docs: update HOWTO with observability dashboard, routing, and agent status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat: add dashboard Traefik route and CAMELEER_TENANT_ID config
2026-04-04 21:06:05 +02:00 · 2026-04-04 21:04:57 +02:00 · 2026-04-04 21:03:41 +02:00 · 2026-04-04 21:03:04 +02:00 · 2026-04-04 21:01:43 +02:00 · 2026-04-04 20:57:37 +02:00
25 changed files with 1901 additions and 25 deletions
--- a/.env.example
+++ b/.env.example
@@ -27,3 +27,4 @@ DOMAIN=localhost
 CAMELEER_AUTH_TOKEN=change_me_bootstrap_token
 CAMELEER_CONTAINER_MEMORY_LIMIT=512m
 CAMELEER_CONTAINER_CPU_SHARES=512
+CAMELEER_TENANT_SLUG=default
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
      - name: Build and Test (unit tests only)
        run: >-
          mvn clean verify -B
-          -Dsurefire.excludes="**/AuthControllerTest.java,**/TenantControllerTest.java,**/LicenseControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java,**/EnvironmentControllerTest.java,**/AppControllerTest.java,**/DeploymentControllerTest.java"
+          -Dsurefire.excludes="**/AuthControllerTest.java,**/TenantControllerTest.java,**/LicenseControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java,**/EnvironmentControllerTest.java,**/AppControllerTest.java,**/DeploymentControllerTest.java,**/AgentStatusControllerTest.java"

  docker:
    needs: build
--- a/.gitea/workflows/sonarqube.yml
+++ b/.gitea/workflows/sonarqube.yml
@@ -28,7 +28,7 @@ jobs:
      - name: Build, Test and Analyze
        run: >-
          mvn clean verify sonar:sonar --batch-mode
-          -Dsurefire.excludes="**/AuthControllerTest.java,**/TenantControllerTest.java,**/LicenseControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java,**/EnvironmentControllerTest.java,**/AppControllerTest.java,**/DeploymentControllerTest.java"
+          -Dsurefire.excludes="**/AuthControllerTest.java,**/TenantControllerTest.java,**/LicenseControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java,**/EnvironmentControllerTest.java,**/AppControllerTest.java,**/DeploymentControllerTest.java,**/AgentStatusControllerTest.java"
          -Dsonar.host.url=${{ secrets.SONAR_HOST_URL }}
          -Dsonar.token=${{ secrets.SONAR_TOKEN }}
          -Dsonar.projectKey=cameleer-saas
--- a/6
+++ b/6
@@ -1,11 +1,11 @@
-# Dockerfile
+# syntax=docker/dockerfile:1
 FROM eclipse-temurin:21-jdk-alpine AS build
 WORKDIR /build
 COPY .mvn/ .mvn/
 COPY mvnw pom.xml ./
-RUN ./mvnw dependency:go-offline -B
+RUN --mount=type=cache,target=/root/.m2/repository ./mvnw dependency:go-offline -B
 COPY src/ src/
-RUN ./mvnw package -DskipTests -B
+RUN --mount=type=cache,target=/root/.m2/repository ./mvnw package -DskipTests -B

 FROM eclipse-temurin:21-jre-alpine
 WORKDIR /app
--- a/HOWTO.md
+++ b/HOWTO.md
@@ -0,0 +1,343 @@
+# Cameleer SaaS -- How to Install, Start & Bootstrap
+
+## Quick Start (Development)
+
+```bash
+# 1. Clone
+git clone https://gitea.siegeln.net/cameleer/cameleer-saas.git
+cd cameleer-saas
+
+# 2. Create environment file
+cp .env.example .env
+
+# 3. Generate Ed25519 key pair
+mkdir -p keys
+ssh-keygen -t ed25519 -f keys/ed25519 -N ""
+mv keys/ed25519 keys/ed25519.key
+
+# 4. Start the stack
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+
+# 5. Wait for services to be ready (~30s)
+docker compose logs -f cameleer-saas --since 10s
+# Look for: "Started CameleerSaasApplication"
+
+# 6. Verify
+curl http://localhost:8080/actuator/health
+# {"status":"UP"}
+```
+
+## Prerequisites
+
+- Docker Desktop (Windows/Mac) or Docker Engine 24+ (Linux)
+- Git
+- `curl` or any HTTP client (for testing)
+
+## Architecture
+
+The platform runs as a Docker Compose stack with 6 services:
+
+| Service | Image | Port | Purpose |
+|---------|-------|------|---------|
+| **traefik** | traefik:v3 | 80, 443 | Reverse proxy, TLS, routing |
+| **postgres** | postgres:16-alpine | 5432* | Platform database + Logto database |
+| **logto** | ghcr.io/logto-io/logto | 3001*, 3002* | Identity provider (OIDC) |
+| **cameleer-saas** | cameleer-saas:latest | 8080* | SaaS API server |
+| **cameleer3-server** | cameleer3-server:latest | 8081 | Observability backend |
+| **clickhouse** | clickhouse-server:latest | 8123* | Trace/metrics/log storage |
+
+*Ports exposed to host only with `docker-compose.dev.yml` overlay.
+
+## Installation
+
+### 1. Environment Configuration
+
+```bash
+cp .env.example .env
+```
+
+Edit `.env` and set at minimum:
+
+```bash
+# Change in production
+POSTGRES_PASSWORD=<strong-password>
+CAMELEER_AUTH_TOKEN=<random-string-for-agent-bootstrap>
+CAMELEER_TENANT_SLUG=<your-tenant-slug>   # e.g., "acme" — tags all observability data
+
+# Logto M2M credentials (get from Logto admin console after first boot)
+LOGTO_M2M_CLIENT_ID=
+LOGTO_M2M_CLIENT_SECRET=
+```
+
+### 2. Ed25519 Keys
+
+The platform uses Ed25519 keys for license signing and machine token verification.
+
+```bash
+mkdir -p keys
+ssh-keygen -t ed25519 -f keys/ed25519 -N ""
+mv keys/ed25519 keys/ed25519.key
+```
+
+This creates `keys/ed25519.key` (private) and `keys/ed25519.pub` (public). The keys directory is mounted read-only into the cameleer-saas container.
+
+If no key files are configured, the platform generates ephemeral keys on startup (suitable for development only -- keys change on every restart).
+
+### 3. Start the Stack
+
+**Development** (ports exposed for direct access):
+```bash
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+```
+
+**Production** (traffic routed through Traefik only):
+```bash
+docker compose up -d
+```
+
+### 4. Verify Services
+
+```bash
+# Health check
+curl http://localhost:8080/actuator/health
+
+# Check all containers are running
+docker compose ps
+```
+
+## Bootstrapping
+
+### First-Time Logto Setup
+
+On first boot, Logto seeds its database automatically. Access the admin console to configure it:
+
+1. Open http://localhost:3002 (Logto admin console)
+2. Complete the initial setup wizard
+3. Create a **Machine-to-Machine** application:
+   - Go to Applications > Create Application > Machine-to-Machine
+   - Note the **App ID** and **App Secret**
+   - Assign the **Logto Management API** resource with all scopes
+4. Update `.env`:
+   ```
+   LOGTO_M2M_CLIENT_ID=<app-id>
+   LOGTO_M2M_CLIENT_SECRET=<app-secret>
+   ```
+5. Restart cameleer-saas: `docker compose restart cameleer-saas`
+
+### Create Your First Tenant
+
+With a Logto user token (obtained via OIDC login flow):
+
+```bash
+TOKEN="<your-logto-jwt>"
+
+# Create tenant
+curl -X POST http://localhost:8080/api/tenants \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"name": "My Company", "slug": "my-company", "tier": "MID"}'
+
+# A "default" environment is auto-created with the tenant
+```
+
+### Generate a License
+
+```bash
+TENANT_ID="<uuid-from-above>"
+
+curl -X POST "http://localhost:8080/api/tenants/$TENANT_ID/license" \
+  -H "Authorization: Bearer $TOKEN"
+```
+
+### Deploy a Camel Application
+
+```bash
+# List environments
+curl "http://localhost:8080/api/tenants/$TENANT_ID/environments" \
+  -H "Authorization: Bearer $TOKEN"
+
+ENV_ID="<default-environment-uuid>"
+
+# Upload JAR and create app
+curl -X POST "http://localhost:8080/api/environments/$ENV_ID/apps" \
+  -H "Authorization: Bearer $TOKEN" \
+  -F 'metadata={"slug":"order-service","displayName":"Order Service"};type=application/json' \
+  -F "file=@/path/to/your-camel-app.jar"
+
+APP_ID="<app-uuid-from-response>"
+
+# Deploy (async -- returns 202 with deployment ID)
+curl -X POST "http://localhost:8080/api/apps/$APP_ID/deploy" \
+  -H "Authorization: Bearer $TOKEN"
+
+DEPLOYMENT_ID="<deployment-uuid>"
+
+# Poll deployment status
+curl "http://localhost:8080/api/apps/$APP_ID/deployments/$DEPLOYMENT_ID" \
+  -H "Authorization: Bearer $TOKEN"
+# Status transitions: BUILDING -> STARTING -> RUNNING (or FAILED)
+
+# View container logs
+curl "http://localhost:8080/api/apps/$APP_ID/logs?limit=50" \
+  -H "Authorization: Bearer $TOKEN"
+
+# Stop the app
+curl -X POST "http://localhost:8080/api/apps/$APP_ID/stop" \
+  -H "Authorization: Bearer $TOKEN"
+```
+
+### Enable Inbound HTTP Routing
+
+If your Camel app exposes a REST endpoint, you can make it reachable from outside the stack:
+
+```bash
+# Set the port your app listens on (e.g., 8080 for Spring Boot)
+curl -X PATCH "http://localhost:8080/api/environments/$ENV_ID/apps/$APP_ID/routing" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"exposedPort": 8080}'
+```
+
+Your app is now reachable at `http://{app-slug}.{env-slug}.{tenant-slug}.{domain}` (e.g., `http://order-service.default.my-company.localhost`). Traefik routes traffic automatically.
+
+To disable routing, set `exposedPort` to `null`.
+
+### View the Observability Dashboard
+
+The cameleer3-server React SPA dashboard is available at:
+
+```
+http://localhost/dashboard
+```
+
+This shows execution traces, route topology graphs, metrics, and logs for all deployed apps. Authentication is required (Logto OIDC token via forward-auth).
+
+### Check Agent & Observability Status
+
+```bash
+# Is the agent registered with cameleer3-server?
+curl "http://localhost:8080/api/apps/$APP_ID/agent-status" \
+  -H "Authorization: Bearer $TOKEN"
+# Returns: registered, state (ACTIVE/STALE/DEAD/UNKNOWN), routeIds
+
+# Is the app producing observability data?
+curl "http://localhost:8080/api/apps/$APP_ID/observability-status" \
+  -H "Authorization: Bearer $TOKEN"
+# Returns: hasTraces, lastTraceAt, traceCount24h
+```
+
+## API Reference
+
+### Tenants
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/api/tenants` | Create tenant |
+| GET | `/api/tenants/{id}` | Get tenant |
+| GET | `/api/tenants/by-slug/{slug}` | Get tenant by slug |
+
+### Licensing
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/api/tenants/{tid}/license` | Generate license |
+| GET | `/api/tenants/{tid}/license` | Get active license |
+
+### Environments
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/api/tenants/{tid}/environments` | Create environment |
+| GET | `/api/tenants/{tid}/environments` | List environments |
+| GET | `/api/tenants/{tid}/environments/{eid}` | Get environment |
+| PATCH | `/api/tenants/{tid}/environments/{eid}` | Rename environment |
+| DELETE | `/api/tenants/{tid}/environments/{eid}` | Delete environment |
+
+### Apps
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/api/environments/{eid}/apps` | Create app + upload JAR |
+| GET | `/api/environments/{eid}/apps` | List apps |
+| GET | `/api/environments/{eid}/apps/{aid}` | Get app |
+| PUT | `/api/environments/{eid}/apps/{aid}/jar` | Re-upload JAR |
+| PATCH | `/api/environments/{eid}/apps/{aid}/routing` | Set/clear exposed port |
+| DELETE | `/api/environments/{eid}/apps/{aid}` | Delete app |
+
+### Deployments
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/api/apps/{aid}/deploy` | Deploy app (async, 202) |
+| GET | `/api/apps/{aid}/deployments` | Deployment history |
+| GET | `/api/apps/{aid}/deployments/{did}` | Get deployment status |
+| POST | `/api/apps/{aid}/stop` | Stop current deployment |
+| POST | `/api/apps/{aid}/restart` | Restart app |
+
+### Logs
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/apps/{aid}/logs` | Query container logs |
+
+Query params: `since`, `until` (ISO timestamps), `limit` (default 500), `stream` (stdout/stderr/both)
+
+### Observability
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/apps/{aid}/agent-status` | Agent registration status |
+| GET | `/api/apps/{aid}/observability-status` | Trace/metrics data health |
+
+### Dashboard
+| Path | Description |
+|------|-------------|
+| `/dashboard` | cameleer3-server observability dashboard (forward-auth protected) |
+
+### Health
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/actuator/health` | Health check (public) |
+| GET | `/api/health/secured` | Authenticated health check |
+
+## Tier Limits
+
+| Tier | Environments | Apps | Retention | Features |
+|------|-------------|------|-----------|----------|
+| LOW | 1 | 3 | 7 days | Topology |
+| MID | 2 | 10 | 30 days | + Lineage, Correlation |
+| HIGH | Unlimited | 50 | 90 days | + Debugger, Replay |
+| BUSINESS | Unlimited | Unlimited | 365 days | All features |
+
+## Development
+
+### Running Tests
+
+```bash
+# Unit tests only (no Docker required)
+mvn test -B -Dsurefire.excludes="**/*ControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java"
+
+# Integration tests (requires Docker Desktop)
+mvn test -B -Dtest="EnvironmentControllerTest,AppControllerTest,DeploymentControllerTest"
+
+# All tests
+mvn verify -B
+```
+
+### Building Locally
+
+```bash
+# Build JAR
+mvn clean package -DskipTests -B
+
+# Build Docker image
+docker build -t cameleer-saas:local .
+
+# Use local image
+VERSION=local docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
+```
+
+## Troubleshooting
+
+**Logto fails to start**: Check that PostgreSQL is healthy first. Logto needs the `logto` database created by `docker/init-databases.sh`. Run `docker compose logs logto` for details.
+
+**cameleer-saas won't start**: Check `docker compose logs cameleer-saas`. Common issues:
+- PostgreSQL not ready (wait for healthcheck)
+- Flyway migration conflict (check for manual schema changes)
+
+**Ephemeral key warnings**: `No Ed25519 key files configured -- generating ephemeral keys (dev mode)` is normal in development. For production, generate keys as described above.
+
+**Container deployment fails**: Check that Docker socket is mounted (`/var/run/docker.sock`) and the `cameleer-runtime-base` image is available. Pull it with: `docker pull gitea.siegeln.net/cameleer/cameleer-runtime-base:latest`
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -94,6 +94,7 @@ services:
      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-cameleer_saas}
      CLICKHOUSE_URL: jdbc:clickhouse://clickhouse:8123/cameleer
      CAMELEER_AUTH_TOKEN: ${CAMELEER_AUTH_TOKEN:-default-bootstrap-token}
+      CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
    labels:
      - traefik.enable=true
      - traefik.http.routers.observe.rule=PathPrefix(`/observe`)
@@ -101,6 +102,10 @@ services:
      - traefik.http.middlewares.forward-auth.forwardauth.address=http://cameleer-saas:8080/auth/verify
      - traefik.http.middlewares.forward-auth.forwardauth.authResponseHeaders=X-Tenant-Id,X-User-Id,X-User-Email
      - traefik.http.services.observe.loadbalancer.server.port=8080
+      - traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
+      - traefik.http.routers.dashboard.middlewares=forward-auth,dashboard-strip
+      - traefik.http.middlewares.dashboard-strip.stripprefix.prefixes=/dashboard
+      - traefik.http.services.dashboard.loadbalancer.server.port=8080
    networks:
      - cameleer

