fix: honor INGESTION_API_KEY in all-in-one auth image

[gingerwizard]

The all-in-one entrypoint set HYPERDX_IMAGE to values (all-in-one / all-in-one-noauth) that did not match the strings config.ts compares against (all-in-one-auth / all-in-one-noauth). As a result IS_ALL_IN_ONE_IMAGE was never true in the auth image, so INGESTION_API_KEY was silently ignored and the OpAMP-delivered collector config only accepted the team's UI-generated key.

Report all-in-one-auth for the auth variant and all-in-one-noauth for the no-auth variant so a pre-shared INGESTION_API_KEY is added to the collector's accepted bearer tokens, enabling demo/bootstrap stacks to specify a known ingestion key without retrieving it from the UI.

[changeset-bot]

🦋 Changeset detected

Latest commit: 01dab46

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@hyperdx/api	Patch
@hyperdx/app	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@gingerwizard is attempting to deploy a commit to the HyperDX Team on Vercel.

A member of the Team first needs to authorize it.

[gingerwizard]

As to why I want to do this - it makes demos flow much easier, and it makes the getting started guide much simpler. @MikeShi42 I don't need to go and get auth keys from the front end.

[greptile-apps]

Greptile Summary

This PR fixes a silent misconfiguration where the all-in-one-auth image variant never honored INGESTION_API_KEY because entry.local.base.sh exported wrong HYPERDX_IMAGE values that didn't match the string literals checked in config.ts.

• Shell script fix: The ternary in entry.local.base.sh is corrected so that the auth variant exports HYPERDX_IMAGE=all-in-one-auth and the noauth variant exports all-in-one-noauth, matching the exact strings compared in config.ts.
• Changeset added: A patch-level changelog entry is included documenting the root cause and the corrected behavior.

Confidence Score: 5/5

Safe to merge — the change is a one-line string correction in a shell entrypoint and a changeset file, with no new logic introduced.

The fix directly aligns the exported HYPERDX_IMAGE values with the exact string literals compared in config.ts. Both call sites are verified: the auth variant now resolves to IS_ALL_IN_ONE_IMAGE=true and the noauth variant continues to resolve correctly, so both paths for INGESTION_API_KEY injection in opampController.ts work correctly.

No files require special attention.

Important Files Changed

Filename	Overview
docker/hyperdx/entry.local.base.sh	Corrects HYPERDX_IMAGE values to match the exact strings config.ts checks: auth variant now exports "all-in-one-auth" and noauth variant exports "all-in-one-noauth". A clarifying comment is added linking back to config.ts constants.
.changeset/fix-all-in-one-ingestion-api-key.md	New patch-level changeset entry for the @hyperdx/api package clearly describing the root cause and the corrected behavior.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant E as entry.local.auth.sh
    participant B as entry.local.base.sh
    participant C as config.ts
    participant O as opampController.ts

    E->>B: "source (IS_LOCAL_APP_MODE=REQUIRED_AUTH)"
    B->>B: "IS_LOCAL_APP_MODE != DANGEROUSLY"
    Note over B: OLD: HYPERDX_IMAGE=all-in-one-noauth
    Note over B: NEW: HYPERDX_IMAGE=all-in-one-auth
    B-->>C: env HYPERDX_IMAGE
    C->>C: IS_ALL_IN_ONE_IMAGE check
    Note over C: OLD: false
    Note over C: NEW: true
    C-->>O: IS_ALL_IN_ONE_IMAGE
    O->>O: push INGESTION_API_KEY if true
    Note over O: OLD: silently ignored
    Note over O: NEW: honored

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant E as entry.local.auth.sh
    participant B as entry.local.base.sh
    participant C as config.ts
    participant O as opampController.ts

    E->>B: "source (IS_LOCAL_APP_MODE=REQUIRED_AUTH)"
    B->>B: "IS_LOCAL_APP_MODE != DANGEROUSLY"
    Note over B: OLD: HYPERDX_IMAGE=all-in-one-noauth
    Note over B: NEW: HYPERDX_IMAGE=all-in-one-auth
    B-->>C: env HYPERDX_IMAGE
    C->>C: IS_ALL_IN_ONE_IMAGE check
    Note over C: OLD: false
    Note over C: NEW: true
    C-->>O: IS_ALL_IN_ONE_IMAGE
    O->>O: push INGESTION_API_KEY if true
    Note over O: OLD: silently ignored
    Note over O: NEW: honored

Loading

_{Reviews (4): Last reviewed commit: "Merge branch 'main' into claude/fix-all-..." | Re-trigger Greptile}