alot more changes

k8s/deployment.yaml

@@ -40,6 +40,8 @@ spec:
           name: grpc
         - containerPort: 4318
           name: otlp-http
+        - containerPort: 6060
+          name: pprof
         env:
         - name: GRPC_GO_LOG_SEVERITY_LEVEL
           value: "info"
@@ -47,6 +49,21 @@ spec:
           value: "/logs/otel-agent.log"
         - name: OTEL_SOURCEMAP_DIR
           value: "/sourcemaps"
+        # Shared key required to POST /api/sourcemaps (X-Sourcemap-Key header);
+        # uploads are refused while it is unset.
+        - name: OTEL_SOURCEMAP_KEY
+          valueFrom:
+            secretKeyRef:
+              name: otel-sourcemap-key
+              key: key
+        # AbuseIPDB API key for authenticated IP checks/reports from the UI.
+        # Create out of band: kubectl create secret generic abuseipdb-key -n monitoring --from-literal=key=...
+        - name: ABUSE_KEY
+          valueFrom:
+            secretKeyRef:
+              name: abuseipdb-key
+              key: key
+              optional: true
         - name: OTEL_OIDC_ISSUER
           value: "https://users.k6n.net"
         - name: OTEL_OIDC_CLIENT_ID
@@ -127,6 +144,13 @@ spec:
         # service account below. Leave Prometheus unset when unavailable.
         - name: OTEL_KUBERNETES_NAMESPACE
           value: ""
+        # Enable the explicitly requested, rate-limited Nmap service probe.
+        # This is kept opt-in because it generates active traffic to external IPs.
+        - name: OTEL_IP_INVESTIGATION_NMAP
+          value: "true"
+        # Whole-scan budget; scans run in the background and are stored.
+        - name: OTEL_IP_INVESTIGATION_NMAP_TIMEOUT
+          value: "5m"
         # - name: OTEL_PROMETHEUS_URL
         #   value: "http://prometheus.monitoring.svc.cluster.local:9090"
         # Private token for an ingress-side synchronizer. If absent, the