--- a/docs/superpowers/plans/2026-04-04-phase-4-observability-pipeline.md
+++ b/docs/superpowers/plans/2026-04-04-phase-4-observability-pipeline.md
@@ -0,0 +1,789 @@
+# Phase 4: Observability Pipeline + Inbound Routing — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Complete the deploy → hit endpoint → see traces loop. Serve the existing cameleer3-server dashboard, add agent connectivity verification, enable optional inbound HTTP routing for customer apps, and wire up observability data health checks.
+
+**Architecture:** Wiring phase — cameleer3-server already has full observability. Phase 4 adds Traefik routing for the dashboard + customer app endpoints, new API endpoints in cameleer-saas for agent-status and observability-status, and configures `CAMELEER_TENANT_ID` on the server.
+
+**Tech Stack:** Spring Boot 3.4.3, docker-java 3.4.1, ClickHouse JDBC, Traefik v3 labels, Spring RestClient
+
+---
+
+## File Structure
+
+### New Files
+
+- `src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusService.java` — Queries cameleer3-server for agent registration
+- `src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusController.java` — Agent status + observability status endpoints
+- `src/main/java/net/siegeln/cameleer/saas/observability/dto/AgentStatusResponse.java` — Response DTO
+- `src/main/java/net/siegeln/cameleer/saas/observability/dto/ObservabilityStatusResponse.java` — Response DTO
+- `src/main/java/net/siegeln/cameleer/saas/observability/dto/UpdateRoutingRequest.java` — Request DTO for PATCH routing
+- `src/main/java/net/siegeln/cameleer/saas/observability/ConnectivityHealthCheck.java` — Startup connectivity verification
+- `src/test/java/net/siegeln/cameleer/saas/observability/AgentStatusServiceTest.java` — Unit tests
+- `src/test/java/net/siegeln/cameleer/saas/observability/AgentStatusControllerTest.java` — Integration tests
+- `src/main/resources/db/migration/V010__add_exposed_port_to_apps.sql` — Migration
+
+### Modified Files
+
+- `src/main/java/net/siegeln/cameleer/saas/runtime/StartContainerRequest.java` — Add `labels` field
+- `src/main/java/net/siegeln/cameleer/saas/runtime/DockerRuntimeOrchestrator.java` — Apply labels on container create
+- `src/main/java/net/siegeln/cameleer/saas/runtime/RuntimeConfig.java` — Add `domain` property
+- `src/main/java/net/siegeln/cameleer/saas/app/AppEntity.java` — Add `exposedPort` field
+- `src/main/java/net/siegeln/cameleer/saas/app/AppService.java` — Add `updateRouting` method
+- `src/main/java/net/siegeln/cameleer/saas/app/AppController.java` — Add PATCH routing endpoint
+- `src/main/java/net/siegeln/cameleer/saas/app/dto/AppResponse.java` — Add `exposedPort` + `routeUrl` fields
+- `src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java` — Build labels for Traefik routing
+- `src/main/resources/application.yml` — Add `domain` property
+- `docker-compose.yml` — Add dashboard Traefik route, `CAMELEER_TENANT_ID`
+- `.env.example` — Add `CAMELEER_TENANT_SLUG`
+- `HOWTO.md` — Update with observability + routing docs
+
+---
+
+## Task 1: Database Migration + Entity Changes
+
+**Files:**
+- Create: `src/main/resources/db/migration/V010__add_exposed_port_to_apps.sql`
+- Modify: `src/main/java/net/siegeln/cameleer/saas/app/AppEntity.java`
+
+- [ ] **Step 1: Create migration V010**
+
+```sql
+ALTER TABLE apps ADD COLUMN exposed_port INTEGER;
+```
+
+- [ ] **Step 2: Add exposedPort field to AppEntity**
+
+Add after `previousDeploymentId` field:
+
+```java
+    @Column(name = "exposed_port")
+    private Integer exposedPort;
+```
+
+Add getter and setter:
+
+```java
+    public Integer getExposedPort() { return exposedPort; }
+    public void setExposedPort(Integer exposedPort) { this.exposedPort = exposedPort; }
+```
+
+- [ ] **Step 3: Verify compilation**
+
+Run: `mvn compile -B -q`
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src/main/resources/db/migration/V010__add_exposed_port_to_apps.sql \
+  src/main/java/net/siegeln/cameleer/saas/app/AppEntity.java
+git commit -m "feat: add exposed_port column to apps table"
+```
+
+---
+
+## Task 2: StartContainerRequest Labels + DockerRuntimeOrchestrator
+
+**Files:**
+- Modify: `src/main/java/net/siegeln/cameleer/saas/runtime/StartContainerRequest.java`
+- Modify: `src/main/java/net/siegeln/cameleer/saas/runtime/DockerRuntimeOrchestrator.java`
+
+- [ ] **Step 1: Add labels field to StartContainerRequest**
+
+Replace the current record with:
+
+```java
+package net.siegeln.cameleer.saas.runtime;
+
+import java.util.Map;
+
+public record StartContainerRequest(
+        String imageRef,
+        String containerName,
+        String network,
+        Map<String, String> envVars,
+        long memoryLimitBytes,
+        int cpuShares,
+        int healthCheckPort,
+        Map<String, String> labels
+) {}
+```
+
+- [ ] **Step 2: Apply labels in DockerRuntimeOrchestrator.startContainer**
+
+In the `startContainer` method, after `.withHostConfig(hostConfig)` and before `.withHealthcheck(...)`, add:
+
+```java
+                .withLabels(request.labels() != null ? request.labels() : Map.of())
+```
+
+- [ ] **Step 3: Fix all existing callers of StartContainerRequest**
+
+The `DeploymentService.executeDeploymentAsync` method creates a `StartContainerRequest`. Add `Map.of()` as the labels argument (empty labels for now — routing labels come in Task 5):
+
+Find the existing `new StartContainerRequest(...)` call and add `Map.of()` as the last argument.
+
+- [ ] **Step 4: Verify compilation and run unit tests**
+
+Run: `mvn test -B -Dsurefire.excludes="**/*ControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java" -q`
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/main/java/net/siegeln/cameleer/saas/runtime/StartContainerRequest.java \
+  src/main/java/net/siegeln/cameleer/saas/runtime/DockerRuntimeOrchestrator.java \
+  src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
+git commit -m "feat: add labels support to StartContainerRequest and DockerRuntimeOrchestrator"
+```
+
+---
+
+## Task 3: RuntimeConfig Domain + AppResponse + AppService Routing
+
+**Files:**
+- Modify: `src/main/java/net/siegeln/cameleer/saas/runtime/RuntimeConfig.java`
+- Modify: `src/main/java/net/siegeln/cameleer/saas/app/dto/AppResponse.java`
+- Modify: `src/main/java/net/siegeln/cameleer/saas/app/AppService.java`
+- Modify: `src/main/java/net/siegeln/cameleer/saas/app/AppController.java`
+- Create: `src/main/java/net/siegeln/cameleer/saas/observability/dto/UpdateRoutingRequest.java`
+- Modify: `src/main/resources/application.yml`
+
+- [ ] **Step 1: Add domain property to RuntimeConfig**
+
+Add field and getter:
+
+```java
+    @Value("${cameleer.runtime.domain:localhost}")
+    private String domain;
+
+    public String getDomain() { return domain; }
+```
+
+- [ ] **Step 2: Add domain to application.yml**
+
+In the `cameleer.runtime` section, add:
+
+```yaml
+    domain: ${DOMAIN:localhost}
+```
+
+- [ ] **Step 3: Update AppResponse to include exposedPort and routeUrl**
+
+Replace the record:
+
+```java
+package net.siegeln.cameleer.saas.app.dto;
+
+import java.time.Instant;
+import java.util.UUID;
+
+public record AppResponse(
+        UUID id,
+        UUID environmentId,
+        String slug,
+        String displayName,
+        String jarOriginalFilename,
+        Long jarSizeBytes,
+        String jarChecksum,
+        Integer exposedPort,
+        String routeUrl,
+        UUID currentDeploymentId,
+        UUID previousDeploymentId,
+        Instant createdAt,
+        Instant updatedAt
+) {}
+```
+
+- [ ] **Step 4: Create UpdateRoutingRequest**
+
+```java
+package net.siegeln.cameleer.saas.observability.dto;
+
+public record UpdateRoutingRequest(
+        Integer exposedPort
+) {}
+```
+
+- [ ] **Step 5: Add updateRouting method to AppService**
+
+```java
+    public AppEntity updateRouting(UUID appId, Integer exposedPort, UUID actorId) {
+        var app = appRepository.findById(appId)
+                .orElseThrow(() -> new IllegalArgumentException("App not found"));
+        app.setExposedPort(exposedPort);
+        return appRepository.save(app);
+    }
+```
+
+- [ ] **Step 6: Update AppController — add PATCH routing endpoint and update toResponse**
+
+Add the endpoint:
+
+```java
+    @PatchMapping("/{appId}/routing")
+    public ResponseEntity<AppResponse> updateRouting(
+            @PathVariable UUID environmentId,
+            @PathVariable UUID appId,
+            @RequestBody UpdateRoutingRequest request,
+            Authentication authentication) {
+        try {
+            var actorId = resolveActorId(authentication);
+            var app = appService.updateRouting(appId, request.exposedPort(), actorId);
+            var env = environmentService.getById(app.getEnvironmentId()).orElse(null);
+            return ResponseEntity.ok(toResponse(app, env));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+```
+
+This requires adding `EnvironmentService` and `RuntimeConfig` as constructor dependencies to `AppController`. Update the constructor.
+
+Update `toResponse` to accept the environment and compute the route URL:
+
+```java
+    private AppResponse toResponse(AppEntity app, EnvironmentEntity env) {
+        String routeUrl = null;
+        if (app.getExposedPort() != null && env != null) {
+            var tenant = tenantRepository.findById(env.getTenantId()).orElse(null);
+            if (tenant != null) {
+                routeUrl = "http://" + app.getSlug() + "." + env.getSlug() + "."
+                        + tenant.getSlug() + "." + runtimeConfig.getDomain();
+            }
+        }
+        return new AppResponse(
+                app.getId(), app.getEnvironmentId(), app.getSlug(), app.getDisplayName(),
+                app.getJarOriginalFilename(), app.getJarSizeBytes(), app.getJarChecksum(),
+                app.getExposedPort(), routeUrl,
+                app.getCurrentDeploymentId(), app.getPreviousDeploymentId(),
+                app.getCreatedAt(), app.getUpdatedAt());
+    }
+```
+
