docs(contributing): use module path in scoped settings example

#### Description

- Make server port configurable so multiple instances can be started for
agentic development and testing.
- Add `make go-stop` to make it easier to restart server by agents. It
does a graceful stop to allow the Prometheus metrics exporter port to
shutdown otherwise that port remain occupied.
- Add make target for generating the OpenAPI specs.
- Documents the above in `docs/contributing/development.md` under "How
do I run more than one instance?", including `make go-stop` in the basic
backend flow.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

.claude/opencode.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "lsp": true,
+  "experimental": {
+    "disable_paste_summary": true
+  }
+}

.claude/rules/comments.md

@@ -7,5 +7,6 @@ Applies to everything in the repo — code, config, workflows.
 - **Rationale goes in prose, not source.** Why a version is pinned, why a job exists, how a subsystem fits together — that belongs in the README or the PR.
 - **Never remove pre-existing comments** when editing code. The bar above applies to comments you write, not comments already there.
 - **Never talk to the reviewer.** No comments about where a change came from, what was changed, or why the change is correct — that belongs in the PR description and is noise the moment it merges.
+- **Less is more.** When writing something intended for human consumption, (comment, commit message, reply to prompt) use as few words as possible. Pick every word meticulously to reduce the volume to a strict minimum. Be down to the point. Less is more.
 
 Language rules build on this one: [`go-comments`](go-comments.md), [`py-comments`](py-comments.md).

.claude/rules/go-contrib.md

@@ -0,0 +1,16 @@
+---
+paths:
+  - "**/*.go"
+---
+
+# Contribution guidelines
+
+- When making Go changes, always ensure they follow the contributing guildelines in [`docs/contributing/go/`](../../docs/contributing/go/).
+- Look for existing patterns in the codebase for any change before implementing the changes.
+- If any API contract is modified, generate the OpenAPI specs with `make gen-openapi-specs`.
+- Always keep the OpenAPI spec generated in a separate commit, so the whole commit can be dropped in case of conflicts during merge. Do not try to resolve conflict in generated files, instead just generate them again.
+- Avoid breaking function calls unncessarily into multilines for couple of arguments.
+- Try to keep most computational only logic in types package itself related to a domain type, use modules as the orchestraction layer cordinating different layers and all db queries in store layer. Check the serviceaccount modules for inspiration when confused.
+- When defining types, keep the structure of file to have any constants and variables first, then exported types and exported methods and then finally the unexported types and methods.
+- Never import types or other modules in migration files, duplicate the required type or method to keep migration free from changes.
+- Always run the gofmt tool for formating beforing commiting any changes.

.claude/rules/go-test.md

@@ -0,0 +1,12 @@
+---
+paths:
+  - "**/*_test.go"
+---
+
+# Go tests
+
+- **testify + table-driven.** Use `assert` / `require`; prefer table-driven cases. Tests live next to the source file.
+- **`require` vs `assert`.** `require` for anything the rest of the test cannot proceed without — setup, `require.NoError(t, err)`, nil/length checks before indexing or dereferencing. `assert` for the actual expectations, so one failed check still reports the rest.
+- **Mock with mockery.** When an interface needs mocking, list it in `.mockery.yml` and run `mockery`; never hand-write mocks. Generated mocks live in the source package's `<pkg>test` sibling (e.g. `resourcestest.NewMockAdapter(t)`).
+- **Table format.** Declare cases as `testCases := []struct{ name string; ... }` and iterate with `for _, testCase := range testCases { t.Run(testCase.name, ...) }` — the variables are named `testCases` / `testCase`. Case names are PascalCase segments joined by `_`, one segment per aspect (scenario, condition, expectation): `TimestampNotNullNoDefault`, `DropPrimaryKeyConstraint_AlterColumnNullable`, `ForeignKeyConstraint_DoesNotExist_SCreateAndDropConstraintTrue`.
+- **No hoisted test constants.** When goconst flags a repeated literal in a test, vary the fixture strings across cases instead of hoisting a constant — never introduce a shared const for test data. 

.claude/rules/pull-requests.md

@@ -2,6 +2,10 @@
 
 - **Follow the template** (`.github/pull_request_template.md`): fill in its headings (Description / Issues closed by this PR / Screenshots / Additional Information). Don't add sections the template doesn't have.
 - **Keep only the headings that apply.** Delete every heading that has nothing under it, along with its `<!--...-->` placeholder comment. The body must never contain an empty heading — if only Description applies, the body has exactly that one heading.
-- **Keep the description concise and human-readable.** A few plain bullets saying what changed and why, for a reviewer skimming it — not a wall of text, not a restatement of the diff, not generated boilerplate.
+- **Keep the description concise and human-readable.** A few non repetitive bullets saying what changed and why, for a reviewer skimming it — not a wall of text, not a restatement of the diff, not generated boilerplate and not the user agent conversation details.
 - **Reference issues with `Closes #issue-number`** under "Issues closed by this PR" so they auto-close on merge. This goes in the PR description only — never in commit messages.
+- **Breaking changes can be added in additional information section** if any.
 - **AI assistance in commits may optionally be disclosed with an `Assisted-by:` trailer** naming the model (e.g. `Assisted-by: Claude Opus 4.5`) — do NOT use a `Co-authored-by:` trailer for this.
+- **Keep the commit body short and human readable** focused on decision made if any. Commit body must not re-iterate the changes done, skip if title is sufficient in conveying the change.
+- **Use convensional commit format** for commits and PR title.
+- **Do not amend the commits once pushed.** Always create a new commit once changes are pushed to remote.

.github/CODEOWNERS

@@ -15,6 +15,10 @@
 .github @therealpandey
 go.mod @therealpandey
 
+# Security
+
+/SECURITY.md @therealpandey
+
 # Scaffold Owners
 
 /pkg/config/ @therealpandey

.gitignore

@@ -232,3 +232,4 @@ pyrightconfig.json
 # dev
 .dev/
 .claude/worktrees/
+.claude/settings.local.json

Makefile

@@ -81,10 +81,13 @@ devenv-clickhouse-clean: ## Clean all ClickHouse data from filesystem
 ##############################################################
 # go commands
 ##############################################################
+SIGNOZ_SQLSTORE_SQLITE_PATH ?= signoz.db
+SIGNOZ_APISERVER_ADDRESS    ?= 0.0.0.0:8080
+
 .PHONY: go-run-enterprise
 go-run-enterprise: ## Runs the enterprise go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SIGNOZ_SQLSTORE_SQLITE_PATH) \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
@@ -101,7 +104,7 @@ go-test: ## Runs go unit tests
 .PHONY: go-run-community
 go-run-community: ## Runs the community go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SIGNOZ_SQLSTORE_SQLITE_PATH) \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
@@ -111,6 +114,28 @@ go-run-community: ## Runs the community go backend server
 	go run -race \
 		$(GO_BUILD_CONTEXT_COMMUNITY)/*.go server
 
+.PHONY: go-stop
+go-stop: ## Stops the go backend server listening on SIGNOZ_APISERVER_ADDRESS, waiting for it to release every port it holds
+	@PORT=$(lastword $(subst :, ,$(SIGNOZ_APISERVER_ADDRESS))); \
+	PIDS=$$(lsof -ti tcp:$$PORT); \
+	if [ -z "$$PIDS" ]; then \
+		echo "No signoz server running on port $$PORT."; \
+		echo "If it's running on a different port, rerun as: make go-stop SIGNOZ_APISERVER_ADDRESS=host:port"; \
+		exit 0; \
+	fi; \
+	kill $$PIDS 2>/dev/null; \
+	for i in $$(seq 1 10); do \
+		alive=$$(for p in $$PIDS; do kill -0 $$p 2>/dev/null && echo $$p; done); \
+		[ -z "$$alive" ] && break; \
+		sleep 1; \
+	done; \
+	alive=$$(for p in $$PIDS; do kill -0 $$p 2>/dev/null && echo $$p; done); \
+	if [ -n "$$alive" ]; then \
+		echo "Graceful shutdown did not finish in 10s, sending SIGKILL to $$alive"; \
+		kill -9 $$alive 2>/dev/null; \
+	fi; \
+	echo "Stopped signoz server on port $$PORT (pid $$PIDS)"
+
 .PHONY: go-build-community $(GO_BUILD_ARCHS_COMMUNITY)
 go-build-community: ## Builds the go backend server for community
 go-build-community: $(GO_BUILD_ARCHS_COMMUNITY)
@@ -241,3 +266,8 @@ semconv-generate: ## Regenerate semantic-convention families for Go and TypeScri
 gen-mocks:
 	@echo ">> Generating mocks"
 	@mockery --config .mockery.yml
+
+.PHONY: gen-openapi-specs
+gen-openapi-specs:
+	@go run cmd/enterprise/*.go generate openapi
+	cd frontend && pnpm generate:api && cd -

SECURITY.md

@@ -1,17 +1,26 @@
 # Security Policy
 
-SigNoz is looking forward to working with security researchers across the world to keep SigNoz and our users safe. If you have found an issue in our systems/applications, please reach out to us.
+SigNoz is looking forward to working with security researchers across the world to keep SigNoz and our users safe. If you have found an issue in our systems/applications, please report it to us privately.
 
 ## Supported Versions
-We always recommend using the latest version of SigNoz to ensure you get all security updates
+
+We always recommend using the latest version of SigNoz to ensure you get all security updates.
 
 ## Reporting a Vulnerability
 
 If you believe you have found a security vulnerability within SigNoz, please let us know right away. We'll try and fix the problem as soon as possible.
 
-**Do not report vulnerabilities using public GitHub issues**. Instead, email <security@signoz.io> with a detailed account of the issue. Please submit one issue per email, this helps us triage vulnerabilities.
+**Do not report vulnerabilities using public GitHub issues, discussions, or pull requests.**
 
-Once we've received your email we'll keep you updated as we fix the vulnerability.
+Instead, report it privately through GitHub's private vulnerability reporting:
+
+1. Go to the [**Security** tab](https://github.com/SigNoz/signoz/security) of this repository.
+2. Click **Report a vulnerability**, or use [this link](https://github.com/SigNoz/signoz/security/advisories/new).
+3. Describe the issue with as much detail as you can — affected version, impact, and steps to reproduce help us triage faster. Please submit one report per vulnerability.
+
+This opens a private advisory visible only to you and the SigNoz maintainers. We'll respond there, keep you updated as we work on a fix, and coordinate disclosure. If the report is valid we'll credit you on the published advisory and request a CVE.
+
+If you're unable to use GitHub's private reporting, you can email <security@signoz.io> instead.
 
