Move telemetry configuration into YAML

README.md

@@ -22,10 +22,13 @@ TLS is not terminated or inspected. HTTPS remains end-to-end encrypted between t
 
 ```sh
 cargo build
+HERMES_CONFIG_PATH=examples/hermes.yaml cargo run
+
+# The CLI flag takes precedence over HERMES_CONFIG_PATH:
 cargo run -- --config examples/hermes.yaml
 ```
 
-The default configuration path is `hermes.yaml`. The included example listens on `127.0.0.1:8080` and allows only localhost clients.
+Configuration path precedence is `--config`, then `HERMES_CONFIG_PATH`, then `hermes.yaml`. This is the only environment variable read by Hermes; logging and OpenTelemetry are also configured in YAML. The included example listens on `127.0.0.1:8080` and allows only localhost clients.
 
 ```sh
 # Plain HTTP
@@ -42,6 +45,22 @@ listen_addr: "127.0.0.1:8080"
 connect_timeout_ms: 10000
 upstream_timeout_ms: 30000
 
+telemetry:
+  service_name: "hermes"
+  log_filter: "info"
+  resource_attributes:
+    deployment.environment.name: "development"
+  otlp:
+    endpoint: "http://127.0.0.1:4318"
+    timeout_ms: 10000
+    headers: {}
+    traces:
+      sample_ratio: 1.0
+    metrics:
+      export_interval_ms: 60000
+      temporality: "cumulative"
+    logs: {}
+
 acl:
   default_action: deny
 
@@ -68,13 +87,14 @@ acl:
 | `listen_addr` | `127.0.0.1:8080` | Downstream listen address |
 | `connect_timeout_ms` | `10000` | TCP connection timeout for `CONNECT` and the HTTP connector |
 | `upstream_timeout_ms` | `30000` | Time limit for receiving upstream HTTP response headers |
+| `telemetry` | see OpenTelemetry below | Logging, resource, and OTLP configuration |
 | `acl.default_action` | `deny` | Action when no rule matches |
 | `acl.users` | empty | Usernames and salted SHA-256 password hashes |
 | `acl.rules` | empty | Ordered ACL rules |
 
 Configuration is loaded and validated at startup. Unknown fields, invalid CIDRs or domain patterns, duplicate or empty rules, references to unknown users, and unsupported password hashes prevent startup. Restart Hermes to apply configuration changes.
 
-`RUST_LOG` controls log filtering and defaults to `info`, for example `RUST_LOG=hermes=debug`.
+`telemetry.log_filter` controls log filtering and defaults to `info`, for example `log_filter: "hermes=debug"`. `RUST_LOG` is not read.
 
 ### ACL rules
 
@@ -157,15 +177,29 @@ Password verification is synchronous and inexpensive, and digest comparisons are
 
 ## OpenTelemetry
 
-Hermes exports traces, metrics, and logs independently to an OpenTelemetry Collector using OTLP/HTTP (protobuf). Exporters use the standard OpenTelemetry environment variables.
+Hermes exports traces, metrics, and logs independently to an OpenTelemetry Collector using OTLP/HTTP (protobuf). All settings come from `telemetry` in YAML; `OTEL_*` environment variables are not read.
 
-```sh
-export OTEL_SERVICE_NAME=hermes
-export OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318
-cargo run -- --config examples/hermes.yaml
+```yaml
+telemetry:
+  service_name: "hermes"
+  log_filter: "info"
+  resource_attributes:
+    deployment.environment.name: "production"
+  otlp:
+    endpoint: "http://127.0.0.1:4318"
+    timeout_ms: 10000
+    headers: {}
+    traces:
+      sample_ratio: 1.0
+    metrics:
+      export_interval_ms: 60000
+      temporality: "cumulative"
+    logs: {}
 ```
 
-Signal-specific settings such as `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`, and `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT` are also supported. Standard OTLP headers, timeouts, and trace sampling environment variables can be used.
+The common `otlp.endpoint` is a base URL; Hermes appends `/v1/traces`, `/v1/metrics`, and `/v1/logs`. Set `otlp.traces.endpoint`, `otlp.metrics.endpoint`, or `otlp.logs.endpoint` to override a signal with an exact full URL. OTLP headers may contain credentials, so protect the configuration file and never log its contents.
+
+Trace `sample_ratio` must be between 0 and 1. Metric `temporality` accepts `cumulative` or `delta`. Timeouts and export intervals must be greater than zero.
 
 Traces and logs are batched, metrics are exported periodically, and all providers are flushed during shutdown. An unavailable collector does not prevent the proxy from forwarding traffic, although exporter errors may appear in stdout logs.