ECI-2165: add CUSTOM_DD_SITE for custom intake endpoints

[yuhuyoyo]

Summary

Adds a CUSTOM_DD_SITE environment variable that lets the OCI forwarders send to custom intake endpoints without provisioning a per-customer TLS certificate.

Introduces client.IntakeURL(prefix, path, site) to centralize intake URL construction across the events, logs, and metrics forwarders (previously each handler inlined its own fmt.Sprintf).

Why

The certificate covering custom intake endpoints has its SAN at a wildcard level (e.g. *.mrf.datadoghq.com). To stay under that single cert for any customer, the host must use dashes instead of dots to separate the prefix labels — e.g. http-intake-logs-customerA.mrf.datadoghq.com rather than http-intake.logs.customerA.mrf.datadoghq.com. This avoids creating a certificate per customer.

How it works

IntakeURL builds the intake URL for a given host prefix and API path:

• CUSTOM_DD_SITE unset (default, unchanged behavior):

  https://{prefix}.{DD_SITE}{path}
  

  e.g. https://http-intake.logs.datadoghq.com/api/v2/logs

• CUSTOM_DD_SITE set — provides the full host base following the (dot→dash) prefix:

  https://{prefix-with-dashes}-{CUSTOM_DD_SITE}{path}
  

  e.g. with CUSTOM_DD_SITE=customerA.mrf.datadoghq.com:

  • https://cloudplatform-intake-customerA.mrf.datadoghq.com/api/v2/cloudchanges
  • https://http-intake-logs-customerA.mrf.datadoghq.com/api/v2/logs
  • https://ocimetrics-intake-customerA.mrf.datadoghq.com/api/v2/ocimetrics

The base domain is not hardcoded — CUSTOM_DD_SITE carries the full base, so it can be repointed (e.g. off mrf.datadoghq.com) with no code change.

Changes

• lib/client/client.go — new IntakeURL helper.
• events-forwarder/internal/handler/handler.go — use IntakeURL.
• logs-forwarder/internal/handler/handler.go — use IntakeURL.
• metrics-forwarder/internal/handler/handler.go — use IntakeURL.
• lib/client/client_test.go — TestIntakeURL covering default and custom-site forms.

Verification

• go build ./... passes for lib, events-forwarder, logs-forwarder, metrics-forwarder.
• All existing tests pass; new TestIntakeURL passes (5 subtests).
• Backfill bucket routing (backfillBucketName) is unaffected — it matches on path substrings (cloudchanges/logs/ocimetrics), which are preserved.

Out of scope / follow-ups

• Terraform wiring to pass CUSTOM_DD_SITE into the function config (datadog-terraform-onboarding / datadog-integration locals.tf) is not included in this PR. The forwarders read the env var directly, so it can be set on the function config out-of-band until the Terraform variable is added.

🤖 Generated with Claude Code

[github-actions]

Version bumped: 1.2.4 → 1.2.5 (patch auto-bump)

Override if needed:

• Breaking change → manually set VERSION and datadog-terraform-onboarding/VERSION to bump the major digit.
• New feature → manually bump the minor digit.
• Minor bug fix → no change needed; the patch bump above is correct.