feat: Haystack authenticates with Phoenix using API key (#13)

Author: yoomlam

app/README.md

@@ -66,3 +66,18 @@ cat server.crt rootCA.crt > server-fullchain.crt
      (Use the contents of `rootCA.crt` created in step 1 above.)
 
 5. Restart Phoenix client
+
+
+### Enabling authentication in Phoenix
+
+Based on [documentation](https://arize.com/docs/phoenix/self-hosting/features/authentication), set `PHOENIX_SECRET` in `docker-compose.yaml` as follows.
+* Add these environment variables to the `phoenix` service:
+```
+      - PHOENIX_ENABLE_AUTH=True
+      - PHOENIX_SECRET=SomeLongSecretThatIsUsedToSignJWTsForTheDeployment
+```
+* Restart and log into the Phoenix UI at http://localhost:6006 and create a system API key; copy the API key
+* Add PHOENIX_API_KEY environment variable in `override.env` for the Haystack service to authenticate to Phoenix:
+```
+      - PHOENIX_API_KEY=<paste API key>
+```

app/docker-compose.yml

@@ -38,6 +38,10 @@ services:
       - PHOENIX_TLS_KEY_FILE_PASSWORD=
       # For verifying client certificates
       - PHOENIX_TLS_VERIFY_CLIENT=False
+
+      # See README.md to enable authentication locally
+      # - PHOENIX_ENABLE_AUTH=True
+      # - PHOENIX_SECRET=ThisSecretIsForLocalDevOnly202508251033
     volumes:
       - ./certs:/certs
 

infra/app/app-config/env-config/environment_variables.tf

@@ -27,6 +27,11 @@ locals {
   #   }
   # }
   secrets = {
+    PHOENIX_API_KEY = {
+      manage_method     = "manual"
+      secret_store_name = "/${var.app_name}-${var.environment}/phoenix-api-key"
+    }
+
     # Example generated secret
     # RANDOM_SECRET = {
     #   manage_method     = "generated"