 ## Thanks
 

cmd/authz.go

@@ -102,7 +102,6 @@ func runGenerateAuthz(_ context.Context) error {
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceTraces).String():       true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceMetrics).String():      true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceMeterMetrics).String(): true,
-		coretypes.NewResourceRef(coretypes.ResourceMetaResourceQuickFilter).String():       true,
 	}
 
 	allowedTypes := map[string]bool{}

conf/example.yaml

@@ -138,6 +138,18 @@ sqlstore:
 
 ##################### APIServer #####################
 apiserver:
+  # The TCP address the API server listens on, in the form "host:port".
+  address: 0.0.0.0:8080
+  # Maximum duration for reading an entire request, including the body.
+  read_timeout: 60s
+  # Keep at 0; any value cuts off streaming endpoints (livetail, SSE, export_raw_data).
+  write_timeout: 0
+  # tls:
+  #   enabled: true
+  #   cert_file: /path/to/server.crt
+  #   key_file: /path/to/server.key
+  #   # Minimum TLS version: "1.2" or "1.3". Defaults to "1.2".
+  #   min_version: "1.2"
   timeout:
     # Default request timeout.
     default: 60s

docs/contributing/development.md

@@ -83,7 +83,13 @@ This command:
 
    You should see: `{"status":"ok"}`
 
-> 💡 **Tip**: The API server runs at `http://localhost:8080/` by default
+3. Stop it when you're done:
+   ```bash
+   make go-stop
+   ```
+
+> 💡 **Tip**: The API server runs at `http://localhost:8080/` by default. You can configure this using `apiserver.address` configuration option. See
+> [running more than one instance](#how-do-i-run-more-than-one-instance) if you need that for agentic testing.
 
 ### 4. Setting up the Frontend
 
@@ -119,6 +125,36 @@ To verify everything is working correctly:
 3. **Check Backend**: `curl http://localhost:8080/api/v1/health` (should return `{"status":"ok"}`)
 4. **Check Frontend**: Open `http://localhost:3301` in your browser
 
+## How do I run more than one instance?
+
+Handy when you keep several branches checked out as separate git worktrees. Every port
+and path below is read from the environment, so set them on the `make` call:
+
+```bash
+SIGNOZ_APISERVER_ADDRESS=0.0.0.0:8081 \
+SIGNOZ_SQLSTORE_SQLITE_PATH=/path/to/main/sqlite.db \
+SIGNOZ_INSTRUMENTATION_METRICS_READERS_PULL_EXPORTER_PROMETHEUS_PORT=9091 \
+make go-run-community
+```
+
+| Variable | Default | Why you'd change it |
+| --- | --- | --- |
+| `SIGNOZ_APISERVER_ADDRESS` | `0.0.0.0:8080` | Address the API server listens on |
+| `SIGNOZ_SQLSTORE_SQLITE_PATH` | `signoz.db` in worktree | To reuse same database |
+| `SIGNOZ_INSTRUMENTATION_METRICS_READERS_PULL_EXPORTER_PROMETHEUS_PORT` | `9090` | Bound by the Prometheus metrics exporter on startup |
+
+Point the frontend at whichever backend you want, in `frontend/.env`:
+
+```env
+VITE_FRONTEND_API_ENDPOINT=http://localhost:8081
+```
+
+Stop an instance using the address it was started on:
+
+```bash
+make go-stop SIGNOZ_APISERVER_ADDRESS=0.0.0.0:8081
+```
+
 ## How to send test data?
 
 You can now send telemetry data to your local SigNoz instance:

docs/contributing/go/service.md

@@ -191,7 +191,7 @@ A standalone service only has the `factory.Service` lifecycle i.e it does not se
         // ... dependencies ...
     ) user.Service {
         return &service{
-            settings: factory.NewScopedProviderSettings(providerSettings, "go.signoz.io/pkg/modules/user"),
+            settings: factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/user"),
             // ... dependencies ...
             stopC:    make(chan struct{}),
         }

ee/query-service/app/server.go

@@ -3,56 +3,29 @@ package app
 import (
 	"context"
 	"fmt"
-	"net"
-	"net/http"
-	"slices"
-
-	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
-	"go.opentelemetry.io/otel/propagation"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-
-	"github.com/gorilla/handlers"
-
-	"github.com/rs/cors"
-	"github.com/soheilhy/cmux"
 
 	"github.com/SigNoz/signoz/ee/query-service/app/api"
 	"github.com/SigNoz/signoz/ee/query-service/usage"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/signoz"
-	"github.com/SigNoz/signoz/pkg/web"
 
 	"log/slog"
 
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
-	baseapp "github.com/SigNoz/signoz/pkg/query-service/app"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
 	"github.com/SigNoz/signoz/pkg/query-service/app/logparsingpipeline"
 	"github.com/SigNoz/signoz/pkg/query-service/app/opamp"
 	opAmpModel "github.com/SigNoz/signoz/pkg/query-service/app/opamp/model"
 	baseconst "github.com/SigNoz/signoz/pkg/query-service/constants"
-	"github.com/SigNoz/signoz/pkg/query-service/healthcheck"
-	"github.com/SigNoz/signoz/pkg/query-service/utils"
 )
 
-// Server runs HTTP, Mux and a grpc server
+// Server runs auxiliary servers (opamp) alongside the signoz apiserver
 type Server struct {
-	config signoz.Config
-	signoz *signoz.SigNoz
-
-	// public http router
-	httpConn     net.Listener
-	httpServer   *http.Server
-	httpHostPort string
-
 	opampServer *opamp.Server
 
 	// Usage manager
 	usageManager *usage.Manager
-
-	unavailableChannel chan healthcheck.Status
 }
 
 // NewServer creates and initializes Server
@@ -127,57 +100,11 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
-	s := &Server{
-		config:             config,
-		signoz:             signoz,
-		httpHostPort:       baseconst.HTTPHostPort,
-		unavailableChannel: make(chan healthcheck.Status),
-		usageManager:       usageManager,
-	}
-
-	httpServer, err := s.createPublicServer(apiHandler, signoz.Web)
-
-	if err != nil {
-		return nil, err
-	}
-
-	s.httpServer = httpServer
-
-	s.opampServer = opamp.InitializeServer(
-		&opAmpModel.AllAgents, agentConfMgr, signoz.Instrumentation,
-	)
-
-	return s, nil
-}
-
-// HealthCheckStatus returns health check status channel a client can subscribe to
-func (s Server) HealthCheckStatus() chan healthcheck.Status {
-	return s.unavailableChannel
-}
-
-func (s *Server) createPublicServer(apiHandler *api.APIHandler, web web.Web) (*http.Server, error) {
-	r := baseapp.NewRouter()
-	am := middleware.NewAuthZ(s.signoz.Instrumentation.Logger(), s.signoz.Modules.OrgGetter, s.signoz.Authz)
-
-	r.Use(middleware.NewRecovery(s.signoz.Instrumentation.Logger()).Wrap)
-	r.Use(otelmux.Middleware(
-		"apiserver",
-		otelmux.WithMeterProvider(s.signoz.Instrumentation.MeterProvider()),
-		otelmux.WithTracerProvider(s.signoz.Instrumentation.TracerProvider()),
-		otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
-		otelmux.WithFilter(func(r *http.Request) bool {
-			return !slices.Contains([]string{"/api/v1/health"}, r.URL.Path)
-		}),
-	))
-	r.Use(middleware.NewIdentN(s.signoz.IdentNResolver, s.signoz.Sharder, s.signoz.Instrumentation.Logger()).Wrap)
-	r.Use(middleware.NewTimeout(s.signoz.Instrumentation.Logger(),
-		s.config.APIServer.Timeout.ExcludedRoutes,
-		s.config.APIServer.Timeout.Default,
-		s.config.APIServer.Timeout.Max,
-	).Wrap)
-	r.Use(middleware.NewResource(s.signoz.Instrumentation.Logger()).Wrap)
-	r.Use(middleware.NewAudit(s.signoz.Instrumentation.Logger(), s.config.APIServer.Logging.ExcludedRoutes, s.signoz.Auditor).Wrap)
-	r.Use(middleware.NewComment().Wrap)
+	// Register the legacy query-service routes on the apiserver router. The
+	// apiserver owns the HTTP server and applies the middleware chain at serve
+	// time, so these routes get the same treatment as the apiserver routes.
+	r := signoz.APIServer.Router()
+	am := middleware.NewAuthZ(signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter, signoz.Authz)
 
 	apiHandler.RegisterRoutes(r, am)
 	apiHandler.RegisterLogsRoutes(r, am)
@@ -188,107 +115,29 @@ func (s *Server) createPublicServer(apiHandler *api.APIHandler, web web.Web) (*h
 	apiHandler.RegisterThirdPartyApiRoutes(r, am)
 	apiHandler.RegisterTraceFunnelsRoutes(r, am)
 
-	err := s.signoz.APIServer.AddToRouter(r)
-	if err != nil {
-		return nil, err
+	s := &Server{
+		usageManager: usageManager,
 	}
 
-	c := cors.New(cors.Options{
-		AllowedOrigins: []string{"*"},
-		AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
-		AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control"},
-	})
+	s.opampServer = opamp.InitializeServer(
+		&opAmpModel.AllAgents, agentConfMgr, signoz.Instrumentation,
+	)
 
-	handler := c.Handler(r)
-
-	handler = handlers.CompressHandler(handler)
-
-	err = web.AddToRouter(r)
-	if err != nil {
-		return nil, err
-	}
-
-	routePrefix := s.config.Global.ExternalPath()
-	if routePrefix != "" {
-		prefixed := http.StripPrefix(routePrefix, handler)
-		handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-			switch req.URL.Path {
-			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
-				r.ServeHTTP(w, req)
-				return
-			}
-
-			prefixed.ServeHTTP(w, req)
-		})
-	}
-
-	return &http.Server{
-		Handler: handler,
-	}, nil
+	return s, nil
 }
 
-// initListeners initialises listeners of the server
-func (s *Server) initListeners() error {
-	// listen on public port
-	var err error
-	publicHostPort := s.httpHostPort
-	if publicHostPort == "" {
-		return fmt.Errorf("baseconst.HTTPHostPort is required")
-	}
-
-	s.httpConn, err = net.Listen("tcp", publicHostPort)
-	if err != nil {
-		return err
-	}
-
-	slog.Info(fmt.Sprintf("Query server started listening on %s...", s.httpHostPort))
-
-	return nil
-}
-
-// Start listening on http and private http port concurrently
+// Start starts the opamp websocket server. The HTTP API server is started by
+// the signoz registry.
 func (s *Server) Start(ctx context.Context) error {
-	err := s.initListeners()
-	if err != nil {
+	slog.Info("Starting OpAmp Websocket server", "addr", baseconst.OpAmpWsEndpoint)
+	if err := s.opampServer.Start(baseconst.OpAmpWsEndpoint); err != nil {
 		return err
 	}
 
