#@acme/telemetry#@/shared/telemetry#g" \
 		-e "s#@acme/types#@/shared/types#g"
 
 # The auth screens moved one level deeper than their components and lib, so

package/templates/react-app/files/.bin/secrets.js

@@ -1,4 +1,5 @@
 import { execSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
 
 // Pulls this app's env from Infisical into the matching .env file.
 //
@@ -42,6 +43,11 @@ const env = normalizeEnv(parseEnvArg());
 const envFile = ENV_FILES[env];
 
 console.log(`Fetching secrets (${env}) -> ${envFile}...`);
-execSync(`infisical export --projectId="${PROJECT_ID}" --path="${SECRET_PATH}" --env=${env} > ${envFile}`, {
-	stdio: 'inherit'
+// Export first and write only on success: a shell `>` redirect would empty
+// the existing file before infisical had the chance to fail. execSync throws
+// (and the process exits non-zero) when infisical fails.
+const output = execSync(`infisical export --projectId="${PROJECT_ID}" --path="${SECRET_PATH}" --env=${env}`, {
+	stdio: ['inherit', 'pipe', 'inherit']
 });
+writeFileSync(envFile, output);
+console.log(`Wrote ${envFile}`);

package/templates/react-app/files/.env.example

@@ -11,6 +11,17 @@ PORT='3000'
 # Needed when you reach the dev server through a tunnel or a wildcard DNS name.
 VITE_APP_ALLOWED_HOSTS=''
 
+# @feature:start telemetry
+# OpenObserve browser monitoring (RUM): page views, errors, slow requests, and
+# trace headers on API calls. Leave empty and it stays off. The client token is
+# a RUM token (OpenObserve → Ingestion → RUM): write-only and meant to ship in
+# the bundle — never the backend's ingestion token.
+# The instance must list this app's origin in ZO_CORS_ALLOWED_ORIGINS.
+VITE_OPENOBSERVE_URL='https://o2.aurostack.co'
+VITE_OPENOBSERVE_ORG=''
+VITE_OPENOBSERVE_CLIENT_TOKEN=''
+# @feature:end
+
 # @feature:start marketing
 # The canonical public origin — the ONE origin that may be indexed. Must match
 # PRODUCTION_ORIGIN in src/features/seo/routes.ts. Anything else (previews,

package/templates/react-app/files/.forgejo/workflows/build-and-push.yml

@@ -47,6 +47,9 @@ jobs:
             VITE_APP_API_URL=${{ secrets.VITE_APP_API_URL }}
             VITE_APP_SITE_URL=${{ secrets.VITE_APP_SITE_URL }}
             VITE_APP_SUPPORT_EMAIL=${{ secrets.VITE_APP_SUPPORT_EMAIL }}
+            VITE_OPENOBSERVE_URL=${{ secrets.VITE_OPENOBSERVE_URL }} # @feature telemetry
+            VITE_OPENOBSERVE_ORG=${{ secrets.VITE_OPENOBSERVE_ORG }} # @feature telemetry
+            VITE_OPENOBSERVE_CLIENT_TOKEN=${{ secrets.VITE_OPENOBSERVE_CLIENT_TOKEN }} # @feature telemetry
           tags: |
             ${{ secrets.REGISTRY }}/${{ steps.tag.outputs.OWNER }}/web:latest
             ${{ secrets.REGISTRY }}/${{ steps.tag.outputs.OWNER }}/web:${{ steps.tag.outputs.TAG }}

package/templates/react-app/files/Dockerfile

@@ -35,6 +35,16 @@ ARG VITE_APP_SUPPORT_EMAIL
 ENV VITE_APP_API_URL=$VITE_APP_API_URL \
 	VITE_APP_SITE_URL=$VITE_APP_SITE_URL \
 	VITE_APP_SUPPORT_EMAIL=$VITE_APP_SUPPORT_EMAIL
+# @feature:start telemetry
+# Browser monitoring. Leave unset and the bundle ships with telemetry off. The
+# client token is a RUM token, write-only and meant to be public.
+ARG VITE_OPENOBSERVE_URL
+ARG VITE_OPENOBSERVE_ORG
+ARG VITE_OPENOBSERVE_CLIENT_TOKEN
+ENV VITE_OPENOBSERVE_URL=$VITE_OPENOBSERVE_URL \
+	VITE_OPENOBSERVE_ORG=$VITE_OPENOBSERVE_ORG \
+	VITE_OPENOBSERVE_CLIENT_TOKEN=$VITE_OPENOBSERVE_CLIENT_TOKEN
+# @feature:end
 
 # Fail loudly rather than silently producing a bundle with `undefined` URLs baked
 # in — that failure is invisible until the app 404s at runtime.

package/templates/react-app/files/_gitignore

@@ -22,6 +22,7 @@ dev-dist/
 .env.*.local
 .env.test
 .env.production
+.env.staging
 
 # editor / os
 .DS_Store

package/templates/react-app/files/build.sh

@@ -38,7 +38,9 @@ read_var() {
 }
 
 BUILD_ARGS=""
-for VAR in VITE_APP_API_URL VITE_APP_SITE_URL VITE_APP_SUPPORT_EMAIL; do
+VARS="VITE_APP_API_URL VITE_APP_SITE_URL VITE_APP_SUPPORT_EMAIL"
+VARS="$VARS VITE_OPENOBSERVE_URL VITE_OPENOBSERVE_ORG VITE_OPENOBSERVE_CLIENT_TOKEN" # @feature telemetry
+for VAR in $VARS; do
 	VALUE="$(read_var "$VAR")"
 	[ -n "$VALUE" ] && BUILD_ARGS="$BUILD_ARGS --build-arg $VAR=$VALUE"
 done

package/templates/react-app/files/package.json

@@ -26,6 +26,8 @@
 	},
 	"dependencies": {
 		"@fontsource-variable/inter": "^5.3.0",
+		"@openobserve/browser-logs": "^0.4.3",
+		"@openobserve/browser-rum": "^0.4.3",
 		"@radix-ui/react-label": "^2.1.7",
 		"@radix-ui/react-popover": "^1.1.21",
 		"@radix-ui/react-select": "^2.3.4",

package/templates/react-app/files/src/lib/env.ts

@@ -26,3 +26,13 @@ export const APP_ORIGIN = window.location.origin;
  */
 export const SITE_URL = (env.VITE_APP_SITE_URL as string | undefined) ?? '';
 // @feature:end
+
+// @feature:start telemetry
+/** OpenObserve browser monitoring (see @/shared/telemetry); unset keeps it off. */
+export const TELEMETRY = {
+	url: env.VITE_OPENOBSERVE_URL as string | undefined,
+	org: env.VITE_OPENOBSERVE_ORG as string | undefined,
+	clientToken: env.VITE_OPENOBSERVE_CLIENT_TOKEN as string | undefined,
+	environment: env.MODE
+};
+// @feature:end