Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

ingest/internal/config/config.go

@@ -0,0 +1,95 @@
+// Package config loads ingest's configuration from environment variables.
+// Phase 0 deliberately has no config file format of its own — env vars are
+// enough for a docker-compose/k8s deployment and avoid pulling in a config
+// library.
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+type Config struct {
+	GRPC       GRPCConfig
+	TLS        TLSConfig
+	Redpanda   RedpandaConfig
+	ClickHouse ClickHouseConfig
+	Batch      BatchConfig
+}
+
+type GRPCConfig struct {
+	ListenAddr string
+}
+
+// TLSConfig is the server-side mTLS material: the ingest service's own
+// cert/key, and the CA used to verify agent client certs.
+type TLSConfig struct {
+	CertFile     string
+	KeyFile      string
+	ClientCAFile string
+}
+
+type RedpandaConfig struct {
+	Brokers       []string
+	Topic         string
+	ConsumerGroup string
+}
+
+type ClickHouseConfig struct {
+	Addr     string
+	Database string
+	Username string
+	Password string
+}
+
+type BatchConfig struct {
+	MaxSize         int
+	FlushIntervalMS int
+}
+
+func Load() (Config, error) {
+	cfg := Config{
+		GRPC: GRPCConfig{
+			ListenAddr: getenv("GRPC_LISTEN_ADDR", ":4317"),
+		},
+		TLS: TLSConfig{
+			CertFile:     getenv("TLS_CERT_FILE", "/etc/sentry-ingest/server.pem"),
+			KeyFile:      getenv("TLS_KEY_FILE", "/etc/sentry-ingest/server-key.pem"),
+			ClientCAFile: getenv("TLS_CLIENT_CA_FILE", "/etc/sentry-ingest/ca.pem"),
+		},
+		Redpanda: RedpandaConfig{
+			Brokers:       strings.Split(getenv("REDPANDA_BROKERS", "localhost:9092"), ","),
+			Topic:         getenv("REDPANDA_TOPIC", "sentry.logs.raw"),
+			ConsumerGroup: getenv("REDPANDA_CONSUMER_GROUP", "sentry-ingest"),
+		},
+		ClickHouse: ClickHouseConfig{
+			Addr:     getenv("CLICKHOUSE_ADDR", "localhost:9000"),
+			Database: getenv("CLICKHOUSE_DATABASE", "sentry"),
+			Username: getenv("CLICKHOUSE_USERNAME", "default"),
+			Password: getenv("CLICKHOUSE_PASSWORD", ""),
+		},
+	}
+
+	maxSize, err := strconv.Atoi(getenv("CONSUMER_BATCH_MAX_SIZE", "500"))
+	if err != nil {
+		return Config{}, fmt.Errorf("CONSUMER_BATCH_MAX_SIZE: %w", err)
+	}
+	cfg.Batch.MaxSize = maxSize
+
+	flushMS, err := strconv.Atoi(getenv("CONSUMER_BATCH_FLUSH_INTERVAL_MS", "2000"))
+	if err != nil {
+		return Config{}, fmt.Errorf("CONSUMER_BATCH_FLUSH_INTERVAL_MS: %w", err)
+	}
+	cfg.Batch.FlushIntervalMS = flushMS
+
+	return cfg, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}

ingest/internal/config/config_test.go

@@ -0,0 +1,49 @@
+package config
+
+import "testing"
+
+func TestLoadDefaults(t *testing.T) {
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if cfg.GRPC.ListenAddr != ":4317" {
+		t.Errorf("GRPC.ListenAddr = %q, want :4317", cfg.GRPC.ListenAddr)
+	}
+	if cfg.Redpanda.Topic != "sentry.logs.raw" {
+		t.Errorf("Redpanda.Topic = %q, want sentry.logs.raw", cfg.Redpanda.Topic)
+	}
+	if cfg.Batch.MaxSize != 500 {
+		t.Errorf("Batch.MaxSize = %d, want 500", cfg.Batch.MaxSize)
+	}
+	if cfg.Batch.FlushIntervalMS != 2000 {
+		t.Errorf("Batch.FlushIntervalMS = %d, want 2000", cfg.Batch.FlushIntervalMS)
+	}
+}
+
+func TestLoadOverridesFromEnv(t *testing.T) {
+	t.Setenv("GRPC_LISTEN_ADDR", ":9999")
+	t.Setenv("REDPANDA_BROKERS", "a:9092,b:9092")
+	t.Setenv("CONSUMER_BATCH_MAX_SIZE", "10")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if cfg.GRPC.ListenAddr != ":9999" {
+		t.Errorf("GRPC.ListenAddr = %q, want :9999", cfg.GRPC.ListenAddr)
+	}
+	if len(cfg.Redpanda.Brokers) != 2 || cfg.Redpanda.Brokers[0] != "a:9092" || cfg.Redpanda.Brokers[1] != "b:9092" {
+		t.Errorf("Redpanda.Brokers = %+v, want [a:9092 b:9092]", cfg.Redpanda.Brokers)
+	}
+	if cfg.Batch.MaxSize != 10 {
+		t.Errorf("Batch.MaxSize = %d, want 10", cfg.Batch.MaxSize)
+	}
+}
+
+func TestLoadInvalidBatchSizeErrors(t *testing.T) {
+	t.Setenv("CONSUMER_BATCH_MAX_SIZE", "not-a-number")
+	if _, err := Load(); err == nil {
+		t.Fatal("expected error for non-numeric CONSUMER_BATCH_MAX_SIZE, got nil")
+	}
+}