-	var httpPort int
-	if port, err := utils.GetPort(s.httpConn.Addr()); err == nil {
-		httpPort = port
-	}
-
-	go func() {
-		slog.Info("Starting HTTP server", "port", httpPort, "addr", s.httpHostPort)
-
-		switch err := s.httpServer.Serve(s.httpConn); err {
-		case nil, http.ErrServerClosed, cmux.ErrListenerClosed:
-			// normal exit, nothing to do
-		default:
-			slog.Error("Could not start HTTP server", errors.Attr(err))
-		}
-		s.unavailableChannel <- healthcheck.Unavailable
-	}()
-
-	go func() {
-		slog.Info("Starting OpAmp Websocket server", "addr", baseconst.OpAmpWsEndpoint)
-		err := s.opampServer.Start(baseconst.OpAmpWsEndpoint)
-		if err != nil {
-			slog.Error("opamp ws server failed to start", errors.Attr(err))
-			s.unavailableChannel <- healthcheck.Unavailable
-		}
-	}()
-
 	return nil
 }
 
 func (s *Server) Stop(ctx context.Context) error {
-	if s.httpServer != nil {
-		if err := s.httpServer.Shutdown(ctx); err != nil {
-			return err
-		}
-	}
-
 	s.opampServer.Stop()
 
 	// stop usage manager

frontend/src/api/utils.ts

@@ -20,6 +20,7 @@ export const Logout = async (): Promise<void> => {
 	deleteLocalStorageKey(LOCALSTORAGE.LOGGED_IN_USER_NAME);
 	deleteLocalStorageKey(LOCALSTORAGE.CHAT_SUPPORT);
 	deleteLocalStorageKey(LOCALSTORAGE.USER_ID);
+	deleteLocalStorageKey(LOCALSTORAGE.QUICK_FILTERS_SETTINGS_ANNOUNCEMENT);
 	window.dispatchEvent(new CustomEvent('LOGOUT'));
 	history.push(ROUTES.LOGIN);
 };

frontend/src/components/QuickFilters/QuickFilters.styles.scss

@@ -95,7 +95,6 @@
 			gap: 10px;
 			width: 100%;
 			justify-content: flex-end;
-			--button-variant-link-color: var(--l1-foreground);
 
 			.divider-filter {
 				width: 1px;

frontend/src/components/QuickFilters/QuickFilters.tsx

@@ -15,30 +15,28 @@ import {
 	ComboboxTrigger,
 } from '@signozhq/ui/combobox';
 import { Skeleton, Tooltip } from 'antd';
-import { Button } from '@signozhq/ui/button';
 import { Switch } from '@signozhq/ui/switch';
 import { Typography } from '@signozhq/ui/typography';
+import getLocalStorageKey from 'api/browser/localstorage/get';
+import setLocalStorageKey from 'api/browser/localstorage/set';
 import logEvent from 'api/common/logEvent';
 import classNames from 'classnames';
 import OverlayScrollbar from 'components/OverlayScrollbar/OverlayScrollbar';
+import { LOCALSTORAGE } from 'constants/localStorage';
 import { PANEL_TYPES } from 'constants/queryBuilder';
 import { useApiMonitoringParams } from 'container/ApiMonitoring/queryParams';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
-import { AuthZGuardContent } from 'lib/authz/components/AuthZGuard/AuthZGuardContent';
-import AuthZButton from 'lib/authz/components/AuthZButton/AuthZButton';
-import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
-import {
-	QuickFilterManagePermissions,
-	QuickFilterReadPermission,
-} from 'lib/authz/hooks/useAuthZ/permissions/quick-filter.permissions';
-import { isFunction } from 'lodash-es';
+import { isFunction, isNull } from 'lodash-es';
+import { useAppContext } from 'providers/App/App';
 import { Query } from 'types/api/queryBuilder/queryBuilderData';
+import { USER_ROLES } from 'types/roles';
 
 import Checkbox from './FilterRenderers/Checkbox/Checkbox';
 import CheckboxV2 from './FilterRenderers/Checkbox/v2/CheckboxFilterV2';
 import Duration from './FilterRenderers/Duration/Duration';
 import Slider from './FilterRenderers/Slider/Slider';
 import useFilterConfig from './hooks/useFilterConfig';
+import AnnouncementTooltip from './QuickFiltersSettings/AnnouncementTooltip';
 import QuickFiltersSettings from './QuickFiltersSettings/QuickFiltersSettings';
 import { FiltersType, IQuickFiltersProps, QuickFiltersSource } from './types';
 
@@ -57,7 +55,9 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 		showQueryName = true,
 		useFieldApis,
 	} = props;
+	const { user } = useAppContext();
 	const [isSettingsOpen, setIsSettingsOpen] = useState(false);
+	const isAdmin = user.role === USER_ROLES.ADMIN;
 	const [params, setParams] = useApiMonitoringParams();
 	const showIP = params.showIP ?? true;
 
@@ -68,12 +68,6 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 		refetchCustomFilters,
 		isCustomFiltersLoading,
 	} = useFilterConfig({ signal, config });
-	const {
-		deniedPermissions: deniedSettingsPermissions,
-		isLoading: isSettingsChecking,
-	} = useAuthZ(QuickFilterManagePermissions, { enabled: isDynamicFilters });
-	const isSettingsDisabled =
-		isSettingsChecking || deniedSettingsPermissions.length > 0;
 
 	const {
 		currentQuery,
@@ -113,6 +107,16 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 	const shouldShowDropdownInListView =
 		isListView && source === QuickFiltersSource.TRACES_EXPLORER;
 
+	const showAnnouncementTooltip = useMemo(() => {
+		const localStorageValue = getLocalStorageKey(
+			LOCALSTORAGE.QUICK_FILTERS_SETTINGS_ANNOUNCEMENT,
+		);
+		if (!isNull(localStorageValue)) {
+			return !(localStorageValue === 'false');
+		}
+		return true;
+	}, []);
+
 	const activeQueryIndex = useMemo(() => {
 		if (isListView) {
 			return source === QuickFiltersSource.TRACES_EXPLORER
@@ -228,49 +232,49 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 	const renderRightActions = (): JSX.Element => (
 		<section className="right-actions">
 			<Tooltip title="Reset All">
-				<Button
-					variant="link"
-					color="secondary"
-					aria-label="Reset All"
-					className="right-action-icon-container"
-					onClick={handleReset}
-					prefix={<RefreshCw className="sync-icon" size="md" />}
-				/>
+				<div className="right-action-icon-container">
+					<RefreshCw className="sync-icon" size="md" onClick={handleReset} />
+				</div>
 			</Tooltip>
 			{showFilterCollapse && (
 				<Tooltip title="Collapse Filters">
-					<Button
-						variant="link"
-						color="secondary"
-						aria-label="Collapse Filters"
-						className="right-action-icon-container"
-						onClick={handleFilterVisibilityChange}
-						prefix={<ArrowUpToLine style={{ rotate: '270deg' }} size="md" />}
-					/>
+					<div className="right-action-icon-container">
+						<ArrowUpToLine
+							style={{ rotate: '270deg', cursor: 'pointer' }}
+							size="md"
+							onClick={handleFilterVisibilityChange}
+						/>
+					</div>
 				</Tooltip>
 			)}
-			{isDynamicFilters && (
-				<AuthZButton
-					checks={QuickFilterManagePermissions}
-					variant="link"
-					color="secondary"
-					aria-label="Settings"
-					className={classNames('right-action-icon-container', {
-						active: isSettingsOpen,
-					})}
-					onClick={(): void => setIsSettingsOpen(true)}
-					testId="settings-icon-container"
-					prefix={
-						<Tooltip title="Settings" open={isSettingsDisabled ? false : undefined}>
-							<SettingsIcon
-								className="settings-icon"
-								data-testid="settings-icon"
-								width={14}
-								height={14}
-							/>
-						</Tooltip>
-					}
-				/>
+			{isDynamicFilters && isAdmin && (
+				<Tooltip title="Settings">
+					<div
+						className={classNames('right-action-icon-container', {
+							active: isSettingsOpen,
+						})}
+					>
+						<SettingsIcon
+							className="settings-icon"
+							data-testid="settings-icon"
+							width={14}
+							height={14}
+							onClick={(): void => setIsSettingsOpen(true)}
+						/>
+						<AnnouncementTooltip
+							show={showAnnouncementTooltip}
+							position={{ top: -5, left: 15 }}
+							title="Edit your quick filters"
+							message="You can now customize and re-arrange your quick filters panel. Select the quick filters you’d need and hide away the rest for faster exploration."
+							onClose={(): void => {
+								setLocalStorageKey(
+									LOCALSTORAGE.QUICK_FILTERS_SETTINGS_ANNOUNCEMENT,
+									'false',
+								);
+							}}
+						/>
+					</div>
+				</Tooltip>
 			)}
 		</section>
 	);
@@ -357,21 +361,6 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 		</>
 	);
 
-	const filtersSkeleton = (
-		<div className="quick-filters-skeleton">
-			{Array.from({ length: 5 }).map((_, index) => (
-				// eslint-disable-next-line react/no-array-index-key
-				<Skeleton.Input active size="small" key={index} />
-			))}
-		</div>
-	);
-
-	const filtersContent = isCustomFiltersLoading ? (
-		filtersSkeleton
-	) : (
-		<OverlayScrollbar>{renderContent()}</OverlayScrollbar>
-	);
-
 	return (
 		<div className="quick-filters-container">
 			<div className="quick-filters">
@@ -382,15 +371,15 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 					</section>
 				)}
 
-				{signal ? (
-					<AuthZGuardContent
-						checks={[QuickFilterReadPermission]}
-						fallbackOnLoading={filtersSkeleton}
-					>
-						{filtersContent}
-					</AuthZGuardContent>
+				{isCustomFiltersLoading ? (
+					<div className="quick-filters-skeleton">
+						{Array.from({ length: 5 }).map((_, index) => (
+							// eslint-disable-next-line react/no-array-index-key
+							<Skeleton.Input active size="small" key={index} />
+						))}
+					</div>
 				) : (
-					filtersContent
+					<OverlayScrollbar>{renderContent()}</OverlayScrollbar>
 				)}
 			</div>
 			<div className="quick-filters-settings-container">

frontend/src/components/QuickFilters/hooks/useFilterConfig.tsx

@@ -35,7 +35,10 @@ const useFilterConfig = ({
 		[data],
 	);
 
