Make a Langfuse trace worth opening: question, answer, session, no probe noise

infra/helm/medical-chatbot/templates/ai-service.yaml

@@ -22,6 +22,9 @@ data:
   OTEL_SERVICE_NAME: ai-service
   OTEL_EXPORTER_OTLP_ENDPOINT: {{ printf "http://%s-otel-collector:4318/v1/traces" (include "medical-chatbot.fullname" .) | quote }}
   OTEL_SAMPLE_RATIO: {{ .Values.aiService.config.otelSampleRatio | quote }}
+  {{- if .Values.aiService.config.langfuseBaseUrl }}
+  LANGFUSE_BASE_URL: {{ .Values.aiService.config.langfuseBaseUrl | quote }}
+  {{- end }}
   MAX_WALL_CLOCK_MS: {{ .Values.aiService.config.maxWallClockMs | quote }}
   MAX_LLM_CALLS_PER_TURN: {{ .Values.aiService.config.maxLlmCallsPerTurn | quote }}
 ---
@@ -81,6 +84,25 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: postgres-dsn
+            {{- if .Values.aiService.config.langfuseBaseUrl }}
+            # Langfuse keys are real credentials, so they come from the
+            # Secret, never the ConfigMap above (which is world-readable to
+            # anyone with namespace get access). Both are marked optional so
+            # a cluster that sets the base URL before creating the Secret
+            # starts anyway, with the exporter simply not added.
+            - name: LANGFUSE_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: langfuse-public-key
+                  optional: true
+            - name: LANGFUSE_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: langfuse-secret-key
+                  optional: true
+            {{- end }}
             {{- if .Values.aws.region }}
             - name: AWS_REGION
               value: {{ .Values.aws.region | quote }}