+This requires adding `TenantRepository` as a constructor dependency too. Update the existing `toResponse(AppEntity)` calls in other methods to pass the environment — look up the environment from the `environmentId` path variable or from `environmentService`.
+
+For the list/get/create endpoints that already have `environmentId` in the path, look up the environment once and pass it.
+
+- [ ] **Step 7: Verify compilation**
+
+Run: `mvn compile -B -q`
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add src/main/java/net/siegeln/cameleer/saas/runtime/RuntimeConfig.java \
+  src/main/java/net/siegeln/cameleer/saas/app/dto/AppResponse.java \
+  src/main/java/net/siegeln/cameleer/saas/app/AppService.java \
+  src/main/java/net/siegeln/cameleer/saas/app/AppController.java \
+  src/main/java/net/siegeln/cameleer/saas/observability/dto/UpdateRoutingRequest.java \
+  src/main/resources/application.yml
+git commit -m "feat: add exposed port routing and route URL to app API"
+```
+
+---
+
+## Task 4: Agent Status + Observability Status Endpoints (TDD)
+
+**Files:**
+- Create: `src/main/java/net/siegeln/cameleer/saas/observability/dto/AgentStatusResponse.java`
+- Create: `src/main/java/net/siegeln/cameleer/saas/observability/dto/ObservabilityStatusResponse.java`
+- Create: `src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusService.java`
+- Create: `src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusController.java`
+- Create: `src/test/java/net/siegeln/cameleer/saas/observability/AgentStatusServiceTest.java`
+
+- [ ] **Step 1: Create DTOs**
+
+`AgentStatusResponse.java`:
+```java
+package net.siegeln.cameleer.saas.observability.dto;
+
+import java.time.Instant;
+import java.util.List;
+
+public record AgentStatusResponse(
+        boolean registered,
+        String state,
+        Instant lastHeartbeat,
+        List<String> routeIds,
+        String applicationId,
+        String environmentId
+) {}
+```
+
+`ObservabilityStatusResponse.java`:
+```java
+package net.siegeln.cameleer.saas.observability.dto;
+
+import java.time.Instant;
+
+public record ObservabilityStatusResponse(
+        boolean hasTraces,
+        boolean hasMetrics,
+        boolean hasDiagrams,
+        Instant lastTraceAt,
+        long traceCount24h
+) {}
+```
+
+- [ ] **Step 2: Write failing tests**
+
+```java
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.app.AppEntity;
+import net.siegeln.cameleer.saas.app.AppRepository;
+import net.siegeln.cameleer.saas.environment.EnvironmentEntity;
+import net.siegeln.cameleer.saas.environment.EnvironmentRepository;
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+@ExtendWith(MockitoExtension.class)
+class AgentStatusServiceTest {
+
+    @Mock private AppRepository appRepository;
+    @Mock private EnvironmentRepository environmentRepository;
+    @Mock private RuntimeConfig runtimeConfig;
+
+    private AgentStatusService agentStatusService;
+
+    @BeforeEach
+    void setUp() {
+        when(runtimeConfig.getCameleer3ServerEndpoint()).thenReturn("http://cameleer3-server:8081");
+        agentStatusService = new AgentStatusService(appRepository, environmentRepository, runtimeConfig);
+    }
+
+    @Test
+    void getAgentStatus_appNotFound_shouldThrow() {
+        when(appRepository.findById(any())).thenReturn(Optional.empty());
+        assertThrows(IllegalArgumentException.class,
+                () -> agentStatusService.getAgentStatus(UUID.randomUUID()));
+    }
+
+    @Test
+    void getAgentStatus_shouldReturnUnknownWhenServerUnreachable() {
+        var appId = UUID.randomUUID();
+        var envId = UUID.randomUUID();
+
+        var app = new AppEntity();
+        app.setId(appId);
+        app.setEnvironmentId(envId);
+        app.setSlug("my-app");
+        when(appRepository.findById(appId)).thenReturn(Optional.of(app));
+
+        var env = new EnvironmentEntity();
+        env.setId(envId);
+        env.setSlug("default");
+        when(environmentRepository.findById(envId)).thenReturn(Optional.of(env));
+
+        var result = agentStatusService.getAgentStatus(appId);
+
+        assertNotNull(result);
+        assertFalse(result.registered());
+        assertEquals("UNKNOWN", result.state());
+    }
+}
+```
+
+- [ ] **Step 3: Implement AgentStatusService**
+
+```java
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.app.AppRepository;
+import net.siegeln.cameleer.saas.environment.EnvironmentRepository;
+import net.siegeln.cameleer.saas.observability.dto.AgentStatusResponse;
+import net.siegeln.cameleer.saas.observability.dto.ObservabilityStatusResponse;
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
+import org.springframework.web.client.RestClient;
+
+import javax.sql.DataSource;
+import java.sql.Timestamp;
+import java.time.Instant;
+import java.util.List;
+import java.util.UUID;
+
+@Service
+public class AgentStatusService {
+
+    private static final Logger log = LoggerFactory.getLogger(AgentStatusService.class);
+
+    private final AppRepository appRepository;
+    private final EnvironmentRepository environmentRepository;
+    private final RuntimeConfig runtimeConfig;
+    private final RestClient restClient;
+
+    @Autowired(required = false)
+    @Qualifier("clickHouseDataSource")
+    private DataSource clickHouseDataSource;
+
+    public AgentStatusService(AppRepository appRepository,
+                              EnvironmentRepository environmentRepository,
+                              RuntimeConfig runtimeConfig) {
+        this.appRepository = appRepository;
+        this.environmentRepository = environmentRepository;
+        this.runtimeConfig = runtimeConfig;
+        this.restClient = RestClient.builder()
+                .baseUrl(runtimeConfig.getCameleer3ServerEndpoint())
+                .build();
+    }
+
+    public AgentStatusResponse getAgentStatus(UUID appId) {
+        var app = appRepository.findById(appId)
+                .orElseThrow(() -> new IllegalArgumentException("App not found"));
+        var env = environmentRepository.findById(app.getEnvironmentId())
+                .orElseThrow(() -> new IllegalStateException("Environment not found"));
+
+        try {
+            var response = restClient.get()
+                    .uri("/api/v1/agents")
+                    .header("Authorization", "Bearer " + runtimeConfig.getBootstrapToken())
+                    .retrieve()
+                    .body(List.class);
+
+            if (response != null) {
+                for (var agentObj : response) {
+                    if (agentObj instanceof java.util.Map<?, ?> agent) {
+                        var agentAppId = String.valueOf(agent.get("applicationId"));
+                        var agentEnvId = String.valueOf(agent.get("environmentId"));
+                        if (app.getSlug().equals(agentAppId) && env.getSlug().equals(agentEnvId)) {
+                            var state = String.valueOf(agent.getOrDefault("state", "UNKNOWN"));
+                            var routeIds = agent.get("routeIds");
+                            @SuppressWarnings("unchecked")
+                            var routes = routeIds instanceof List<?> r ? (List<String>) r : List.<String>of();
+                            return new AgentStatusResponse(true, state, null, routes,
+                                    agentAppId, agentEnvId);
+                        }
+                    }
+                }
+            }
+            return new AgentStatusResponse(false, "NOT_REGISTERED", null,
+                    List.of(), app.getSlug(), env.getSlug());
+        } catch (Exception e) {
+            log.warn("Failed to query agent status from cameleer3-server: {}", e.getMessage());
+            return new AgentStatusResponse(false, "UNKNOWN", null,
+                    List.of(), app.getSlug(), env.getSlug());
+        }
+    }
+
+    public ObservabilityStatusResponse getObservabilityStatus(UUID appId) {
+        var app = appRepository.findById(appId)
+                .orElseThrow(() -> new IllegalArgumentException("App not found"));
+        var env = environmentRepository.findById(app.getEnvironmentId())
+                .orElseThrow(() -> new IllegalStateException("Environment not found"));
+
+        if (clickHouseDataSource == null) {
+            return new ObservabilityStatusResponse(false, false, false, null, 0);
+        }
+
+        try (var conn = clickHouseDataSource.getConnection();
+             var ps = conn.prepareStatement("""
+                SELECT
+                    count() as trace_count,
+                    max(start_time) as last_trace
+                FROM executions
+                WHERE application_id = ? AND environment = ?
+                  AND start_time > now() - INTERVAL 24 HOUR
+                """)) {
+            ps.setString(1, app.getSlug());
+            ps.setString(2, env.getSlug());
+
+            try (var rs = ps.executeQuery()) {
+                if (rs.next()) {
+                    var count = rs.getLong("trace_count");
+                    var lastTrace = rs.getTimestamp("last_trace");
+                    return new ObservabilityStatusResponse(
+                            count > 0, false, false,
+                            lastTrace != null ? lastTrace.toInstant() : null,
+                            count);
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to query observability status from ClickHouse: {}", e.getMessage());
+        }
+        return new ObservabilityStatusResponse(false, false, false, null, 0);
+    }
+}
+```
+
+- [ ] **Step 4: Create AgentStatusController**
+
+```java
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.observability.dto.AgentStatusResponse;
+import net.siegeln.cameleer.saas.observability.dto.ObservabilityStatusResponse;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/apps/{appId}")
+public class AgentStatusController {
+
+    private final AgentStatusService agentStatusService;
+
+    public AgentStatusController(AgentStatusService agentStatusService) {
+        this.agentStatusService = agentStatusService;
+    }
+
+    @GetMapping("/agent-status")