-	const isDynamicFilters = !!signal;
+	const isDynamicFilters = useMemo(
+		() => customFilters.length > 0,
+		[customFilters],
+	);
 
 	const filterConfig = useMemo(
 		() => getFilterConfig(signal, customFilters, config),

frontend/src/components/QuickFilters/tests/QuickFilters.authz.test.tsx

@@ -1,212 +0,0 @@
-import { ENVIRONMENT } from 'constants/env';
-import {
-	ApiMonitoringParams,
-	useApiMonitoringParams,
-} from 'container/ApiMonitoring/queryParams';
-import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
-import {
-	QuickFilterReadPermission,
-	QuickFilterUpdatePermission,
-} from 'lib/authz/hooks/useAuthZ/permissions/quick-filter.permissions';
-import {
-	AUTHZ_CHECK_URL,
-	setupAuthzAdmin,
-	setupAuthzDeny,
-	setupAuthzDenyAll,
-} from 'lib/authz/utils/authz-test-utils';
-import {
-	otherFiltersResponse,
-	quickFiltersAttributeValuesResponse,
-	quickFiltersListResponse,
-} from 'mocks-server/__mockdata__/customQuickFilters';
-import { server } from 'mocks-server/server';
-import { rest } from 'msw';
-import { render, screen, userEvent, waitFor } from 'tests/test-utils';
-
-import QuickFilters from '../QuickFilters';
-import { QuickFiltersSource, SignalType } from '../types';
-import { QuickFiltersConfig } from './constants';
-
-jest.mock('hooks/queryBuilder/useQueryBuilder', () => ({
-	useQueryBuilder: jest.fn(),
-}));
-jest.mock('container/ApiMonitoring/queryParams');
-
-const mockUseApiMonitoringParams = jest.mocked(useApiMonitoringParams);
-
-const BASE_URL = ENVIRONMENT.baseURL;
-const SIGNAL = SignalType.LOGS;
-const quickFiltersListURL = `${BASE_URL}/api/v2/quick_filters/${SIGNAL}`;
-const fieldsKeysURL = `${BASE_URL}/api/v1/fields/keys`;
-const attributeValuesURL = `${BASE_URL}/api/v3/autocomplete/attribute_values`;
-const fieldsValuesURL = `${BASE_URL}/api/v1/fields/values`;
-
-const NOT_AUTHORIZED_TEXT = /is not authorized to perform/i;
-const FILTER_SERVICE_NAME = 'Service Name';
-const SETTINGS_CONTAINER_TEST_ID = 'settings-icon-container';
-
-beforeEach(() => {
-	(useQueryBuilder as jest.Mock).mockReturnValue({
-		currentQuery: {
-			builder: {
-				queryData: [
-					{
-						queryName: 'Test Query',
-						filters: { items: [] },
-					},
-				],
-			},
-		},
-		lastUsedQuery: 0,
-		redirectWithQueryBuilderData: jest.fn(),
-	});
-	mockUseApiMonitoringParams.mockReturnValue([
-		{ showIP: true } as ApiMonitoringParams,
-		jest.fn(),
-	]);
-	server.use(
-		rest.get(quickFiltersListURL, (_req, res, ctx) =>
-			res(ctx.status(200), ctx.json(quickFiltersListResponse)),
-		),
-		rest.get(fieldsKeysURL, (_req, res, ctx) =>
-			res(ctx.status(200), ctx.json(otherFiltersResponse)),
-		),
-		rest.get(attributeValuesURL, (_req, res, ctx) =>
-			res(ctx.status(200), ctx.json(quickFiltersAttributeValuesResponse)),
-		),
-		rest.get(fieldsValuesURL, (_req, res, ctx) =>
-			res(ctx.status(200), ctx.json(quickFiltersAttributeValuesResponse)),
-		),
-	);
-});
-
-afterEach(() => {
-	server.resetHandlers();
-	jest.clearAllMocks();
-});
-
-function renderWithSignal(): void {
-	render(
-		<QuickFilters
-			source={QuickFiltersSource.LOGS_EXPLORER}
-			signal={SIGNAL}
-			handleFilterVisibilityChange={jest.fn()}
-		/>,
-	);
-}
-
-function renderStaticConfig(): void {
-	render(
-		<QuickFilters
-			source={QuickFiltersSource.EXCEPTIONS}
-			config={QuickFiltersConfig}
-			handleFilterVisibilityChange={jest.fn()}
-		/>,
-	);
-}
-
-describe('QuickFilters - AuthZ', () => {
-	describe('read denied', () => {
-		it('shows the inline denial instead of the filters, header stays', async () => {
-			server.use(setupAuthzDeny(QuickFilterReadPermission));
-
-			renderWithSignal();
-
-			await expect(
-				screen.findByText(NOT_AUTHORIZED_TEXT),
-			).resolves.toBeInTheDocument();
-
-			expect(screen.queryByText(FILTER_SERVICE_NAME)).not.toBeInTheDocument();
-			expect(screen.getByText('Filters for')).toBeInTheDocument();
-
-			const settingsTrigger = await screen.findByTestId(
-				SETTINGS_CONTAINER_TEST_ID,
-			);
-			await waitFor(() =>
-				expect(settingsTrigger).toHaveAttribute(
-					'data-denied-permissions',
-					expect.stringContaining('read'),
-				),
-			);
-		});
-	});
-
-	describe('update denied', () => {
-		it('renders the filters but disables the settings trigger', async () => {
-			server.use(setupAuthzDeny(QuickFilterUpdatePermission));
-
-			renderWithSignal();
-
-			await expect(
-				screen.findByText(FILTER_SERVICE_NAME),
-			).resolves.toBeInTheDocument();
-
-			const settingsTrigger = await screen.findByTestId(
-				SETTINGS_CONTAINER_TEST_ID,
-			);
-			await waitFor(() =>
-				expect(settingsTrigger).toHaveAttribute(
-					'data-denied-permissions',
-					expect.stringContaining('update'),
-				),
-			);
-
-			await userEvent.click(settingsTrigger);
-			expect(screen.queryByText(/ADDED FILTERS/i)).not.toBeInTheDocument();
-		});
-	});
-
-	describe('all permissions granted', () => {
-		it('renders the filters and opens settings from the trigger', async () => {
-			server.use(setupAuthzAdmin());
-
-			renderWithSignal();
-
-			await expect(
-				screen.findByText(FILTER_SERVICE_NAME),
-			).resolves.toBeInTheDocument();
-
-			const settingsTrigger = await screen.findByTestId(
-				SETTINGS_CONTAINER_TEST_ID,
-			);
-			expect(settingsTrigger).not.toHaveAttribute('data-denied-permissions');
-
-			await userEvent.click(settingsTrigger);
-			await expect(
-				screen.findByText(/ADDED FILTERS/i),
-			).resolves.toBeInTheDocument();
-		});
-	});
-
-	describe('static config pages (no signal)', () => {
-		it('is not gated even when every permission is denied', async () => {
-			server.use(setupAuthzDenyAll());
-
-			renderStaticConfig();
-
-			await expect(
-				screen.findByText(FILTER_SERVICE_NAME),
-			).resolves.toBeInTheDocument();
-			expect(screen.queryByText(NOT_AUTHORIZED_TEXT)).not.toBeInTheDocument();
-		});
-	});
-
-	describe('permission check loading', () => {
-		it('shows the skeleton, not the filters or a denial', async () => {
-			server.use(
-				rest.post(AUTHZ_CHECK_URL, (_req, res, ctx) => res(ctx.delay('infinite'))),
-			);
-
-			renderWithSignal();
-
-			await waitFor(() =>
-				// eslint-disable-next-line testing-library/no-node-access
-				expect(
-					document.querySelector('.quick-filters-skeleton'),
-				).toBeInTheDocument(),
-			);
-			expect(screen.queryByText(NOT_AUTHORIZED_TEXT)).not.toBeInTheDocument();
-			expect(screen.queryByText(FILTER_SERVICE_NAME)).not.toBeInTheDocument();
-		});
-	});
-});

frontend/src/components/QuickFilters/types.ts

@@ -54,7 +54,6 @@ export interface IQuickFiltersProps {
 	source: QuickFiltersSource;
 	onFilterChange?: (query: Query) => void;
 	onQuickFilterChange?: (data: QuickFilterChangeEventData) => void;
-	/** Pass to fetch quick filters for this signal; omit to use `config` as-is */
 	signal?: SignalType;
 	className?: string;
 	showFilterCollapse?: boolean;

frontend/src/constants/localStorage.ts

@@ -31,6 +31,7 @@ export enum LOCALSTORAGE {
 	DONT_SHOW_SLOW_API_WARNING = 'DONT_SHOW_SLOW_API_WARNING',
 	METRICS_LIST_OPTIONS = 'METRICS_LIST_OPTIONS',
 	SHOW_EXCEPTIONS_QUICK_FILTERS = 'SHOW_EXCEPTIONS_QUICK_FILTERS',
+	QUICK_FILTERS_SETTINGS_ANNOUNCEMENT = 'QUICK_FILTERS_SETTINGS_ANNOUNCEMENT',
 	FUNNEL_STEPS = 'FUNNEL_STEPS',
 	SPAN_DETAILS_PINNED_ATTRIBUTES = 'SPAN_DETAILS_PINNED_ATTRIBUTES',
 	LAST_USED_CUSTOM_TIME_RANGES = 'LAST_USED_CUSTOM_TIME_RANGES',

frontend/src/container/RolesSettings/hooks/__tests__/useRolePermissions.test.ts

@@ -329,14 +329,13 @@ describe('transformTransactionGroupsToResourcePermissions', () => {
 	it('returns all resources from RESOURCE_ORDER even with empty transaction groups', () => {
 		const result = transformTransactionGroupsToResourcePermissions([]);
 
-		expect(result).toHaveLength(10);
+		expect(result).toHaveLength(9);
 		expect(result.map((r) => r.resourceKind)).toStrictEqual([
 			'factor-api-key',
 			'license',
 			'logs',
 			'meter-metrics',
 			'metrics',
-			'quick-filter',
 			'role',
 			'serviceaccount',
 			'subscription',
@@ -421,14 +420,13 @@ describe('createEmptyRolePermissions', () => {
 	it('creates permissions for all resources in RESOURCE_ORDER', () => {
 		const result = createEmptyRolePermissions();
 
