ВМ1: реализован сбор логов

VM1_app/codebase/backend/tests/test_config.py

@@ -348,9 +348,63 @@ class InfrastructureConfigTests(unittest.TestCase):
             source = service_main.read_text(encoding="utf-8")
             self.assertNotIn("route=request.url.path", source)
             self.assertIn('getattr(request.scope.get("route"), "path"', source)
+        for telemetry_path in (
+            ROOT / "api-backend/app/telemetry.py",
+            ROOT / "sms-service/app/telemetry.py",
+            ROOT / "bitrix-local-app/app/telemetry.py",
+        ):
+            telemetry = telemetry_path.read_text(encoding="utf-8")
+            self.assertIn("OTLPLogExporter", telemetry)
+            self.assertIn("BatchLogRecordProcessor", telemetry)
+            self.assertIn("LoggingHandler", telemetry)
         worker = (ROOT / "sms-service/app/worker.py").read_text(encoding="utf-8")
         for span_name in ("sms.claim", "sms.process", "sms.provider", "sms.save_result"):
             self.assertIn(f'"{span_name}"', worker)
+        bitrix = (ROOT / "bitrix-local-app/app/main.py").read_text(encoding="utf-8")
+        self.assertIn('EXPECTED_BITRIX_DB_REVISION = "0002_inbox_trace_context"', bitrix)
+        self.assertIn("links=origin_links(row.traceparent)", bitrix)
+        bitrix_migration = (
+            ROOT / "bitrix-local-app/alembic/versions/0002_inbox_trace_context.py"
+        ).read_text(encoding="utf-8")
+        self.assertIn('down_revision: str | None = "0001_bitrix_local"', bitrix_migration)
+
+    def test_host_otel_collector_is_hardened_and_allowlisted(self) -> None:
+        config = (
+            ROOT / "deployment/observability/otel-host-collector.yaml"
+        ).read_text(encoding="utf-8")
+        unit = (ROOT / "deployment/han-host-otel-collector@.service").read_text(
+            encoding="utf-8"
+        )
+        setup = (ROOT / "deployment/scripts/setup-vm.sh").read_text(encoding="utf-8")
+        for required in (
+            "filelog/docker",
+            "journald/host",
+            "filter/allowlist",
+            "storage: file_storage",
+            'layout: "2006-01-02T15:04:05.000000000Z07:00"',
+            'set(body, "nginx.access")',
+            'set(body, "keycloak.event")',
+            '{key: uri, action: delete}',
+            'resource.attributes["service.name"] != "nginx"',
+            'resource.attributes["service.name"] != "keycloak"',
+            'resource.attributes["service.name"] != "redis"',
+        ):
+            self.assertIn(required, config)
+        self.assertNotIn("/var/run/docker.sock", config + unit)
+        self.assertNotIn('from: attributes["service.name"]', config)
+        self.assertIn("CapabilityBoundingSet=", unit)
+        self.assertIn("NoNewPrivileges=yes", unit)
+        self.assertIn("ReadOnlyPaths=/var/lib/docker/containers", unit)
+        self.assertIn("ReadWritePaths=/var/lib/han-otel/host-collector", unit)
+        self.assertIn("OTEL_HOST_COLLECTOR_SHA256", setup)
+        self.assertIn("sha256sum -c -", setup)
+        self.assertIn("journalctl --flush", setup)
+        self.assertNotIn("systemctl start han-host-otel-collector", setup)
+        verify = (
+            ROOT / "deployment/scripts/verify-observability.sh"
+        ).read_text(encoding="utf-8")
+        self.assertIn("TELEMETRYGEN_IMAGE", verify)
+        self.assertNotIn("telemetrygen:latest", verify)
 
     def test_settings_cli_and_workers_are_deployable(self) -> None:
         cli = ROOT / "api-backend/app/cli"
@@ -442,7 +496,7 @@ class InfrastructureConfigTests(unittest.TestCase):
             dedup_fix,
         )
         self.assertIn('down_revision: str | None = "0009_chat_message_max"', dedup_fix)
-        self.assertIn('EXPECTED_API_DB_REVISION = "0012_safety_v2_checkpoint"', main)
+        self.assertIn('EXPECTED_API_DB_REVISION = "0013_delivery_trace_context"', main)
 
     def test_consent_audit_migration_supports_existing_and_fresh_databases(self) -> None:
         migration = (