feat: improve tracing (#13)

Author: coadler

.dockerignore

@@ -0,0 +1,5 @@
+# Ignore everything
+*
+
+# Allow the tunnel binary
+!/build/tunneld

Dockerfile

@@ -11,6 +11,6 @@ LABEL \
 RUN adduser -D -u 1000 tunneld
 USER tunneld
 
-COPY tunneld /
+COPY ./build/tunneld /
 
 CMD ["/tunneld"]

Makefile

@@ -49,17 +49,11 @@ build/tunneld.tag: build/tunneld
 	version="$(VERSION)"
 	tag="ghcr.io/coder/wgtunnel/tunneld:$${version//+/-}"
 
-	# make a temp directory, copy the binary into it, and build the image.
-	temp_dir=$$(mktemp -d)
-	cp build/tunneld "$$temp_dir"
-
 	docker build \
 		--file Dockerfile \
 		--build-arg "WGTUNNEL_VERSION=$(VERSION)" \
-		--tag "$$tag" \
-		"$$temp_dir"
+		--tag "$$tag"
 
-	rm -rf "$$temp_dir"
 	echo "$$tag" > "$@"
 
 test:

cmd/tunneld/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"io"
 	"log"
 	"net/http"
@@ -121,6 +122,11 @@ func main() {
 				Usage:   "The Honeycomb team ID to send tracing data to. If not specified, tracing will not be shipped anywhere.",
 				EnvVars: []string{"TUNNELD_TRACING_HONEYCOMB_TEAM"},
 			},
+			&cli.StringFlag{
+				Name:    "tracing-service-id",
+				Usage:   "The service ID to annotate all traces with that uniquely identifies this deployment.",
+				EnvVars: []string{"TUNNELD_TRACING_SERVICE_ID"},
+			},
 		},
 		Action: runApp,
 	}
@@ -146,6 +152,7 @@ func runApp(ctx *cli.Context) error {
 		realIPHeader           = ctx.String("real-ip-header")
 		pprofListenAddress     = ctx.String("pprof-listen-address")
 		tracingHoneycombTeam   = ctx.String("tracing-honeycomb-team")
+		tracingServiceID       = ctx.String("tracing-service-id")
 	)
 	if baseURL == "" {
 		return xerrors.New("base-url is required. See --help for more information.")
@@ -173,12 +180,12 @@ func runApp(ctx *cli.Context) error {
 	if tracingHoneycombTeam != "" {
 		exp, err := newHoneycombExporter(ctx.Context, tracingHoneycombTeam)
 		if err != nil {
-			return xerrors.Errorf("failed to create honeycomb telemetry exporter: %w", err)
+			return xerrors.Errorf("create honeycomb telemetry exporter: %w", err)
 		}
 
 		// Create a new tracer provider with a batch span processor and the otlp
 		// exporter.
-		tp := newTraceProvider(exp)
+		tp := newTraceProvider(exp, tracingServiceID)
 		otel.SetTracerProvider(tp)
 		otel.SetTextMapPropagator(
 			propagation.NewCompositeTextMapPropagator(
@@ -210,7 +217,7 @@ func runApp(ctx *cli.Context) error {
 
 	if wireguardKeyFile != "" {
 		_, err = os.Stat(wireguardKeyFile)
-		if xerrors.Is(err, os.ErrNotExist) {
+		if errors.Is(err, os.ErrNotExist) {
 			logger.Info(ctx.Context, "generating private key to file", slog.F("path", wireguardKeyFile))
 			key, err := tunnelsdk.GeneratePrivateKey()
 			if err != nil {

cmd/tunneld/tracing.go

@@ -7,8 +7,10 @@ import (
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	semconv "go.opentelemetry.io/otel/semconv/v1.4.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.11.0"
 	"google.golang.org/grpc/credentials"
+
+	"github.com/coder/wgtunnel/buildinfo"
 )
 
 func newHoneycombExporter(ctx context.Context, teamID string) (*otlptrace.Exporter, error) {
@@ -24,10 +26,12 @@ func newHoneycombExporter(ctx context.Context, teamID string) (*otlptrace.Export
 	return otlptrace.New(ctx, client)
 }
 