-		expect(result).toHaveLength(10);
+		expect(result).toHaveLength(9);
 		expect(result.map((r) => r.resourceKind)).toStrictEqual([
 			'factor-api-key',
 			'license',
 			'logs',
 			'meter-metrics',
 			'metrics',
-			'quick-filter',
 			'role',
 			'serviceaccount',
 			'subscription',

frontend/src/container/RolesSettings/permissions.config.ts

@@ -5,7 +5,6 @@ import {
 	FileKey,
 	Gauge,
 	Key,
-	ListFilter,
 	Logs,
 	Receipt,
 	Shield,
@@ -78,14 +77,6 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 		selectorPlaceholder: 'Type * to cover the workspace subscription',
 		docsAnchor: 'subscription',
 	},
-	'quick-filter': {
-		label: 'Quick Filters',
-		description: 'Quick filters shown in the logs, traces, and other explorers.',
-		icon: ListFilter,
-		selectorPlaceholder:
-			'Type quick filter ID, separate multiple with comma or space',
-		docsAnchor: 'quick-filter',
-	},
 	logs: {
 		label: 'Logs',
 		description: 'Log data collected across the workspace.',

frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts

@@ -13,11 +13,6 @@ export default {
 				type: 'metaresource',
 				allowedVerbs: ['create', 'delete', 'list', 'read', 'update'],
 			},
-			{
-				kind: 'quick-filter',
-				type: 'metaresource',
-				allowedVerbs: ['list', 'read', 'update'],
-			},
 			{
 				kind: 'subscription',
 				type: 'metaresource',

frontend/src/lib/authz/hooks/useAuthZ/permissions/quick-filter.permissions.ts

@@ -1,16 +0,0 @@
-import { buildPermission } from '../utils';
-
-export const QuickFilterReadPermission = buildPermission(
-	'read',
-	'quick-filter:*',
-);
-export const QuickFilterUpdatePermission = buildPermission(
-	'update',
-	'quick-filter:*',
-);
-
-// Editing quick filters needs read as well as update
-export const QuickFilterManagePermissions = [
-	QuickFilterReadPermission,
-	QuickFilterUpdatePermission,
-];

go.mod

@@ -57,7 +57,6 @@ require (
 	github.com/segmentio/analytics-go/v3 v3.2.1
 	github.com/sethvargo/go-password v0.2.0
 	github.com/smartystreets/goconvey v1.8.1
-	github.com/soheilhy/cmux v0.1.5
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
 	github.com/swaggest/jsonschema-go v0.3.78

go.sum

@@ -1057,8 +1057,6 @@ github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY=
 github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
-github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
-github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
@@ -1493,7 +1491,6 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

pkg/apiserver/apiserver.go

@@ -1,10 +1,14 @@
 package apiserver
 
 import (
+	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/gorilla/mux"
 )
 
 type APIServer interface {
+	// APIServer is a long running service serving the SigNoz API.
+	factory.ServiceWithHealthy
+
 	// Returns the mux router for the API server. Primarily used for collecting OpenAPI operations.
 	Router() *mux.Router
 

pkg/apiserver/config.go

@@ -3,13 +3,16 @@ package apiserver
 import (
 	"time"
 
+	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/factory"
+	httpserver "github.com/SigNoz/signoz/pkg/http/server"
 )
 
 // Config holds the configuration for config.
 type Config struct {
-	Timeout Timeout `mapstructure:"timeout"`
-	Logging Logging `mapstructure:"logging"`
+	httpserver.Config `mapstructure:",squash" yaml:",squash"`
+	Timeout           Timeout `mapstructure:"timeout"`
+	Logging           Logging `mapstructure:"logging"`
 }
 
 type Timeout struct {
@@ -32,6 +35,10 @@ func NewConfigFactory() factory.ConfigFactory {
 
 func newConfig() factory.Config {
 	return &Config{
+		Config: httpserver.Config{
+			Address:     "0.0.0.0:8080",
+			ReadTimeout: 60 * time.Second,
+		},
 		Timeout: Timeout{
 			Default: 60 * time.Second,
 			Max:     600 * time.Second,
@@ -52,5 +59,13 @@ func newConfig() factory.Config {
 }
 
 func (c Config) Validate() error {
+	if err := c.Config.Validate(); err != nil {
+		return err
+	}
+
+	if c.Address == "" {
+		return errors.NewInvalidInputf(errors.CodeInvalidInput, "apiserver.address is required")
+	}
+
 	return nil
 }

pkg/apiserver/config_test.go

@@ -8,11 +8,18 @@ import (
 	"github.com/SigNoz/signoz/pkg/config"
 	"github.com/SigNoz/signoz/pkg/config/envprovider"
 	"github.com/SigNoz/signoz/pkg/factory"
+	httpserver "github.com/SigNoz/signoz/pkg/http/server"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewWithEnvProvider(t *testing.T) {
+	t.Setenv("SIGNOZ_APISERVER_ADDRESS", "0.0.0.0:9090")
+	t.Setenv("SIGNOZ_APISERVER_READ__TIMEOUT", "80s")
+	t.Setenv("SIGNOZ_APISERVER_TLS_ENABLED", "true")
+	t.Setenv("SIGNOZ_APISERVER_TLS_CERT__FILE", "/etc/signoz/server.crt")
+	t.Setenv("SIGNOZ_APISERVER_TLS_KEY__FILE", "/etc/signoz/server.key")
+	t.Setenv("SIGNOZ_APISERVER_TLS_MIN__VERSION", "1.3")
 	t.Setenv("SIGNOZ_APISERVER_TIMEOUT_DEFAULT", "70s")
 	t.Setenv("SIGNOZ_APISERVER_TIMEOUT_MAX", "700s")
 	t.Setenv("SIGNOZ_APISERVER_TIMEOUT_EXCLUDED__ROUTES", "/excluded1,/excluded2")
@@ -38,6 +45,16 @@ func TestNewWithEnvProvider(t *testing.T) {
 	require.NoError(t, err)
 
 	expected := &Config{
+		Config: httpserver.Config{
+			Address:     "0.0.0.0:9090",
+			ReadTimeout: 80 * time.Second,
+			TLS: httpserver.TLS{
+				Enabled:    true,
+				CertFile:   "/etc/signoz/server.crt",
+				KeyFile:    "/etc/signoz/server.key",
+				MinVersion: "1.3",
+			},
+		},
 		Timeout: Timeout{
 			Default: 70 * time.Second,
 			Max:     700 * time.Second,

pkg/apiserver/signozapiserver/provider.go

@@ -2,9 +2,11 @@ package signozapiserver
 
 import (
 	"context"
+	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/alertmanager"
 	"github.com/SigNoz/signoz/pkg/apiserver"
+	"github.com/SigNoz/signoz/pkg/auditor"
 	"github.com/SigNoz/signoz/pkg/authz"
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
@@ -12,6 +14,8 @@ import (
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
+	httpserver "github.com/SigNoz/signoz/pkg/http/server"
+	"github.com/SigNoz/signoz/pkg/identn"
 	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/modules/aiobservability"
 	"github.com/SigNoz/signoz/pkg/modules/authdomain"
@@ -37,18 +41,22 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/statsreporter"
 	"github.com/SigNoz/signoz/pkg/subscription"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/web"
 	"github.com/SigNoz/signoz/pkg/zeus"
 	"github.com/gorilla/mux"
 )
 
 type provider struct {
-	config                     apiserver.Config
-	settings                   factory.ScopedProviderSettings
+	globalConfig               global.Config
+	web                        web.Web
 	router                     *mux.Router
+	httpServer                 *httpserver.Server
+	healthyC                   chan struct{}
 	authzMiddleware            *middleware.AuthZ
 	authzService               authz.AuthZ
 	orgHandler                 organization.Handler
@@ -132,6 +140,11 @@ func NewFactory(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
+	globalConfig global.Config,
+	identNResolver identn.IdentNResolver,
+	sharder sharder.Sharder,
+	auditor auditor.Auditor,
+	web web.Web,
 	quickFilterModule quickfilter.Module,
 	quickFilterHandler quickfilter.Handler,
 ) factory.ProviderFactory[apiserver.APIServer, apiserver.Config] {
@@ -179,6 +192,11 @@ func NewFactory(
 			rulerHandler,
 			statsHandler,
 			savedViewHandler,
+			globalConfig,
+			identNResolver,
+			sharder,
+			auditor,
+			web,
 			quickFilterModule,
 			quickFilterHandler,
 		)
@@ -228,6 +246,11 @@ func newProvider(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
+	globalConfig global.Config,
+	identNResolver identn.IdentNResolver,
+	sharder sharder.Sharder,
+	auditor auditor.Auditor,
+	web web.Web,
 	quickFilterModule quickfilter.Module,
 	quickFilterHandler quickfilter.Handler,
 ) (apiserver.APIServer, error) {
@@ -235,9 +258,10 @@ func newProvider(
 	router := mux.NewRouter().UseEncodedPath()
 
 	provider := &provider{
-		config:                     config,
-		settings:                   settings,
+		globalConfig:               globalConfig,
+		web:                        web,
 		router:                     router,
+		healthyC:                   make(chan struct{}),
 		orgHandler:                 orgHandler,
 		userHandler:                userHandler,
 		authzService:               authzService,
@@ -282,13 +306,68 @@ func newProvider(
 
 	provider.authzMiddleware = middleware.NewAuthZ(settings.Logger(), orgGetter, authzService)
 
+	router.Use(middleware.NewRecovery(settings.Logger()).Wrap)
+	router.Use(middleware.NewOtel("apiserver", providerSettings.MeterProvider, providerSettings.TracerProvider).Wrap)
+	router.Use(middleware.NewIdentN(identNResolver, sharder, settings.Logger()).Wrap)
+	router.Use(middleware.NewTimeout(settings.Logger(),
+		config.Timeout.ExcludedRoutes,
+		config.Timeout.Default,
+		config.Timeout.Max,
+	).Wrap)
+	router.Use(middleware.NewResource(settings.Logger()).Wrap)
+	router.Use(middleware.NewAudit(settings.Logger(), config.Logging.ExcludedRoutes, auditor).Wrap)
+	router.Use(middleware.NewComment().Wrap)
+
 	if err := provider.AddToRouter(router); err != nil {
 		return nil, err
 	}
 
+	httpHandler := middleware.NewCors().Wrap(router)
+	httpHandler = middleware.NewCompress().Wrap(httpHandler)
+
+	routePrefix := globalConfig.ExternalPath()
+	if routePrefix != "" {
+		prefixed := http.StripPrefix(routePrefix, httpHandler)
+		httpHandler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			switch req.URL.Path {
+			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
+				router.ServeHTTP(w, req)
+				return
+			}
+
+			prefixed.ServeHTTP(w, req)
+		})
+	}
+
+	httpServer, err := httpserver.New(settings.Logger(), config.Config, httpHandler)
+	if err != nil {
+		return nil, err
+	}
+	provider.httpServer = httpServer
+
 	return provider, nil
 }
 
+func (provider *provider) Start(ctx context.Context) error {
+	// Mount the web routes last so the catch-all prefix does not shadow API
+	// routes registered on the router after construction.
+	if err := provider.web.AddToRouter(provider.router); err != nil {
+		return err
+	}
+
+	close(provider.healthyC)
+
+	return provider.httpServer.Start(ctx)
+}
+
+func (provider *provider) Stop(ctx context.Context) error {
+	return provider.httpServer.Stop(ctx)
+}
+
+func (provider *provider) Healthy() <-chan struct{} {
+	return provider.healthyC
+}
+
 func (provider *provider) Router() *mux.Router {
 	return provider.router
 }

pkg/factory/registry.go

@@ -78,6 +78,40 @@ func NewRegistry(ctx context.Context, logger *slog.Logger, services ...NamedServ
 	}, nil
 }
 
