feat(observability): add Tempo trace backend

compose.yml

@@ -561,6 +561,25 @@ services:
       - no-new-privileges:true
     restart: unless-stopped
 
+  tempo:
+    image: grafana/tempo:2.7.2
+    container_name: tempo
+    networks:
+      - observability
+    volumes:
+      - ./infra/tempo/tempo.yml:/etc/tempo/config.yaml:ro
+      - tempo_data:/var/tempo
+    command: -config.file=/etc/tempo/config.yaml
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3200/ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+
   promtail:
     image: grafana/promtail:latest
     container_name: promtail
@@ -761,4 +780,5 @@ volumes:
   act_runner_data:
   loki_data:
   prometheus_data:
+  tempo_data:
   grafana_data:

infra/tempo/tempo.yml

@@ -0,0 +1,24 @@
+server:
+  http_listen_port: 3200
+
+distributor:
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+        http:
+          endpoint: 0.0.0.0:4318
+
+ingester:
+  trace_idle_period: 30s
+  max_block_bytes: 1048576
+  max_block_duration: 5m
+
+storage:
+  trace:
+    backend: local
+    local:
+      path: /var/tempo/traces
+    wal:
+      path: /var/tempo/wal

tests/test_observability.py

@@ -23,3 +23,19 @@ def _services() -> dict:
 
 def test_compose_has_services():
     assert _services(), "compose.yml has no services"
+
+
+class TestTempo:
+    def test_tempo_service_present(self):
+        svcs = _services()
+        assert "tempo" in svcs
+        assert svcs["tempo"]["networks"] == ["observability"]
+
+    def test_tempo_volume_declared(self):
+        vols = _load().get("volumes", {})
+        assert "tempo_data" in vols
+
+    def test_tempo_config_mounted(self):
+        svc = _services()["tempo"]
+        mounts = [v for v in svc["volumes"] if "/etc/tempo" in v]
+        assert any("./infra/tempo/tempo.yml" in v for v in mounts)