+    public ResponseEntity<AgentStatusResponse> getAgentStatus(@PathVariable UUID appId) {
+        try {
+            var status = agentStatusService.getAgentStatus(appId);
+            return ResponseEntity.ok(status);
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+
+    @GetMapping("/observability-status")
+    public ResponseEntity<ObservabilityStatusResponse> getObservabilityStatus(@PathVariable UUID appId) {
+        try {
+            var status = agentStatusService.getObservabilityStatus(appId);
+            return ResponseEntity.ok(status);
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+}
+```
+
+- [ ] **Step 5: Run tests**
+
+Run: `mvn test -pl . -Dtest=AgentStatusServiceTest -B`
+Expected: 2 tests PASS
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add src/main/java/net/siegeln/cameleer/saas/observability/ \
+  src/test/java/net/siegeln/cameleer/saas/observability/
+git commit -m "feat: add agent status and observability status endpoints"
+```
+
+---
+
+## Task 5: Traefik Routing Labels in DeploymentService
+
+**Files:**
+- Modify: `src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java`
+
+- [ ] **Step 1: Build Traefik labels when app has exposedPort**
+
+In `executeDeploymentAsync`, after building the `envVars` map and before creating `startRequest`, add label computation:
+
+```java
+            // Build Traefik labels for inbound routing
+            var labels = new java.util.HashMap<String, String>();
+            if (app.getExposedPort() != null) {
+                labels.put("traefik.enable", "true");
+                labels.put("traefik.http.routers." + containerName + ".rule",
+                        "Host(`" + app.getSlug() + "." + env.getSlug() + "."
+                                + tenant.getSlug() + "." + runtimeConfig.getDomain() + "`)");
+                labels.put("traefik.http.services." + containerName + ".loadbalancer.server.port",
+                        String.valueOf(app.getExposedPort()));
+            }
+```
+
+Then pass `labels` to the `StartContainerRequest` constructor (replacing the `Map.of()` added in Task 2).
+
+Note: The `tenant` variable is already looked up earlier in the method for container naming.
+
+- [ ] **Step 2: Run unit tests**
+
+Run: `mvn test -pl . -Dtest=DeploymentServiceTest -B`
+Expected: All tests PASS
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
+git commit -m "feat: add Traefik routing labels for customer apps with exposed ports"
+```
+
+---
+
+## Task 6: Connectivity Health Check
+
+**Files:**
+- Create: `src/main/java/net/siegeln/cameleer/saas/observability/ConnectivityHealthCheck.java`
+
+- [ ] **Step 1: Create startup connectivity check**
+
+```java
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.RestClient;
+
+@Component
+public class ConnectivityHealthCheck {
+
+    private static final Logger log = LoggerFactory.getLogger(ConnectivityHealthCheck.class);
+
+    private final RuntimeConfig runtimeConfig;
+
+    public ConnectivityHealthCheck(RuntimeConfig runtimeConfig) {
+        this.runtimeConfig = runtimeConfig;
+    }
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void verifyConnectivity() {
+        checkCameleer3Server();
+    }
+
+    private void checkCameleer3Server() {
+        try {
+            var client = RestClient.builder()
+                    .baseUrl(runtimeConfig.getCameleer3ServerEndpoint())
+                    .build();
+            var response = client.get()
+                    .uri("/actuator/health")
+                    .retrieve()
+                    .toBodilessEntity();
+            if (response.getStatusCode().is2xxSuccessful()) {
+                log.info("cameleer3-server connectivity: OK ({})",
+                        runtimeConfig.getCameleer3ServerEndpoint());
+            } else {
+                log.warn("cameleer3-server connectivity: HTTP {} ({})",
+                        response.getStatusCode(), runtimeConfig.getCameleer3ServerEndpoint());
+            }
+        } catch (Exception e) {
+            log.warn("cameleer3-server connectivity: FAILED ({}) - {}",
+                    runtimeConfig.getCameleer3ServerEndpoint(), e.getMessage());
+        }
+    }
+}
+```
+
+- [ ] **Step 2: Verify compilation**
+
+Run: `mvn compile -B -q`
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/main/java/net/siegeln/cameleer/saas/observability/ConnectivityHealthCheck.java
+git commit -m "feat: add cameleer3-server startup connectivity check"
+```
+
+---
+
+## Task 7: Docker Compose + .env + CI Updates
+
+**Files:**
+- Modify: `docker-compose.yml`
+- Modify: `.env.example`
+- Modify: `.gitea/workflows/ci.yml`
+
+- [ ] **Step 1: Update docker-compose.yml — add dashboard route and CAMELEER_TENANT_ID**
+
+In the `cameleer3-server` service:
+
+Add to environment section:
+```yaml
+    CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
+```
+
+Add new Traefik labels (after existing ones):
+```yaml
+    - traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
+    - traefik.http.routers.dashboard.middlewares=forward-auth,dashboard-strip
+    - traefik.http.middlewares.dashboard-strip.stripprefix.prefixes=/dashboard
+    - traefik.http.services.dashboard.loadbalancer.server.port=8080
+```
+
+- [ ] **Step 2: Update .env.example**
+
+Add:
+```
+CAMELEER_TENANT_SLUG=default
+```
+
+- [ ] **Step 3: Update CI excludes**
+
+In `.gitea/workflows/ci.yml`, add `**/AgentStatusControllerTest.java` to the Surefire excludes (if integration test exists).
+
+- [ ] **Step 4: Run all unit tests**
+
+Run: `mvn test -B -Dsurefire.excludes="**/*ControllerTest.java,**/AuditRepositoryTest.java,**/CameleerSaasApplicationTest.java" -q`
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add docker-compose.yml .env.example .gitea/workflows/ci.yml
+git commit -m "feat: add dashboard Traefik route and CAMELEER_TENANT_ID config"
+```
+
+---
+
+## Task 8: Update HOWTO.md
+
+**Files:**
+- Modify: `HOWTO.md`
+
+- [ ] **Step 1: Add observability and routing sections**
+
+After the "Deploy a Camel Application" section, add:
+
+**Observability Dashboard section** — explains how to access the dashboard at `/dashboard`, what data is visible.
+
+**Inbound HTTP Routing section** — explains how to set `exposedPort` on an app and what URL to use.
+
+**Agent Status section** — explains the agent-status and observability-status endpoints.
+
+Update the API Reference table with the new endpoints:
+- `GET /api/apps/{aid}/agent-status`
+- `GET /api/apps/{aid}/observability-status`
+- `PATCH /api/environments/{eid}/apps/{aid}/routing`
+
+Update the .env table to include `CAMELEER_TENANT_SLUG`.
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add HOWTO.md
+git commit -m "docs: update HOWTO with observability dashboard, routing, and agent status"
+```
+
+---
+
+## Summary of Spec Coverage
+
+| Spec Requirement | Task |
+|---|---|
+| Serve cameleer3-server dashboard via Traefik | Task 7 (dashboard Traefik labels) |
+| CAMELEER_TENANT_ID configuration | Task 7 (docker-compose env) |
+| Agent connectivity verification endpoint | Task 4 (AgentStatusService + Controller) |
+| Observability data health endpoint | Task 4 (ObservabilityStatusResponse) |
+| Inbound HTTP routing (exposedPort + Traefik labels) | Tasks 1, 2, 3, 5 |
+| StartContainerRequest labels support | Task 2 |
+| AppResponse with routeUrl | Task 3 |
+| PATCH routing API | Task 3 |
+| Startup connectivity check | Task 6 |
+| Docker Compose changes | Task 7 |
+| .env.example updates | Task 7 |
+| HOWTO.md updates | Task 8 |
+| V010 migration | Task 1 |
--- a/docs/superpowers/specs/2026-04-04-phase-4-observability-pipeline.md
+++ b/docs/superpowers/specs/2026-04-04-phase-4-observability-pipeline.md
@@ -0,0 +1,321 @@
+# Phase 4: Observability Pipeline + Inbound Routing
+
+**Date:** 2026-04-04
+**Status:** Draft
+**Depends on:** Phase 3 (Runtime Orchestration + Environments)
+**Gitea issue:** #28
+
+## Context
+
+Phase 3 delivered the managed Camel runtime: customers upload a JAR, the platform builds a container with the cameleer3 agent injected, and deploys it. The agent connects to cameleer3-server and sends traces, metrics, diagrams, and logs to ClickHouse. But there is no way for the user to see this data yet, and customer apps that expose HTTP endpoints are not reachable.
+
+Phase 4 completes the loop: deploy an app, hit its endpoint, see the traces in the dashboard.
+
+cameleer3-server already has the complete observability stack — ClickHouse schemas with `tenant_id` partitioning, full search/stats/diagram/log REST APIs, and a React SPA dashboard. Phase 4 is a **wiring phase**, not a build-from-scratch phase.
+
+## Key Decisions
+
+| Decision | Choice | Rationale |
+|----------|--------|-----------|
+| Observability UI | Serve existing cameleer3-server React SPA via Traefik | Already built. SaaS management UI is Phase 9 — observability UI is not SaaS-specific. |
+| API access | Traefik routes directly to cameleer3-server with forward-auth | No proxy layer needed. Forward-auth validates user, injects headers. Server API works as-is. |
+| Server changes | None | Single-tenant Docker mode works out of the box. `CAMELEER_TENANT_ID` env var already supported. |
+| Agent changes | None | Agent already sends `applicationId`, `environmentId`, connects to `CAMELEER_EXPORT_ENDPOINT`. |
+| Tenant ID | Set `CAMELEER_TENANT_ID` to tenant slug in Docker Compose | Tags ClickHouse data with the real tenant identity from day one. Avoids `'default'` → real-id migration later. |
+| Inbound routing | Optional `exposedPort` on deployment, Traefik labels on customer containers | Thin feature. `{app}.{env}.{tenant}.{domain}` routing via Traefik Host rule. |
+
+## What's Already Working (Phase 3)
+
+- Customer containers on the `cameleer` bridge network
+- Agent configured: `CAMELEER_AUTH_TOKEN`, `CAMELEER_EXPORT_ENDPOINT=http://cameleer3-server:8081`, `CAMELEER_APPLICATION_ID`, `CAMELEER_ENVIRONMENT_ID`
+- cameleer3-server writes traces/metrics/diagrams/logs to ClickHouse
+- Traefik routes `/observe/*` to cameleer3-server with forward-auth middleware