+// Add registers additional services into the registry. It must be called before Start.
+func (registry *Registry) Add(ctx context.Context, services ...NamedService) error {
+	added := make([]*serviceWithState, 0, len(services))
+	for _, s := range services {
+		if _, ok := registry.servicesByName[s.Name()]; ok {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeInvalidRegistry, "cannot add service, duplicate service name %q", s.Name())
+		}
+		added = append(added, newServiceWithState(s))
+	}
+
+	for _, ss := range added {
+		registry.services = append(registry.services, ss)
+		registry.servicesByName[ss.service.Name()] = ss
+	}
+
+	for _, ss := range added {
+		for _, dep := range ss.service.DependsOn() {
+			if dep == ss.service.Name() {
+				registry.logger.ErrorContext(ctx, "ignoring self-dependency", slog.Any("service", ss.service.Name()))
+				continue
+			}
+
+			if _, ok := registry.servicesByName[dep]; !ok {
+				registry.logger.ErrorContext(ctx, "ignoring unknown dependency", slog.Any("service", ss.service.Name()), slog.Any("dependency", dep))
+				continue
+			}
+
+			ss.dependsOn = append(ss.dependsOn, dep)
+		}
+	}
+
+	return detectCyclicDeps(registry.services)
+}
+
 func (registry *Registry) Start(ctx context.Context) {
 	for _, ss := range registry.services {
 		go func(ss *serviceWithState) {

pkg/factory/registry_test.go

@@ -342,3 +342,61 @@ func TestDependsOnCycleReturnsError(t *testing.T) {
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "dependency cycles detected")
 }
+
+func TestRegistryAdd(t *testing.T) {
+	s1 := newTestService(t)
+	s2 := newTestService(t)
+
+	registry, err := NewRegistry(context.Background(), slog.New(slog.DiscardHandler), NewNamedService(MustNewName("s1"), s1))
+	require.NoError(t, err)
+
+	require.NoError(t, registry.Add(context.Background(), NewNamedService(MustNewName("s2"), s2)))
+
+	ctx := context.Background()
+	registry.Start(ctx)
+
+	require.NoError(t, registry.AwaitHealthy(ctx))
+	byState := registry.ServicesByState()
+	assert.Len(t, byState[StateRunning], 2)
+	assert.True(t, registry.IsHealthy())
+
+	assert.NoError(t, registry.Stop(ctx))
+}
+
+func TestRegistryAddDuplicateReturnsError(t *testing.T) {
+	s1 := newTestService(t)
+
+	registry, err := NewRegistry(context.Background(), slog.New(slog.DiscardHandler), NewNamedService(MustNewName("s1"), s1))
+	require.NoError(t, err)
+
+	err = registry.Add(context.Background(), NewNamedService(MustNewName("s1"), newTestService(t)))
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "duplicate service name")
+}
+
+func TestRegistryAddWithDependency(t *testing.T) {
+	s1 := newHealthyTestService(t)
+	s2 := newTestService(t)
+
+	registry, err := NewRegistry(context.Background(), slog.New(slog.DiscardHandler), NewNamedService(MustNewName("s1"), s1))
+	require.NoError(t, err)
+
+	// s2 depends on the already registered s1.
+	require.NoError(t, registry.Add(context.Background(), NewNamedService(MustNewName("s2"), s2, MustNewName("s1"))))
+
+	ctx := context.Background()
+	registry.Start(ctx)
+
+	// s2 stays in STARTING until s1 is healthy.
+	require.Eventually(t, func() bool {
+		byState := registry.ServicesByState()
+		return len(byState[StateStarting]) == 2
+	}, time.Second, time.Millisecond)
+
+	close(s1.healthyC)
+
+	require.NoError(t, registry.AwaitHealthy(ctx))
+	assert.True(t, registry.IsHealthy())
+
+	assert.NoError(t, registry.Stop(ctx))
+}

pkg/http/middleware/compress.go

@@ -0,0 +1,17 @@
+package middleware
+
+import (
+	"net/http"
+
+	gorillahandlers "github.com/gorilla/handlers"
+)
+
+type Compress struct{}
+
+func NewCompress() *Compress {
+	return &Compress{}
+}
+
+func (middleware *Compress) Wrap(next http.Handler) http.Handler {
+	return gorillahandlers.CompressHandler(next)
+}

pkg/http/middleware/cors.go

@@ -0,0 +1,25 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/rs/cors"
+)
+
+type Cors struct {
+	cors *cors.Cors
+}
+
+func NewCors() *Cors {
+	return &Cors{
+		cors: cors.New(cors.Options{
+			AllowedOrigins: []string{"*"},
+			AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
+			AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control"},
+		}),
+	}
+}
+
+func (middleware *Cors) Wrap(next http.Handler) http.Handler {
+	return middleware.cors.Handler(next)
+}

pkg/http/middleware/otel.go

@@ -0,0 +1,43 @@
+package middleware
+
+import (
+	"net/http"
+	"slices"
+
+	"github.com/gorilla/mux"
+	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// defaultExcludedRoutes are the health endpoints kept out of tracing/metrics to
+// avoid drowning telemetry in probe traffic.
+var defaultExcludedRoutes = []string{
+	"/api/v1/health",
+	"/api/v2/healthz",
+	"/api/v2/readyz",
+	"/api/v2/livez",
+}
+
+type Otel struct {
+	wrap mux.MiddlewareFunc
+}
+
+func NewOtel(service string, meterProvider metric.MeterProvider, tracerProvider trace.TracerProvider) *Otel {
+	return &Otel{
+		wrap: otelmux.Middleware(
+			service,
+			otelmux.WithMeterProvider(meterProvider),
+			otelmux.WithTracerProvider(tracerProvider),
+			otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
+			otelmux.WithFilter(func(r *http.Request) bool {
+				return !slices.Contains(defaultExcludedRoutes, r.URL.Path)
+			}),
+		),
+	}
+}
+
+func (middleware *Otel) Wrap(next http.Handler) http.Handler {
+	return middleware.wrap(next)
+}

pkg/http/server/config.go

@@ -1,9 +1,89 @@
 package server
 
-// Config holds the configuration for http.
+import (
+	"crypto/tls"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+)
+
+var tlsVersions = map[string]uint16{
+	"1.2": tls.VersionTLS12,
+	"1.3": tls.VersionTLS13,
+}
+
 type Config struct {
-	//Address specifies the TCP address for the server to listen on, in the form "host:port".
+	// Address specifies the TCP address for the server to listen on, in the form "host:port".
 	// If empty, ":http" (port 80) is used. The service names are defined in RFC 6335 and assigned by IANA.
 	// See net.Dial for details of the address format.
 	Address string `mapstructure:"address"`
+
+	// ReadTimeout bounds reading an entire request, including the body. Zero means no timeout.
+	ReadTimeout time.Duration `mapstructure:"read_timeout"`
+
+	// WriteTimeout bounds writing the response. Zero means no timeout, required for
+	// streaming endpoints that hold the connection open.
+	WriteTimeout time.Duration `mapstructure:"write_timeout"`
+
+	TLS TLS `mapstructure:"tls"`
+}
+
+type TLS struct {
+	Enabled bool `mapstructure:"enabled"`
+
+	// The full path to the certificate file.
+	CertFile string `mapstructure:"cert_file"`
+
+	// The full path to the key file.
+	KeyFile string `mapstructure:"key_file"`
+
+	// MinVersion is the minimum acceptable TLS version, "1.2" or "1.3". Empty uses the Go default.
+	MinVersion string `mapstructure:"min_version"`
+}
+
+func (c Config) Validate() error {
+	if !c.TLS.Enabled {
+		return nil
+	}
+
+	if c.TLS.CertFile == "" || c.TLS.KeyFile == "" {
+		return errors.NewInvalidInputf(errors.CodeInvalidInput, "tls::cert_file and tls::key_file are required when tls is enabled")
+	}
+
+	_, err := tlsVersion(c.TLS.MinVersion)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (tlsConfig TLS) Config() (*tls.Config, error) {
+	cert, err := tls.LoadX509KeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)
+	if err != nil {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot load tls::cert_file and tls::key_file: %v", err)
+	}
+
+	minVersion, err := tlsVersion(tlsConfig.MinVersion)
+	if err != nil {
+		return nil, err
+	}
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		MinVersion:   minVersion,
+	}, nil
+}
+
+func tlsVersion(name string) (uint16, error) {
+	if name == "" {
+		return 0, nil
+	}
+
+	version, ok := tlsVersions[name]
+	if !ok {
+		return 0, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid tls version %q, must be \"1.2\" or \"1.3\"", name)
+	}
+
+	return version, nil
 }

pkg/http/server/server.go

@@ -28,17 +28,30 @@ func New(logger *slog.Logger, cfg Config, handler http.Handler) (*Server, error)
 		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot build http server, logger is required")
 	}
 
+	if err := cfg.Validate(); err != nil {
+		return nil, err
+	}
+
 	srv := &http.Server{
 		Addr:           cfg.Address,
 		Handler:        handler,
-		ReadTimeout:    10 * time.Second,
-		WriteTimeout:   10 * time.Second,
+		ReadTimeout:    cfg.ReadTimeout,
+		WriteTimeout:   cfg.WriteTimeout,
 		MaxHeaderBytes: 1 << 20,
 	}
 