-func newTraceProvider(exp *otlptrace.Exporter) *sdktrace.TracerProvider {
+func newTraceProvider(exp *otlptrace.Exporter, serviceID string) *sdktrace.TracerProvider {
 	rsc := resource.NewWithAttributes(
 		semconv.SchemaURL,
 		semconv.ServiceNameKey.String("WireguardTunnel"),
+		semconv.ServiceInstanceIDKey.String(serviceID),
+		semconv.ServiceVersionKey.String(buildinfo.Version()),
 	)
 
 	return sdktrace.NewTracerProvider(

compose/.env.example

@@ -0,0 +1,2 @@
+CLOUDFLARE_TOKEN=
+HONEYCOMB_TEAM=

compose/.gitignore

@@ -0,0 +1 @@
+.env

compose/Makefile

@@ -0,0 +1,17 @@
+# Use a single bash shell for each job, and immediately exit on failure
+SHELL := bash
+.SHELLFLAGS := -ceu
+.ONESHELL:
+
+# Don't print the commands in the file unless you specify VERBOSE. This is
+# essentially the same as putting "@" at the start of each line.
+ifndef VERBOSE
+.SILENT:
+endif
+
+up:
+	pushd ..
+		make -B build
+	popd
+	docker compose -p wgtunnel up --build
+.PHONY: up

compose/caddy/Dockerfile

@@ -0,0 +1,12 @@
+ARG CADDY_VERSION=2.6.4
+FROM caddy:${CADDY_VERSION}-builder AS builder
+
+RUN xcaddy build \
+    --with github.com/lucaslorentz/caddy-docker-proxy/v2 \
+    --with github.com/caddy-dns/cloudflare
+
+FROM caddy:${CADDY_VERSION}
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+
+CMD ["caddy", "docker-proxy"]

compose/docker-compose.yml

@@ -0,0 +1,47 @@
+version: "3.9"
+services:
+  caddy:
+    build: ./caddy
+    ports:
+      - 8080:80
+      - 4443:443
+    environment:
+      - CADDY_INGRESS_NETWORKS=caddy
+    networks:
+      - caddy
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - caddy_data:/data
+    restart: unless-stopped
+
+  tunnel:
+    build: ..
+    restart: always
+    ports:
+      - 55551:55551/udp
+    networks:
+      - caddy
+    environment:
+      TUNNELD_LISTEN_ADDRESS: "0.0.0.0:8080"
+      TUNNELD_BASE_URL: "https://local.try.coder.app:4443"
+      TUNNELD_WIREGUARD_ENDPOINT: "local.try.coder.app:55551"
+      TUNNELD_WIREGUARD_PORT: "55551"
+      TUNNELD_WIREGUARD_KEY_FILE: "/home/tunneld/wg.key"
+      TUNNELD_WIREGUARD_MTU: "1280"
+      TUNNELD_WIREGUARD_SERVER_IP: "fcca::1"
+      TUNNELD_WIREGUARD_NETWORK_PREFIX: "fcca::/16"
+      TUNNELD_REAL_IP_HEADER: "X-Forwarded-For"
+      TUNNELD_PPROF_LISTEN_ADDRESS: "127.0.0.1:6060"
+      TUNNELD_TRACING_HONEYCOMB_TEAM: "${HONEYCOMB_TEAM}"
+      TUNNELD_TRACING_INSTANCE_ID: "local"
+    labels:
+      caddy: "local.try.coder.app, *.local.try.coder.app"
+      caddy.reverse_proxy: "{{upstreams 8080}}"
+      caddy.tls.dns: cloudflare ${CLOUDFLARE_TOKEN}
+
+networks:
+  caddy:
+    external: true
+
+volumes:
+  caddy_data: {}