+- Forward-auth endpoint at `/auth/verify` validates JWT, returns `X-Tenant-Id`, `X-User-Id`, `X-User-Email` headers
+
+## Component 1: Serve cameleer3-server Dashboard
+
+### Traefik Routing
+
+Add Traefik labels to the cameleer3-server service in `docker-compose.yml` to serve the React SPA:
+
+```yaml
+# Existing (Phase 3):
+- traefik.http.routers.observe.rule=PathPrefix(`/observe`)
+- traefik.http.routers.observe.middlewares=forward-auth
+
+# New (Phase 4):
+- traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
+- traefik.http.routers.dashboard.middlewares=forward-auth
+- traefik.http.services.dashboard.loadbalancer.server.port=8080
+```
+
+The cameleer3-server SPA is served from its own embedded web server. The SPA already calls the server's API endpoints at relative paths — the existing `/observe/*` Traefik route handles those requests with forward-auth.
+
+**Note:** If the cameleer3-server SPA expects to be served from `/` rather than `/dashboard`, a Traefik StripPrefix middleware may be needed:
+
+```yaml
+- traefik.http.middlewares.dashboard-strip.stripprefix.prefixes=/dashboard
+- traefik.http.routers.dashboard.middlewares=forward-auth,dashboard-strip
+```
+
+This depends on how the cameleer3-server SPA is configured (base path). To be verified during implementation.
+
+### CAMELEER_TENANT_ID Configuration
+
+Set `CAMELEER_TENANT_ID` on the cameleer3-server service so all ingested data is tagged with the real tenant slug:
+
+```yaml
+cameleer3-server:
+  environment:
+    CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
+```
+
+In the Docker single-tenant stack, this is set once during initial setup (e.g., `CAMELEER_TENANT_SLUG=acme` in `.env`). All ClickHouse data is then partitioned under this tenant ID.
+
+Add `CAMELEER_TENANT_SLUG` to `.env.example`.
+
+## Component 2: Agent Connectivity Verification
+
+New endpoint in cameleer-saas to check whether a deployed app's agent has successfully registered with cameleer3-server and is sending data.
+
+### API
+
+```
+GET /api/apps/{appId}/agent-status
+Returns: 200 + AgentStatusResponse
+```
+
+### AgentStatusResponse
+
+```java
+public record AgentStatusResponse(
+    boolean registered,
+    String state,           // ACTIVE, STALE, DEAD, UNKNOWN
+    Instant lastHeartbeat,
+    List<String> routeIds,
+    String applicationId,
+    String environmentId
+) {}
+```
+
+### Implementation
+
+`AgentStatusService` in cameleer-saas calls cameleer3-server's agent registry API:
+
+```
+GET http://cameleer3-server:8081/api/v1/agents
+```
+
+This returns the list of registered agents. The service filters by `applicationId` matching the app's slug and `environmentId` matching the environment's slug.
+
+If the cameleer3-server doesn't expose a public agent listing endpoint, the alternative is to query ClickHouse directly for recent data:
+
+```sql
+SELECT max(timestamp) as last_seen
+FROM container_logs
+WHERE app_id = ? AND deployment_id = ?
+LIMIT 1
+```
+
+The preferred approach is the agent registry API. If it requires authentication, cameleer-saas can use the shared `CAMELEER_AUTH_TOKEN` as a machine token.
+
+### Integration with Deployment Status
+
+After a deployment reaches `RUNNING` status (container healthy), the platform can poll agent-status to confirm the agent has registered. This could be surfaced as a sub-status:
+
+- `RUNNING` — container is healthy
+- `RUNNING_CONNECTED` — container healthy + agent registered with server
+- `RUNNING_DISCONNECTED` — container healthy but agent not yet registered (timeout: 30s)
+
+This is a nice-to-have enhancement on top of the basic agent-status endpoint.
+
+## Component 3: Inbound HTTP Routing for Customer Apps
+
+### Data Model
+
+Add `exposed_port` column to the `apps` table:
+
+```sql
+ALTER TABLE apps ADD COLUMN exposed_port INTEGER;
+```
+
+This is the port the customer's Camel app listens on inside the container (e.g., 8080 for a Spring Boot REST app). When set, Traefik routes external traffic to this port.
+
+### API
+
+```
+PATCH /api/apps/{appId}/routing
+Body: { "exposedPort": 8080 }    // or null to disable routing
+Returns: 200 + AppResponse
+```
+
+The routable URL is computed and included in `AppResponse`:
+
+```java
+// In AppResponse, add:
+String routeUrl    // e.g., "http://order-svc.default.acme.localhost" or null if no routing
+```
+
+### URL Pattern
+
+```
+{app-slug}.{env-slug}.{tenant-slug}.{domain}
+```
+
+Example: `order-svc.default.acme.localhost`
+
+The `{domain}` comes from the `DOMAIN` env var (already in `.env.example`).
+
+### DockerRuntimeOrchestrator Changes
+
+When starting a container for an app that has `exposedPort` set, add Traefik labels:
+
+```java
+var labels = new HashMap<String, String>();
+labels.put("traefik.enable", "true");
+labels.put("traefik.http.routers." + containerName + ".rule",
+    "Host(`" + app.getSlug() + "." + env.getSlug() + "." + tenant.getSlug() + "." + domain + "`)");
+labels.put("traefik.http.services." + containerName + ".loadbalancer.server.port",
+    String.valueOf(app.getExposedPort()));
+```
+
+These labels are set on the Docker container via docker-java's `withLabels()` on the `CreateContainerCmd`.
+
+Traefik auto-discovers labeled containers on the `cameleer` network (already configured in `traefik.yml` with `exposedByDefault: false`).
+
+### StartContainerRequest Changes
+
+Add optional fields to `StartContainerRequest`:
+
+```java
+public record StartContainerRequest(
+    String imageRef,
+    String containerName,
+    String network,
+    Map<String, String> envVars,
+    long memoryLimitBytes,
+    int cpuShares,
+    int healthCheckPort,
+    Map<String, String> labels       // NEW: Traefik routing labels
+) {}
+```
+
+### RuntimeConfig Addition
+
+```yaml
+cameleer:
+  runtime:
+    domain: ${DOMAIN:localhost}
+```
+
+## Component 4: End-to-End Connectivity Health
+
+### Startup Verification
+
+On application startup, cameleer-saas verifies that cameleer3-server is reachable:
+
+```java
+@EventListener(ApplicationReadyEvent.class)
+public void verifyConnectivity() {
+    // HTTP GET http://cameleer3-server:8081/actuator/health
+    // Log result: "cameleer3-server connectivity: OK" or "FAILED: ..."
+}
+```
+
+This is a best-effort check, not a hard dependency. If cameleer3-server is not yet running (e.g., starting up), the SaaS platform still starts. The check is logged for diagnostics.
+
+### ClickHouse Data Verification
+
+Add a lightweight endpoint for checking whether a deployed app is producing observability data:
+
+```
+GET /api/apps/{appId}/observability-status
+Returns: 200 + ObservabilityStatusResponse
+```
+
+```java
+public record ObservabilityStatusResponse(
+    boolean hasTraces,
+    boolean hasMetrics,
+    boolean hasDiagrams,
+    Instant lastTraceAt,
+    long traceCount24h
+) {}
+```
+
+Implementation queries ClickHouse:
+
+```sql
+SELECT
+    count() > 0 as has_traces,
+    max(start_time) as last_trace,
+    count() as trace_count_24h
+FROM executions
+WHERE tenant_id = ? AND application_id = ? AND environment = ?
+  AND start_time > now() - INTERVAL 24 HOUR
+```
+
+This requires cameleer-saas to query ClickHouse directly (the `clickHouseDataSource` bean from Phase 3). The query is scoped by tenant + application + environment.
+
+## Docker Compose Changes
+
+### cameleer3-server labels (add dashboard route)
+
+```yaml
+cameleer3-server:
+  environment:
+    CAMELEER_TENANT_ID: ${CAMELEER_TENANT_SLUG:-default}
+  labels:
+    # Existing:
+    - traefik.enable=true
+    - traefik.http.routers.observe.rule=PathPrefix(`/observe`)
+    - traefik.http.routers.observe.middlewares=forward-auth
+    - traefik.http.services.observe.loadbalancer.server.port=8080
+    # New:
+    - traefik.http.routers.dashboard.rule=PathPrefix(`/dashboard`)
+    - traefik.http.routers.dashboard.middlewares=forward-auth,dashboard-strip
+    - traefik.http.middlewares.dashboard-strip.stripprefix.prefixes=/dashboard
+    - traefik.http.services.dashboard.loadbalancer.server.port=8080
+```
+
+### .env.example addition
+
+```
+CAMELEER_TENANT_SLUG=default
+```
+
+## Database Migration
+
+```sql
+-- V010__add_exposed_port_to_apps.sql
+ALTER TABLE apps ADD COLUMN exposed_port INTEGER;
+```
+
+## New Configuration Properties
+
+```yaml
+cameleer:
+  runtime:
+    domain: ${DOMAIN:localhost}
+```
+
+## Verification Plan
+
+1. Deploy a sample Camel REST app with `exposedPort: 8080`
+2. `curl http://order-svc.default.acme.localhost` hits the Camel app
+3. The Camel route processes the request
+4. cameleer3 agent captures the trace and sends to cameleer3-server
+5. `GET /api/apps/{appId}/agent-status` shows `registered: true, state: ACTIVE`
+6. `GET /api/apps/{appId}/observability-status` shows `hasTraces: true`
+7. Open `http://localhost/dashboard` — cameleer3-server SPA loads
+8. Traces visible in the dashboard for the deployed app
+9. Route topology graph shows the Camel route structure
+10. `CAMELEER_TENANT_ID` is set to the tenant slug in ClickHouse data
+
+## What Phase 4 Does NOT Touch
+
+- No changes to cameleer3-server code (works as-is for single-tenant Docker mode)
+- No changes to the cameleer3 agent
+- No new ClickHouse schemas (cameleer3-server manages its own)
+- No SaaS management UI (Phase 9)
+- No K8s-specific changes (Phase 5)
--- a/src/main/java/net/siegeln/cameleer/saas/app/AppController.java
+++ b/src/main/java/net/siegeln/cameleer/saas/app/AppController.java
@@ -3,14 +3,19 @@ package net.siegeln.cameleer.saas.app;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import net.siegeln.cameleer.saas.app.dto.AppResponse;
 import net.siegeln.cameleer.saas.app.dto.CreateAppRequest;
+import net.siegeln.cameleer.saas.environment.EnvironmentService;
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import net.siegeln.cameleer.saas.tenant.TenantRepository;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.core.Authentication;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PatchMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.bind.annotation.RestController;
@@ -26,10 +31,19 @@ public class AppController {