+	if cfg.TLS.Enabled {
+		tlsConfig, err := cfg.TLS.Config()
+		if err != nil {
+			return nil, err
+		}
+
+		srv.TLSConfig = tlsConfig
+	}
+
 	return &Server{
 		srv:     srv,
-		logger:  logger.With(slog.String("pkg", "go.signoz.io/pkg/http/server")),
+		logger:  logger.With(slog.String("pkg", "github.com/SigNoz/signoz/pkg/http/server")),
 		handler: handler,
 		cfg:     cfg,
 	}, nil
@@ -46,11 +59,18 @@ func New(logger *slog.Logger, cfg Config, handler http.Handler) (*Server, error)
 
 func (server *Server) Start(ctx context.Context) error {
 	server.logger.InfoContext(ctx, "starting http server", slog.String("address", server.srv.Addr))
-	if err := server.srv.ListenAndServe(); err != nil {
-		if err != http.ErrServerClosed {
-			server.logger.ErrorContext(ctx, "failed to start server", errors.Attr(err))
-			return err
-		}
+
+	var err error
+	if server.cfg.TLS.Enabled {
+		// The certificate is already loaded in TLSConfig, so ListenAndServeTLS needs no file paths.
+		err = server.srv.ListenAndServeTLS("", "")
+	} else {
+		err = server.srv.ListenAndServe()
+	}
+
+	if err != nil && err != http.ErrServerClosed {
+		server.logger.ErrorContext(ctx, "failed to start server", errors.Attr(err))
+		return err
 	}
 	return nil
 }

pkg/http/server/server_test.go

@@ -0,0 +1,221 @@
+package server
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"io"
+	"log/slog"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNew(t *testing.T) {
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+	certFile, keyFile := writeSelfSignedCert(t)
+
+	corruptFile := filepath.Join(t.TempDir(), "corrupt.crt")
+	require.NoError(t, os.WriteFile(corruptFile, []byte("not a pem"), 0o644))
+
+	testCases := []struct {
+		name       string
+		config     Config
+		err        bool
+		minVersion uint16
+	}{
+		{
+			name:   "TLSDisabled",
+			config: Config{},
+		},
+		{
+			name:   "TLSDisabled_WithCertAndKey",
+			config: Config{TLS: TLS{CertFile: "ignored.crt", KeyFile: "ignored.key"}},
+		},
+		{
+			name:   "TLSEnabled_WithoutCertAndKey",
+			config: Config{TLS: TLS{Enabled: true}},
+			err:    true,
+		},
+		{
+			name:   "TLSEnabled_WithoutKey",
+			config: Config{TLS: TLS{Enabled: true, CertFile: "server.crt"}},
+			err:    true,
+		},
+		{
+			name:   "TLSEnabled_WithoutCert",
+			config: Config{TLS: TLS{Enabled: true, KeyFile: "server.key"}},
+			err:    true,
+		},
+		{
+			name:   "TLSEnabled_InvalidMinVersion",
+			config: Config{TLS: TLS{Enabled: true, CertFile: "tls.crt", KeyFile: "tls.key", MinVersion: "1.1"}},
+			err:    true,
+		},
+		{
+			name:   "TLSEnabled_MissingFiles",
+			config: Config{TLS: TLS{Enabled: true, CertFile: "missing.crt", KeyFile: "missing.key"}},
+			err:    true,
+		},
+		{
+			name:   "TLSEnabled_CorruptCertFile",
+			config: Config{TLS: TLS{Enabled: true, CertFile: corruptFile, KeyFile: keyFile}},
+			err:    true,
+		},
+		{
+			name:   "TLSEnabled_DefaultVersions",
+			config: Config{TLS: TLS{Enabled: true, CertFile: certFile, KeyFile: keyFile}},
+		},
+		{
+			name:       "TLSEnabled_WithMin",
+			config:     Config{TLS: TLS{Enabled: true, CertFile: certFile, KeyFile: keyFile, MinVersion: "1.3"}},
+			minVersion: tls.VersionTLS13,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			server, err := New(logger, testCase.config, handler)
+			if testCase.err {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			if !testCase.config.TLS.Enabled {
+				assert.Nil(t, server.srv.TLSConfig)
+				return
+			}
+
+			require.NotNil(t, server.srv.TLSConfig)
+			assert.Len(t, server.srv.TLSConfig.Certificates, 1)
+			assert.Equal(t, testCase.minVersion, server.srv.TLSConfig.MinVersion)
+		})
+	}
+}
+
+func TestStartWithTLS(t *testing.T) {
+	certFile, keyFile := writeSelfSignedCert(t)
+	addr := freeAddr(t)
+
+	server, err := New(
+		slog.New(slog.NewTextHandler(io.Discard, nil)),
+		Config{Address: addr, TLS: TLS{Enabled: true, CertFile: certFile, KeyFile: keyFile}},
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte("ok")) }),
+	)
+	require.NoError(t, err)
+
+	errC := make(chan error, 1)
+	go func() { errC <- server.Start(context.Background()) }()
+
+	certPEM, err := os.ReadFile(certFile)
+	require.NoError(t, err)
+	pool := x509.NewCertPool()
+	require.True(t, pool.AppendCertsFromPEM(certPEM))
+	client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool}}}
+
+	var resp *http.Response
+	require.Eventually(t, func() bool {
+		resp, err = client.Get("https://" + addr)
+		return err == nil
+	}, 5*time.Second, 25*time.Millisecond)
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "ok", string(body))
+	require.NotNil(t, resp.TLS)
+	assert.GreaterOrEqual(t, resp.TLS.Version, uint16(tls.VersionTLS12))
+
+	plainResp, err := http.Get("http://" + addr)
+	require.NoError(t, err)
+	_ = plainResp.Body.Close()
+	assert.Equal(t, http.StatusBadRequest, plainResp.StatusCode)
+
+	require.NoError(t, server.Stop(context.Background()))
+	require.NoError(t, <-errC)
+}
+
+func TestStartWithoutTLS(t *testing.T) {
+	addr := freeAddr(t)
+
+	server, err := New(
+		slog.New(slog.NewTextHandler(io.Discard, nil)),
+		Config{Address: addr},
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte("pong")) }),
+	)
+	require.NoError(t, err)
+
+	errC := make(chan error, 1)
+	go func() { errC <- server.Start(context.Background()) }()
+
+	var resp *http.Response
+	require.Eventually(t, func() bool {
+		var err error
+		resp, err = http.Get("http://" + addr)
+		return err == nil
+	}, 5*time.Second, 25*time.Millisecond)
+	defer func() { _ = resp.Body.Close() }()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Nil(t, resp.TLS)
+
+	require.NoError(t, server.Stop(context.Background()))
+	require.NoError(t, <-errC)
+}
+
+func freeAddr(t *testing.T) string {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer func() { _ = listener.Close() }()
+
+	return listener.Addr().String()
+}
+
+func writeSelfSignedCert(t *testing.T) (string, string) {
+	t.Helper()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "localhost"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	require.NoError(t, err)
+
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	require.NoError(t, err)
+
+	dir := t.TempDir()
+	certFile := filepath.Join(dir, "server.crt")
+	keyFile := filepath.Join(dir, "server.key")
+
+	require.NoError(t, os.WriteFile(certFile, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o644))
+	require.NoError(t, os.WriteFile(keyFile, pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}), 0o600))
+
+	return certFile, keyFile
+}

pkg/pprof/httppprof/provider.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	nethttppprof "net/http/pprof"
 	runtimepprof "runtime/pprof"
+	"time"
 
 	"github.com/SigNoz/signoz/pkg/factory"
 	httpserver "github.com/SigNoz/signoz/pkg/http/server"
@@ -23,7 +24,7 @@ func NewFactory() factory.ProviderFactory[pprof.PProf, pprof.Config] {
 func New(_ context.Context, settings factory.ProviderSettings, config pprof.Config) (pprof.PProf, error) {
 	server, err := httpserver.New(
 		settings.Logger.With(slog.String("pkg", "github.com/SigNoz/signoz/pkg/pprof/httppprof")),
-		httpserver.Config{Address: config.Address},
+		httpserver.Config{Address: config.Address, ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second},
 		newHandler(),
 	)
 	if err != nil {

pkg/query-service/app/http_handler.go

@@ -4070,20 +4070,20 @@ func (aH *APIHandler) RegisterTraceFunnelsRoutes(router *mux.Router, am *middlew
 		Methods(http.MethodPut)
 
 	// Analytics endpoints
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/validate", aH.handleValidateTraces).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/overview", aH.handleFunnelAnalytics).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps", aH.handleStepAnalytics).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps/overview", aH.handleFunnelStepAnalytics).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/slow-traces", aH.handleFunnelSlowTraces).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/error-traces", aH.handleFunnelErrorTraces).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/validate", am.ViewAccess(aH.handleValidateTraces)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/overview", am.ViewAccess(aH.handleFunnelAnalytics)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps", am.ViewAccess(aH.handleStepAnalytics)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps/overview", am.ViewAccess(aH.handleFunnelStepAnalytics)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/slow-traces", am.ViewAccess(aH.handleFunnelSlowTraces)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/error-traces", am.ViewAccess(aH.handleFunnelErrorTraces)).Methods("POST")
 
 	// Analytics endpoints
-	traceFunnelsRouter.HandleFunc("/analytics/validate", aH.handleValidateTracesWithPayload).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/overview", aH.handleFunnelAnalyticsWithPayload).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/steps", aH.handleStepAnalyticsWithPayload).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/steps/overview", aH.handleFunnelStepAnalyticsWithPayload).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/slow-traces", aH.handleFunnelSlowTracesWithPayload).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/error-traces", aH.handleFunnelErrorTracesWithPayload).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/validate", am.ViewAccess(aH.handleValidateTracesWithPayload)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/overview", am.ViewAccess(aH.handleFunnelAnalyticsWithPayload)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/steps", am.ViewAccess(aH.handleStepAnalyticsWithPayload)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/steps/overview", am.ViewAccess(aH.handleFunnelStepAnalyticsWithPayload)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/slow-traces", am.ViewAccess(aH.handleFunnelSlowTracesWithPayload)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/error-traces", am.ViewAccess(aH.handleFunnelErrorTracesWithPayload)).Methods("POST")
 }
 
 func (aH *APIHandler) handleValidateTraces(w http.ResponseWriter, r *http.Request) {

pkg/query-service/app/server.go

@@ -2,19 +2,9 @@ package app
 
 import (
 	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"slices"
 
-	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/queryparser"
 
-	"github.com/gorilla/handlers"
-
-	"github.com/rs/cors"
-	"github.com/soheilhy/cmux"
-
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
@@ -23,31 +13,15 @@ import (
 	"github.com/SigNoz/signoz/pkg/query-service/app/opamp"
 	opAmpModel "github.com/SigNoz/signoz/pkg/query-service/app/opamp/model"
 	"github.com/SigNoz/signoz/pkg/signoz"
-	"github.com/SigNoz/signoz/pkg/web"
 
 	"log/slog"
 
-	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
-	"go.opentelemetry.io/otel/propagation"
-
 	"github.com/SigNoz/signoz/pkg/query-service/constants"
-	"github.com/SigNoz/signoz/pkg/query-service/healthcheck"
-	"github.com/SigNoz/signoz/pkg/query-service/utils"
 )
 
-// Server runs HTTP, Mux and a grpc server
+// Server runs auxiliary servers (opamp) alongside the signoz apiserver
 type Server struct {
-	config signoz.Config
-	signoz *signoz.SigNoz
-
-	// public http router
-	httpConn     net.Listener
-	httpServer   *http.Server
-	httpHostPort string
-
 	opampServer *opamp.Server
-
-	unavailableChannel chan healthcheck.Status
 }
 
