feat: environment variables for TLS

[RogerHYang]

resolves #7272

Add TLS Support for Phoenix Server

Overview

This PR implements Transport Layer Security (TLS) support for the Phoenix server, enabling secure HTTPS and gRPC connections. This enhancement allows for encrypted communication between clients and the server, with optional mutual TLS (mTLS) authentication.

Caveat: When using encrypted private keys (via PHOENIX_TLS_KEY_FILE_PASSWORD), the cryptography package must be installed. This package is used for decrypting private keys and validating certificate-key pairs.

Key Features

• Secure HTTP & gRPC Connections: Enable HTTPS and secure gRPC endpoints
• Flexible Configuration: Control TLS settings through environment variables
• Optional Client Verification: Support for mutual TLS (mTLS) authentication
• Integration Test Support: Added TLS-aware testing infrastructure

Configuration Options

The following environment variables control TLS behavior:

Variable	Type	Description	Example
PHOENIX_TLS_ENABLED	boolean	Enable/disable TLS support	true
PHOENIX_TLS_CERT_FILE	string	Path to TLS certificate file	/path/to/cert.pem
PHOENIX_TLS_KEY_FILE	string	Path to private key file	/path/to/key.pem
PHOENIX_TLS_KEY_FILE_PASSWORD	string	Password for encrypted private key file	mysecretpassword
PHOENIX_TLS_CA_FILE	string	Path to CA certificate (for client verification)	/path/to/ca.pem
PHOENIX_TLS_VERIFY_CLIENT	boolean	Enable client certificate verification	true

Technical Changes

• Added TLS configuration handling in server setup
• Implemented secure connection support for both HTTP and gRPC servers
• Updated server welcome message to display TLS status
• Enhanced integration tests with TLS support

Appendix

Implementation Details

• Certificate Handling: The server supports both encrypted and unencrypted private keys. If the key file is password-protected, use PHOENIX_TLS_KEY_FILE_PASSWORD to provide the decryption password.
• gRPC Integration: When TLS is enabled, gRPC server automatically switches to secure mode using the provided certificates.
• Client Verification: When PHOENIX_TLS_VERIFY_CLIENT is enabled, clients must provide valid certificates signed by the CA specified in PHOENIX_TLS_CA_FILE.
• OTLP Integration: OTLP exporter configuration automatically adapts to TLS settings using environment variables:
  • OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE
  • OTEL_EXPORTER_OTLP_TRACES_CLIENT_CERTIFICATE
  • OTEL_EXPORTER_OTLP_TRACES_CLIENT_KEY