    private final AppService appService;
    private final ObjectMapper objectMapper;
+    private final EnvironmentService environmentService;
+    private final RuntimeConfig runtimeConfig;
+    private final TenantRepository tenantRepository;

-    public AppController(AppService appService, ObjectMapper objectMapper) {
+    public AppController(AppService appService, ObjectMapper objectMapper,
+                         EnvironmentService environmentService,
+                         RuntimeConfig runtimeConfig,
+                         TenantRepository tenantRepository) {
        this.appService = appService;
        this.objectMapper = objectMapper;
+        this.environmentService = environmentService;
+        this.runtimeConfig = runtimeConfig;
+        this.tenantRepository = tenantRepository;
    }

    @PostMapping(consumes = "multipart/form-data")
@@ -103,6 +117,21 @@ public class AppController {
        }
    }

+    @PatchMapping("/{appId}/routing")
+    public ResponseEntity<AppResponse> updateRouting(
+            @PathVariable UUID environmentId,
+            @PathVariable UUID appId,
+            @RequestBody net.siegeln.cameleer.saas.observability.dto.UpdateRoutingRequest request,
+            Authentication authentication) {
+        try {
+            var actorId = resolveActorId(authentication);
+            var app = appService.updateRouting(appId, request.exposedPort(), actorId);
+            return ResponseEntity.ok(toResponse(app));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+
    private UUID resolveActorId(Authentication authentication) {
        String sub = authentication.getName();
        try {
@@ -112,19 +141,23 @@ public class AppController {
        }
    }

-    private AppResponse toResponse(AppEntity entity) {
+    private AppResponse toResponse(AppEntity app) {
+        String routeUrl = null;
+        if (app.getExposedPort() != null) {
+            var env = environmentService.getById(app.getEnvironmentId()).orElse(null);
+            if (env != null) {
+                var tenant = tenantRepository.findById(env.getTenantId()).orElse(null);
+                if (tenant != null) {
+                    routeUrl = "http://" + app.getSlug() + "." + env.getSlug() + "."
+                            + tenant.getSlug() + "." + runtimeConfig.getDomain();
+                }
+            }
+        }
        return new AppResponse(
-                entity.getId(),
-                entity.getEnvironmentId(),
-                entity.getSlug(),
-                entity.getDisplayName(),
-                entity.getJarOriginalFilename(),
-                entity.getJarSizeBytes(),
-                entity.getJarChecksum(),
-                entity.getCurrentDeploymentId(),
-                entity.getPreviousDeploymentId(),
-                entity.getCreatedAt(),
-                entity.getUpdatedAt()
-        );
+                app.getId(), app.getEnvironmentId(), app.getSlug(), app.getDisplayName(),
+                app.getJarOriginalFilename(), app.getJarSizeBytes(), app.getJarChecksum(),
+                app.getExposedPort(), routeUrl,
+                app.getCurrentDeploymentId(), app.getPreviousDeploymentId(),
+                app.getCreatedAt(), app.getUpdatedAt());
    }
 }
--- a/src/main/java/net/siegeln/cameleer/saas/app/AppEntity.java
+++ b/src/main/java/net/siegeln/cameleer/saas/app/AppEntity.java
@@ -39,6 +39,9 @@ public class AppEntity {
    @Column(name = "previous_deployment_id")
    private UUID previousDeploymentId;

+    @Column(name = "exposed_port")
+    private Integer exposedPort;
+
    @Column(name = "created_at", nullable = false)
    private Instant createdAt;

@@ -76,6 +79,8 @@ public class AppEntity {
    public void setCurrentDeploymentId(UUID currentDeploymentId) { this.currentDeploymentId = currentDeploymentId; }
    public UUID getPreviousDeploymentId() { return previousDeploymentId; }
    public void setPreviousDeploymentId(UUID previousDeploymentId) { this.previousDeploymentId = previousDeploymentId; }
+    public Integer getExposedPort() { return exposedPort; }
+    public void setExposedPort(Integer exposedPort) { this.exposedPort = exposedPort; }
    public Instant getCreatedAt() { return createdAt; }
    public Instant getUpdatedAt() { return updatedAt; }
 }
--- a/src/main/java/net/siegeln/cameleer/saas/app/AppService.java
+++ b/src/main/java/net/siegeln/cameleer/saas/app/AppService.java
@@ -112,6 +112,13 @@ public class AppService {
                null, null, "SUCCESS", null);
    }

+    public AppEntity updateRouting(UUID appId, Integer exposedPort, UUID actorId) {
+        var app = appRepository.findById(appId)
+                .orElseThrow(() -> new IllegalArgumentException("App not found"));
+        app.setExposedPort(exposedPort);
+        return appRepository.save(app);
+    }
+
    public Path resolveJarPath(String relativePath) {
        return Path.of(runtimeConfig.getJarStoragePath()).resolve(relativePath);
    }
--- a/src/main/java/net/siegeln/cameleer/saas/app/dto/AppResponse.java
+++ b/src/main/java/net/siegeln/cameleer/saas/app/dto/AppResponse.java
@@ -4,8 +4,17 @@ import java.time.Instant;
 import java.util.UUID;

 public record AppResponse(
-        UUID id, UUID environmentId, String slug, String displayName,
-        String jarOriginalFilename, Long jarSizeBytes, String jarChecksum,
-        UUID currentDeploymentId, UUID previousDeploymentId,
-        Instant createdAt, Instant updatedAt
+        UUID id,
+        UUID environmentId,
+        String slug,
+        String displayName,
+        String jarOriginalFilename,
+        Long jarSizeBytes,
+        String jarChecksum,
+        Integer exposedPort,
+        String routeUrl,
+        UUID currentDeploymentId,
+        UUID previousDeploymentId,
+        Instant createdAt,
+        Instant updatedAt
 ) {}
--- a/src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
+++ b/src/main/java/net/siegeln/cameleer/saas/deployment/DeploymentService.java
@@ -126,6 +126,17 @@ public class DeploymentService {
                });
            }