 // NewServer creates and initializes Server
@@ -90,20 +64,20 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
-	s := &Server{
-		config:             config,
-		signoz:             signoz,
-		httpHostPort:       constants.HTTPHostPort,
-		unavailableChannel: make(chan healthcheck.Status),
-	}
+	// Register the legacy query-service routes on the apiserver router. The
+	// apiserver owns the HTTP server and applies the middleware chain at serve
+	// time, so these routes get the same treatment as the apiserver routes.
+	r := signoz.APIServer.Router()
+	am := middleware.NewAuthZ(signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter, signoz.Authz)
 
-	httpServer, err := s.createPublicServer(apiHandler, signoz.Web)
-
-	if err != nil {
-		return nil, err
-	}
-
-	s.httpServer = httpServer
+	apiHandler.RegisterRoutes(r, am)
+	apiHandler.RegisterLogsRoutes(r, am)
+	apiHandler.RegisterIntegrationRoutes(r, am)
+	apiHandler.RegisterQueryRangeV3Routes(r, am)
+	apiHandler.RegisterQueryRangeV4Routes(r, am)
+	apiHandler.RegisterMessagingQueuesRoutes(r, am)
+	apiHandler.RegisterThirdPartyApiRoutes(r, am)
+	apiHandler.RegisterTraceFunnelsRoutes(r, am)
 
 	opAmpModel.Init(signoz.SQLStore, signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter)
 
@@ -121,6 +95,8 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
+	s := &Server{}
+
 	s.opampServer = opamp.InitializeServer(
 		&opAmpModel.AllAgents,
 		agentConfMgr,
@@ -130,146 +106,18 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 	return s, nil
 }
 
-// HealthCheckStatus returns health check status channel a client can subscribe to
-func (s Server) HealthCheckStatus() chan healthcheck.Status {
-	return s.unavailableChannel
-}
-
-func (s *Server) createPublicServer(api *APIHandler, web web.Web) (*http.Server, error) {
-	r := NewRouter()
-
-	r.Use(middleware.NewRecovery(s.signoz.Instrumentation.Logger()).Wrap)
-	r.Use(otelmux.Middleware(
-		"apiserver",
-		otelmux.WithMeterProvider(s.signoz.Instrumentation.MeterProvider()),
-		otelmux.WithTracerProvider(s.signoz.Instrumentation.TracerProvider()),
-		otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
-		otelmux.WithFilter(func(r *http.Request) bool {
-			return !slices.Contains([]string{"/api/v1/health"}, r.URL.Path)
-		}),
-	))
-	r.Use(middleware.NewIdentN(s.signoz.IdentNResolver, s.signoz.Sharder, s.signoz.Instrumentation.Logger()).Wrap)
-	r.Use(middleware.NewTimeout(s.signoz.Instrumentation.Logger(),
-		s.config.APIServer.Timeout.ExcludedRoutes,
-		s.config.APIServer.Timeout.Default,
-		s.config.APIServer.Timeout.Max,
-	).Wrap)
-	r.Use(middleware.NewResource(s.signoz.Instrumentation.Logger()).Wrap)
-	r.Use(middleware.NewAudit(s.signoz.Instrumentation.Logger(), s.config.APIServer.Logging.ExcludedRoutes, s.signoz.Auditor).Wrap)
-	r.Use(middleware.NewComment().Wrap)
-
-	am := middleware.NewAuthZ(s.signoz.Instrumentation.Logger(), s.signoz.Modules.OrgGetter, s.signoz.Authz)
-
-	api.RegisterRoutes(r, am)
-	api.RegisterLogsRoutes(r, am)
-	api.RegisterIntegrationRoutes(r, am)
-	api.RegisterQueryRangeV3Routes(r, am)
-	api.RegisterQueryRangeV4Routes(r, am)
-	api.RegisterMessagingQueuesRoutes(r, am)
-	api.RegisterThirdPartyApiRoutes(r, am)
-	api.RegisterTraceFunnelsRoutes(r, am)
-
-	err := s.signoz.APIServer.AddToRouter(r)
-	if err != nil {
-		return nil, err
-	}
-
-	c := cors.New(cors.Options{
-		AllowedOrigins: []string{"*"},
-		AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
-		AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control"},
-	})
-
-	handler := c.Handler(r)
-
-	handler = handlers.CompressHandler(handler)
-
-	err = web.AddToRouter(r)
-	if err != nil {
-		return nil, err
-	}
-
-	routePrefix := s.config.Global.ExternalPath()
-	if routePrefix != "" {
-		prefixed := http.StripPrefix(routePrefix, handler)
-		handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-			switch req.URL.Path {
-			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
-				r.ServeHTTP(w, req)
-				return
-			}
-
-			prefixed.ServeHTTP(w, req)
-		})
-	}
-
-	return &http.Server{
-		Handler: handler,
-	}, nil
-}
-
-// initListeners initialises listeners of the server
-func (s *Server) initListeners() error {
-	// listen on public port
-	var err error
-	publicHostPort := s.httpHostPort
-	if publicHostPort == "" {
-		return fmt.Errorf("constants.HTTPHostPort is required")
-	}
-
-	s.httpConn, err = net.Listen("tcp", publicHostPort)
-	if err != nil {
-		return err
-	}
-
-	slog.Info(fmt.Sprintf("Query server started listening on %s...", s.httpHostPort))
-
-	return nil
-}
-
-// Start listening on http and private http port concurrently
+// Start starts the opamp websocket server. The HTTP API server is started by
+// the signoz registry.
 func (s *Server) Start(ctx context.Context) error {
-	err := s.initListeners()
-	if err != nil {
+	slog.Info("Starting OpAmp Websocket server", "addr", constants.OpAmpWsEndpoint)
+	if err := s.opampServer.Start(constants.OpAmpWsEndpoint); err != nil {
 		return err
 	}
 
-	var httpPort int
-	if port, err := utils.GetPort(s.httpConn.Addr()); err == nil {
-		httpPort = port
-	}
-
-	go func() {
-		slog.Info("Starting HTTP server", "port", httpPort, "addr", s.httpHostPort)
-
-		switch err := s.httpServer.Serve(s.httpConn); err {
-		case nil, http.ErrServerClosed, cmux.ErrListenerClosed:
-			// normal exit, nothing to do
-		default:
-			slog.Error("Could not start HTTP server", errors.Attr(err))
-		}
-		s.unavailableChannel <- healthcheck.Unavailable
-	}()
-
-	go func() {
-		slog.Info("Starting OpAmp Websocket server", "addr", constants.OpAmpWsEndpoint)
-		err := s.opampServer.Start(constants.OpAmpWsEndpoint)
-		if err != nil {
-			slog.Error("opamp ws server failed to start", errors.Attr(err))
-			s.unavailableChannel <- healthcheck.Unavailable
-		}
-	}()
-
 	return nil
 }
 
 func (s *Server) Stop(ctx context.Context) error {
-	if s.httpServer != nil {
-		if err := s.httpServer.Shutdown(context.Background()); err != nil {
-			return err
-		}
-	}
-
 	s.opampServer.Stop()
 
 	return nil

pkg/query-service/constants/constants.go

@@ -10,11 +10,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-const (
-	HTTPHostPort    = "0.0.0.0:8080" // Address to serve http (query service)
-	PrivateHostPort = "0.0.0.0:8085" // Address to server internal services like alert manager
-	OpAmpWsEndpoint = "0.0.0.0:4320" // address for opamp websocket
-)
+const OpAmpWsEndpoint = "0.0.0.0:4320" // address for opamp websocket
 
 const MaxAllowedPointsInTimeSeries = 300
 

pkg/query-service/healthcheck/handler.go

@@ -1,12 +0,0 @@
-package healthcheck
-
-const (
-	// Unavailable indicates the service is not able to handle requests
-	Unavailable Status = iota
-	// Ready indicates the service is ready to handle requests
-	Ready
-	// Broken indicates that the healthcheck itself is broken, not serving HTTP
-	Broken
-)
-
-type Status int

pkg/signoz/openapi.go

@@ -10,12 +10,14 @@ import (
 	"github.com/SigNoz/signoz/pkg/alertmanager"
 	"github.com/SigNoz/signoz/pkg/apiserver"
 	"github.com/SigNoz/signoz/pkg/apiserver/signozapiserver"
+	"github.com/SigNoz/signoz/pkg/auditor"
 	"github.com/SigNoz/signoz/pkg/authz"
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
 	"github.com/SigNoz/signoz/pkg/gateway"
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/identn"
 	"github.com/SigNoz/signoz/pkg/instrumentation"
 	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/modules/aiobservability"
@@ -42,9 +44,11 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/statsreporter"
 	"github.com/SigNoz/signoz/pkg/subscription"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/web"
 	"github.com/SigNoz/signoz/pkg/zeus"
 	"github.com/swaggest/jsonschema-go"
 	"github.com/swaggest/openapi-go"
@@ -101,6 +105,11 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ ruler.Handler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
+		global.Config{},
+		struct{ identn.IdentNResolver }{},
+		struct{ sharder.Sharder }{},
+		struct{ auditor.Auditor }{},
+		struct{ web.Web }{},
 		struct{ quickfilter.Module }{},
 		struct{ quickfilter.Handler }{},
 	).New(ctx, instrumentation.ToProviderSettings(), apiserver.Config{})

pkg/signoz/provider.go

@@ -319,7 +319,7 @@ func NewQuerierProviderFactories(telemetryStore telemetrystore.TelemetryStore, p
 	)
 }
 
-func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
+func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
 	return factory.MustNewNamedMap(
 		signozapiserver.NewFactory(
 			orgGetter,
@@ -361,6 +361,11 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RulerHandler,
 			handlers.StatsHandler,
 			handlers.SavedView,
+			globalConfig,
+			identNResolver,
+			sharder,
+			auditor,
+			web,
 			modules.QuickFilter,
 			handlers.QuickFilter,
 		),

pkg/signoz/provider_test.go

@@ -102,6 +102,10 @@ func TestNewProviderFactories(t *testing.T) {
 			Handlers{},
 			global.Config{},
 			nil,
+			nil,
+			nil,
+			nil,
+			nil,
 		)
 	})
 }

pkg/signoz/signoz.go

@@ -635,13 +635,20 @@ func New(
 		ctx,
 		providerSettings,
 		config.APIServer,
-		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway),
+		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web),
 		"signoz",
 	)
 	if err != nil {
 		return nil, err
 	}
 
+	// Register the API server with the registry so its lifecycle is managed
+	// alongside the other services and it shows up in the health endpoint.
+	err = registry.Add(ctx, factory.NewNamedService(factory.MustNewName("apiserver"), apiserverInstance))
+	if err != nil {
+		return nil, err
+	}
+
 	return &SigNoz{
 		Registry:               registry,
 		Analytics:              analytics,