From 73d518d51109dcdd1bf605c7825ea1ab8317844d Mon Sep 17 00:00:00 2001
From: Ravi Kumar L <ravi.lazar@clickhouse.com>
Date: Mon, 29 Jun 2026 14:01:12 +0200
Subject: [PATCH] fix(langfuse): allow fanout central base url secret

---
 .../templates/langfuse-fanout-deployment.yaml | 14 +++++++++++++
 .../tests/langfuse_fanout_selector_test.sh    | 21 +++++++++++++++++++
 helm/librechat/values.yaml                    |  3 +++
 otel/langfuse-fanout/README.md                |  7 ++++++-
 4 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/helm/librechat/templates/langfuse-fanout-deployment.yaml b/helm/librechat/templates/langfuse-fanout-deployment.yaml
index f17775b43a..b8ad83033d 100644
--- a/helm/librechat/templates/langfuse-fanout-deployment.yaml
+++ b/helm/librechat/templates/langfuse-fanout-deployment.yaml
@@ -45,7 +45,14 @@ spec:
               protocol: TCP
           env:
             - name: LANGFUSE_FANOUT_CENTRAL_BASE_URL
+            {{- with .Values.langfuseFanout.central.baseUrlSecret.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ . | quote }}
+                  key: {{ $.Values.langfuseFanout.central.baseUrlSecret.key | quote }}
+            {{- else }}
               value: {{ .Values.langfuseFanout.central.baseUrl | quote }}
+            {{- end }}
             - name: LANGFUSE_FANOUT_CENTRAL_AUTH_HEADER
               valueFrom:
                 secretKeyRef:
@@ -99,7 +106,14 @@ spec:
               protocol: TCP
           env:
             - name: LANGFUSE_FANOUT_CENTRAL_BASE_URL
+            {{- with .Values.langfuseFanout.central.baseUrlSecret.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ . | quote }}
+                  key: {{ $.Values.langfuseFanout.central.baseUrlSecret.key | quote }}
+            {{- else }}
               value: {{ .Values.langfuseFanout.central.baseUrl | quote }}
+            {{- end }}
             - name: LANGFUSE_FANOUT_CENTRAL_AUTH_HEADER
               valueFrom:
                 secretKeyRef:
diff --git a/helm/librechat/tests/langfuse_fanout_selector_test.sh b/helm/librechat/tests/langfuse_fanout_selector_test.sh
index 52da4579fb..1d35b53641 100755
--- a/helm/librechat/tests/langfuse_fanout_selector_test.sh
+++ b/helm/librechat/tests/langfuse_fanout_selector_test.sh
@@ -32,6 +32,8 @@ cp "${CHART_DIR}/templates/langfuse-fanout-deployment.yaml" \
 
 helm template librechat "${RENDER_CHART_DIR}" \
   --set langfuseFanout.enabled=true \
+  --set langfuseFanout.central.baseUrlSecret.name=librechat \
+  --set langfuseFanout.central.baseUrlSecret.key=LANGFUSE_BASE_URL \
   --set langfuseFanout.central.authHeaderSecret.name=langfuse-central \
   --set langfuseFanout.redis.uri=redis://langfuse-fanout-redis:6379 \
   --show-only templates/service.yaml \
@@ -109,6 +111,10 @@ function envValue(env, name) {
   return (env ?? []).find((entry) => entry.name === name)?.value;
 }
 
+function envEntry(env, name) {
+  return (env ?? []).find((entry) => entry.name === name);
+}
+
 const mainService = find('Service', 'librechat-librechat');
 const fanoutService = find('Service', 'librechat-librechat-langfuse-fanout');
 const fanoutDeployment = find('Deployment', 'librechat-librechat-langfuse-fanout');
@@ -118,6 +124,12 @@ const fanoutContainer = fanoutDeployment.spec?.template?.spec?.containers?.find(
 if (!fanoutContainer) {
   fail('missing langfuse-fanout container');
 }
+const otelCollectorContainer = fanoutDeployment.spec?.template?.spec?.containers?.find(
+  (container) => container.name === 'otelcol',
+);
+if (!otelCollectorContainer) {
+  fail('missing otelcol container');
+}
 
 const mainSelector = mainService.spec?.selector ?? {};
 const fanoutSelector = fanoutService.spec?.selector ?? {};
@@ -143,6 +155,15 @@ if (fanoutMetadataLabels['app.kubernetes.io/name'] !== fanoutSelector['app.kuber
 if (envValue(fanoutContainer.env, 'LANGFUSE_FANOUT_REDIS_URI') !== 'redis://langfuse-fanout-redis:6379') {
   fail('fanout Deployment did not render configured Redis URI');
 }
+for (const container of [fanoutContainer, otelCollectorContainer]) {
+  const centralBaseUrl = envEntry(container.env, 'LANGFUSE_FANOUT_CENTRAL_BASE_URL');
+  if (
+    centralBaseUrl?.valueFrom?.secretKeyRef?.name !== 'librechat' ||
+    centralBaseUrl?.valueFrom?.secretKeyRef?.key !== 'LANGFUSE_BASE_URL'
+  ) {
+    fail(`${container.name} did not render central base URL from the configured secret`);
+  }
+}
 if (
   envValue(fanoutContainer.env, 'LANGFUSE_FANOUT_PUBLIC_URL') !==
   'http://librechat-librechat-langfuse-fanout.default.svc.cluster.local:4318'
diff --git a/helm/librechat/values.yaml b/helm/librechat/values.yaml
index bcefc74342..5a08f80171 100755
--- a/helm/librechat/values.yaml
+++ b/helm/librechat/values.yaml
@@ -304,6 +304,9 @@ langfuseFanout:
     annotations: {}
   central:
     baseUrl: https://cloud.langfuse.com
+    baseUrlSecret:
+      name: ""
+      key: LANGFUSE_BASE_URL
     authHeaderSecret:
       name: ""
       key: LANGFUSE_FANOUT_CENTRAL_AUTH_HEADER
diff --git a/otel/langfuse-fanout/README.md b/otel/langfuse-fanout/README.md
index f78fa16bab..b57942e707 100644
--- a/otel/langfuse-fanout/README.md
+++ b/otel/langfuse-fanout/README.md
@@ -179,7 +179,12 @@ redis:
 langfuseFanout:
   enabled: true
   central:
-    baseUrl: https://cloud.langfuse.com
+    # Use either baseUrl or baseUrlSecret. baseUrlSecret lets deployments reuse
+    # an existing LANGFUSE_BASE_URL secret instead of duplicating the URL.
+    baseUrl: ""
+    baseUrlSecret:
+      name: librechat
+      key: LANGFUSE_BASE_URL
     authHeaderSecret:
       name: langfuse-central
       key: LANGFUSE_FANOUT_CENTRAL_AUTH_HEADER