+            // Build Traefik labels for inbound routing
+            var labels = new java.util.HashMap<String, String>();
+            if (app.getExposedPort() != null) {
+                labels.put("traefik.enable", "true");
+                labels.put("traefik.http.routers." + containerName + ".rule",
+                        "Host(`" + app.getSlug() + "." + env.getSlug() + "."
+                                + tenantSlug + "." + runtimeConfig.getDomain() + "`)");
+                labels.put("traefik.http.services." + containerName + ".loadbalancer.server.port",
+                        String.valueOf(app.getExposedPort()));
+            }
+
            var containerId = runtimeOrchestrator.startContainer(new StartContainerRequest(
                    deployment.getImageRef(),
                    containerName,
@@ -140,7 +151,8 @@ public class DeploymentService {
                    ),
                    runtimeConfig.parseMemoryLimitBytes(),
                    runtimeConfig.getContainerCpuShares(),
-                    runtimeConfig.getAgentHealthPort()
+                    runtimeConfig.getAgentHealthPort(),
+                    labels
            ));

            deployment.setOrchestratorMetadata(Map.of("containerId", containerId));
--- a/src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusController.java
+++ b/src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusController.java
@@ -0,0 +1,37 @@
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.observability.dto.AgentStatusResponse;
+import net.siegeln.cameleer.saas.observability.dto.ObservabilityStatusResponse;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/apps/{appId}")
+public class AgentStatusController {
+
+    private final AgentStatusService agentStatusService;
+
+    public AgentStatusController(AgentStatusService agentStatusService) {
+        this.agentStatusService = agentStatusService;
+    }
+
+    @GetMapping("/agent-status")
+    public ResponseEntity<AgentStatusResponse> getAgentStatus(@PathVariable UUID appId) {
+        try {
+            return ResponseEntity.ok(agentStatusService.getAgentStatus(appId));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+
+    @GetMapping("/observability-status")
+    public ResponseEntity<ObservabilityStatusResponse> getObservabilityStatus(@PathVariable UUID appId) {
+        try {
+            return ResponseEntity.ok(agentStatusService.getObservabilityStatus(appId));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+}
--- a/src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusService.java
+++ b/src/main/java/net/siegeln/cameleer/saas/observability/AgentStatusService.java
@@ -0,0 +1,136 @@
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.app.AppRepository;
+import net.siegeln.cameleer.saas.environment.EnvironmentRepository;
+import net.siegeln.cameleer.saas.observability.dto.AgentStatusResponse;
+import net.siegeln.cameleer.saas.observability.dto.ObservabilityStatusResponse;
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
+import org.springframework.web.client.RestClient;
+
+import javax.sql.DataSource;
+import java.sql.Timestamp;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+@Service
+public class AgentStatusService {
+
+    private static final Logger log = LoggerFactory.getLogger(AgentStatusService.class);
+
+    private final AppRepository appRepository;
+    private final EnvironmentRepository environmentRepository;
+    private final RuntimeConfig runtimeConfig;
+    private final RestClient restClient;
+
+    @Autowired(required = false)
+    @Qualifier("clickHouseDataSource")
+    private DataSource clickHouseDataSource;
+
+    public AgentStatusService(AppRepository appRepository,
+                               EnvironmentRepository environmentRepository,
+                               RuntimeConfig runtimeConfig) {
+        this.appRepository = appRepository;
+        this.environmentRepository = environmentRepository;
+        this.runtimeConfig = runtimeConfig;
+        this.restClient = RestClient.builder()
+                .baseUrl(runtimeConfig.getCameleer3ServerEndpoint())
+                .build();
+    }
+
+    public AgentStatusResponse getAgentStatus(UUID appId) {
+        var app = appRepository.findById(appId)
+                .orElseThrow(() -> new IllegalArgumentException("App not found: " + appId));
+
+        var env = environmentRepository.findById(app.getEnvironmentId())
+                .orElseThrow(() -> new IllegalArgumentException("Environment not found: " + app.getEnvironmentId()));
+
+        try {
+            @SuppressWarnings("unchecked")
+            List<Map<String, Object>> agents = restClient.get()
+                    .uri("/api/v1/agents")
+                    .header("Authorization", "Bearer " + runtimeConfig.getBootstrapToken())
+                    .retrieve()
+                    .body(List.class);
+
+            if (agents == null) {
+                return unknownStatus(app.getSlug(), env.getSlug());
+            }
+
+            for (Map<String, Object> agent : agents) {
+                String agentAppId = (String) agent.get("applicationId");
+                String agentEnvId = (String) agent.get("environmentId");
+                if (app.getSlug().equals(agentAppId) && env.getSlug().equals(agentEnvId)) {
+                    String state = (String) agent.getOrDefault("state", "UNKNOWN");
+                    @SuppressWarnings("unchecked")
+                    List<String> routeIds = (List<String>) agent.getOrDefault("routeIds", Collections.emptyList());
+                    return new AgentStatusResponse(
+                            true,
+                            state,
+                            null,
+                            routeIds,
+                            app.getSlug(),
+                            env.getSlug()
+                    );
+                }
+            }
+
+            return unknownStatus(app.getSlug(), env.getSlug());
+
+        } catch (Exception e) {
+            log.warn("Failed to fetch agent status from cameleer3-server: {}", e.getMessage());
+            return unknownStatus(app.getSlug(), env.getSlug());
+        }
+    }
+
+    public ObservabilityStatusResponse getObservabilityStatus(UUID appId) {
+        var app = appRepository.findById(appId)
+                .orElseThrow(() -> new IllegalArgumentException("App not found: " + appId));
+
+        var env = environmentRepository.findById(app.getEnvironmentId())
+                .orElseThrow(() -> new IllegalArgumentException("Environment not found: " + app.getEnvironmentId()));
+
+        if (clickHouseDataSource == null) {
+            return new ObservabilityStatusResponse(false, false, false, null, 0);
+        }
+
+        try (var conn = clickHouseDataSource.getConnection()) {
+            String sql = "SELECT count() as cnt, max(start_time) as last_trace " +
+                         "FROM executions " +
+                         "WHERE application_id = ? AND environment_id = ? " +
+                         "AND start_time >= now() - INTERVAL 24 HOUR";
+            try (var stmt = conn.prepareStatement(sql)) {
+                stmt.setString(1, app.getSlug());
+                stmt.setString(2, env.getSlug());
+                try (var rs = stmt.executeQuery()) {
+                    if (rs.next()) {
+                        long count = rs.getLong("cnt");
+                        Timestamp lastTrace = rs.getTimestamp("last_trace");
+                        boolean hasTraces = count > 0;
+                        return new ObservabilityStatusResponse(
+                                hasTraces,
+                                false,
+                                false,
+                                hasTraces && lastTrace != null ? lastTrace.toInstant() : null,
+                                count
+                        );
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to query ClickHouse for observability status: {}", e.getMessage());
+        }
+
+        return new ObservabilityStatusResponse(false, false, false, null, 0);
+    }
+
+    private AgentStatusResponse unknownStatus(String applicationId, String environmentId) {
+        return new AgentStatusResponse(false, "UNKNOWN", null, Collections.emptyList(), applicationId, environmentId);
+    }
+}
--- a/src/main/java/net/siegeln/cameleer/saas/observability/ConnectivityHealthCheck.java
+++ b/src/main/java/net/siegeln/cameleer/saas/observability/ConnectivityHealthCheck.java
@@ -0,0 +1,48 @@
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.RestClient;
+
+@Component
+public class ConnectivityHealthCheck {
+
+    private static final Logger log = LoggerFactory.getLogger(ConnectivityHealthCheck.class);
+
+    private final RuntimeConfig runtimeConfig;
+
+    public ConnectivityHealthCheck(RuntimeConfig runtimeConfig) {
+        this.runtimeConfig = runtimeConfig;
+    }
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void verifyConnectivity() {
+        checkCameleer3Server();
+    }
+
+    private void checkCameleer3Server() {
+        try {
+            var client = RestClient.builder()
+                    .baseUrl(runtimeConfig.getCameleer3ServerEndpoint())
+                    .build();
+            var response = client.get()
+                    .uri("/actuator/health")
+                    .retrieve()
+                    .toBodilessEntity();
+            if (response.getStatusCode().is2xxSuccessful()) {
+                log.info("cameleer3-server connectivity: OK ({})",
+                        runtimeConfig.getCameleer3ServerEndpoint());
+            } else {
+                log.warn("cameleer3-server connectivity: HTTP {} ({})",
+                        response.getStatusCode(), runtimeConfig.getCameleer3ServerEndpoint());
+            }
+        } catch (Exception e) {
+            log.warn("cameleer3-server connectivity: FAILED ({}) - {}",
+                    runtimeConfig.getCameleer3ServerEndpoint(), e.getMessage());
+        }
+    }
+}
--- a/src/main/java/net/siegeln/cameleer/saas/observability/dto/AgentStatusResponse.java
+++ b/src/main/java/net/siegeln/cameleer/saas/observability/dto/AgentStatusResponse.java
@@ -0,0 +1,13 @@
+package net.siegeln.cameleer.saas.observability.dto;
+
+import java.time.Instant;
+import java.util.List;
+
+public record AgentStatusResponse(
+        boolean registered,
+        String state,
+        Instant lastHeartbeat,
+        List<String> routeIds,
+        String applicationId,
+        String environmentId
+) {}
--- a/src/main/java/net/siegeln/cameleer/saas/observability/dto/ObservabilityStatusResponse.java
+++ b/src/main/java/net/siegeln/cameleer/saas/observability/dto/ObservabilityStatusResponse.java
@@ -0,0 +1,11 @@
+package net.siegeln.cameleer.saas.observability.dto;
+
+import java.time.Instant;
+
+public record ObservabilityStatusResponse(
+        boolean hasTraces,
+        boolean hasMetrics,
+        boolean hasDiagrams,
+        Instant lastTraceAt,
+        long traceCount24h
+) {}
--- a/src/main/java/net/siegeln/cameleer/saas/observability/dto/UpdateRoutingRequest.java
+++ b/src/main/java/net/siegeln/cameleer/saas/observability/dto/UpdateRoutingRequest.java
@@ -0,0 +1,5 @@
+package net.siegeln.cameleer.saas.observability.dto;
+
+public record UpdateRoutingRequest(
+        Integer exposedPort
+) {}
--- a/src/main/java/net/siegeln/cameleer/saas/runtime/DockerRuntimeOrchestrator.java
+++ b/src/main/java/net/siegeln/cameleer/saas/runtime/DockerRuntimeOrchestrator.java
@@ -21,6 +21,7 @@ import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
 import java.util.Comparator;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;

@Component
@@ -87,6 +88,7 @@ public class DockerRuntimeOrchestrator implements RuntimeOrchestrator {
        var container = dockerClient.createContainerCmd(request.imageRef())
                .withName(request.containerName())
                .withEnv(envList)
+                .withLabels(request.labels() != null ? request.labels() : Map.of())
                .withHostConfig(hostConfig)
                .withHealthcheck(new HealthCheck()
                        .withTest(List.of("CMD-SHELL",
--- a/src/main/java/net/siegeln/cameleer/saas/runtime/RuntimeConfig.java
+++ b/src/main/java/net/siegeln/cameleer/saas/runtime/RuntimeConfig.java
@@ -39,6 +39,9 @@ public class RuntimeConfig {
    @Value("${cameleer.runtime.cameleer3-server-endpoint:http://cameleer3-server:8081}")
    private String cameleer3ServerEndpoint;

+    @Value("${cameleer.runtime.domain:localhost}")
+    private String domain;
+
    public long getMaxJarSize() { return maxJarSize; }
    public String getJarStoragePath() { return jarStoragePath; }
    public String getBaseImage() { return baseImage; }
@@ -50,6 +53,7 @@ public class RuntimeConfig {
    public int getContainerCpuShares() { return containerCpuShares; }
    public String getBootstrapToken() { return bootstrapToken; }
    public String getCameleer3ServerEndpoint() { return cameleer3ServerEndpoint; }
+    public String getDomain() { return domain; }

    public long parseMemoryLimitBytes() {
        var limit = containerMemoryLimit.trim().toLowerCase();
--- a/src/main/java/net/siegeln/cameleer/saas/runtime/StartContainerRequest.java
+++ b/src/main/java/net/siegeln/cameleer/saas/runtime/StartContainerRequest.java
@@ -9,5 +9,6 @@ public record StartContainerRequest(
        Map<String, String> envVars,
        long memoryLimitBytes,
        int cpuShares,
-        int healthCheckPort
+        int healthCheckPort,
+        Map<String, String> labels
 ) {}
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -45,5 +45,6 @@ cameleer:
    container-cpu-shares: ${CAMELEER_CONTAINER_CPU_SHARES:512}
    bootstrap-token: ${CAMELEER_AUTH_TOKEN:}
    cameleer3-server-endpoint: ${CAMELEER3_SERVER_ENDPOINT:http://cameleer3-server:8081}
+    domain: ${DOMAIN:localhost}
  clickhouse:
    url: ${CLICKHOUSE_URL:jdbc:clickhouse://clickhouse:8123/cameleer}
--- a/src/main/resources/db/migration/V010__add_exposed_port_to_apps.sql
+++ b/src/main/resources/db/migration/V010__add_exposed_port_to_apps.sql
@@ -0,0 +1 @@
+ALTER TABLE apps ADD COLUMN exposed_port INTEGER;
--- a/src/test/java/net/siegeln/cameleer/saas/observability/AgentStatusServiceTest.java
+++ b/src/test/java/net/siegeln/cameleer/saas/observability/AgentStatusServiceTest.java
@@ -0,0 +1,92 @@
+package net.siegeln.cameleer.saas.observability;
+
+import net.siegeln.cameleer.saas.app.AppEntity;
+import net.siegeln.cameleer.saas.app.AppRepository;
+import net.siegeln.cameleer.saas.environment.EnvironmentEntity;
+import net.siegeln.cameleer.saas.environment.EnvironmentRepository;
+import net.siegeln.cameleer.saas.runtime.RuntimeConfig;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.Optional;
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.*;
+
+@ExtendWith(MockitoExtension.class)
+class AgentStatusServiceTest {
+
+    @Mock private AppRepository appRepository;
+    @Mock private EnvironmentRepository environmentRepository;
+    @Mock private RuntimeConfig runtimeConfig;
+
+    private AgentStatusService agentStatusService;
+
+    @BeforeEach
+    void setUp() {
+        when(runtimeConfig.getCameleer3ServerEndpoint()).thenReturn("http://localhost:9999");
+        agentStatusService = new AgentStatusService(appRepository, environmentRepository, runtimeConfig);
+    }
+
+    @Test
+    void getAgentStatus_appNotFound_shouldThrow() {
+        when(appRepository.findById(any())).thenReturn(Optional.empty());
+        assertThrows(IllegalArgumentException.class,
+                () -> agentStatusService.getAgentStatus(UUID.randomUUID()));
+    }
+
+    @Test
+    void getAgentStatus_shouldReturnUnknownWhenServerUnreachable() {
+        var appId = UUID.randomUUID();
+        var envId = UUID.randomUUID();
+
+        var app = new AppEntity();
+        app.setId(appId);
+        app.setEnvironmentId(envId);
+        app.setSlug("my-app");
+        when(appRepository.findById(appId)).thenReturn(Optional.of(app));
+
+        var env = new EnvironmentEntity();
+        env.setId(envId);
+        env.setSlug("default");
+        when(environmentRepository.findById(envId)).thenReturn(Optional.of(env));
+
+        // Server at localhost:9999 won't be running — should return UNKNOWN gracefully
+        var result = agentStatusService.getAgentStatus(appId);
+
+        assertNotNull(result);
+        assertFalse(result.registered());
+        assertEquals("UNKNOWN", result.state());
+        assertEquals("my-app", result.applicationId());
+        assertEquals("default", result.environmentId());
+    }
+
+    @Test
+    void getObservabilityStatus_shouldReturnEmptyWhenClickHouseUnavailable() {
+        var appId = UUID.randomUUID();
+        var envId = UUID.randomUUID();
+
+        var app = new AppEntity();
+        app.setId(appId);
+        app.setEnvironmentId(envId);
+        app.setSlug("my-app");
+        when(appRepository.findById(appId)).thenReturn(Optional.of(app));
+
+        var env = new EnvironmentEntity();
+        env.setId(envId);
+        env.setSlug("default");
+        when(environmentRepository.findById(envId)).thenReturn(Optional.of(env));
+
+        // No ClickHouse DataSource injected — should return empty status
+        var result = agentStatusService.getObservabilityStatus(appId);
+
+        assertNotNull(result);
+        assertFalse(result.hasTraces());
+        assertEquals(0, result.traceCount24h());
+    }
+}
Author	SHA1	Message	Date
hsiegeln	9b1643c1ee	docs: update HOWTO with observability dashboard, routing, and agent status All checks were successful CI / build (push) Successful in 29s Details CI / build (pull_request) Successful in 48s Details CI / docker (push) Successful in 47s Details CI / docker (pull_request) Has been skipped Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 21:06:05 +02:00
hsiegeln	9f8d0f43ab	feat: add dashboard Traefik route and CAMELEER_TENANT_ID config Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 21:04:57 +02:00
hsiegeln	43cd2d012f	feat: add cameleer3-server startup connectivity check	2026-04-04 21:03:41 +02:00
hsiegeln	210da55e7a	feat: add Traefik routing labels for customer apps with exposed ports Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 21:03:04 +02:00
hsiegeln	08b87edd6e	feat: add agent status and observability status endpoints Implements AgentStatusService (TDD) that proxies cameleer3-server agent registry API and queries ClickHouse for trace counts. Gracefully degrades to UNKNOWN state when server is unreachable or DataSource is absent. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 21:01:43 +02:00
hsiegeln	024780c01e	feat: add exposed port routing and route URL to app API Adds domain config to RuntimeConfig/application.yml, expands AppResponse with exposedPort and computed routeUrl, adds updateRouting to AppService, and adds PATCH /{appId}/routing endpoint to AppController. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 20:57:37 +02:00
hsiegeln	d25849d665	feat: add labels support to StartContainerRequest and DockerRuntimeOrchestrator Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 20:55:16 +02:00
hsiegeln	b0275bcf64	feat: add exposed_port column to apps table	2026-04-04 20:53:56 +02:00
hsiegeln	f8d80eaf79	docs: add Phase 4 Observability Pipeline implementation plan All checks were successful CI / build (push) Successful in 28s Details CI / docker (push) Successful in 4s Details 8 tasks: migration, labels support, routing API, agent/observability status endpoints, Traefik routing labels, connectivity check, Docker Compose + env, HOWTO update. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 20:52:17 +02:00
hsiegeln	41629f3290	docs: add Phase 4 Observability Pipeline + Inbound Routing spec All checks were successful CI / build (push) Successful in 27s Details CI / docker (push) Successful in 4s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 20:47:51 +02:00
hsiegeln	b78dfa9a7b	docs: add HOWTO.md with install, start, and bootstrap instructions All checks were successful CI / build (push) Successful in 27s Details CI / docker (push) Successful in 4s Details Quick start, full installation guide, Logto setup, first tenant creation, app deployment walkthrough, API reference, tier limits, development commands, and troubleshooting. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 19:31:56 +02:00
hsiegeln	d81ce2b697	ci: revert artifact approach, use BuildKit cache for Maven deps All checks were successful CI / build (push) Successful in 29s Details CI / docker (push) Successful in 2m31s Details Gitea Actions doesn't support upload/download-artifact v4. Reverted to two-job approach (git clone + docker build). Added BuildKit cache mount (--mount=type=cache,target=/root/.m2) to Dockerfile so Maven deps persist across Docker builds on the same runner. First build downloads, subsequent builds are cached. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 19:27:08 +02:00
hsiegeln	cbf7d5c60f	ci: pass pre-built JAR to docker job via artifact Some checks failed CI / build (push) Failing after 51s Details CI / docker (push) Has been skipped Details Build job uploads the JAR, docker job downloads it and builds a runtime-only image. Eliminates duplicate Maven dependency download (~2min saving). The repo Dockerfile is kept for local builds. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 18:15:12 +02:00
hsiegeln	956eb13dd6	Merge pull request 'feat: Phase 3 — Runtime Orchestration + Environments' (#33 ) from feat/phase-3-runtime-orchestration into main All checks were successful CI / build (push) Successful in 29s Details CI / docker (push) Successful in 45s Details Reviewed-on: #33	2026-04-04 18:10:42 +02:00
				`@@ -0,0 +1 @@`
				`ALTER TABLE apps ADD COLUMN exposed_port INTEGER;`