53 lines
2.7 KiB
Bash
53 lines
2.7 KiB
Bash
# infra/sentry/.env.example
|
|
#
|
|
# Copy to `.env` and fill before running ./install.sh. Never commit the real
|
|
# .env — it is git-ignored (see .gitignore). Use Coolify's secret vault to
|
|
# manage the production values; this file is only the template.
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Public URL — must match the Traefik-routed hostname in docker-compose.override.yml
|
|
# -----------------------------------------------------------------------------
|
|
SENTRY_BASE_URL=https://sentry.boiler.saas-ctrl.com
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Admin / superuser bootstrap
|
|
# -----------------------------------------------------------------------------
|
|
# install.sh seeds this user on first run via `sentry createuser --superuser`.
|
|
# Enable 2FA in the UI immediately after first login (Hardening Checklist).
|
|
SENTRY_ADMIN_EMAIL=ops@example.com
|
|
SENTRY_ADMIN_PASSWORD=replace-me-strong-password
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Sentry secret key
|
|
# -----------------------------------------------------------------------------
|
|
# Generate ONCE with: python -c "import secrets; print(secrets.token_urlsafe(50))"
|
|
# Losing this key invalidates all session cookies AND makes encrypted backups
|
|
# unreadable. Store it both in Coolify secrets AND in an offline password vault.
|
|
SENTRY_SECRET_KEY=replace-me-with-50-chars-of-urlsafe-entropy
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Project DSNs (filled AFTER first deploy — read from the Sentry UI)
|
|
# -----------------------------------------------------------------------------
|
|
# Three projects are created post-install: API, Worker, Web. Their DSNs feed
|
|
# into the apps' own .env via Coolify (see Phase 02 tasks #30 / #31).
|
|
SENTRY_DSN_API=
|
|
SENTRY_DSN_WORKER=
|
|
SENTRY_DSN_WEB=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# S3 backup target (consumed by infra/sentry/backup/)
|
|
# -----------------------------------------------------------------------------
|
|
# Endpoint format examples:
|
|
# AWS: https://s3.eu-central-1.amazonaws.com
|
|
# Hetzner: https://nbg1.your-objectstorage.com
|
|
# MinIO local: https://minio.boiler.saas-ctrl.com
|
|
SENTRY_S3_BACKUP_ENDPOINT=https://nbg1.your-objectstorage.com
|
|
SENTRY_S3_BACKUP_BUCKET=boilerplate-sentry-backups
|
|
SENTRY_S3_BACKUP_ACCESS_KEY=replace-me
|
|
SENTRY_S3_BACKUP_SECRET_KEY=replace-me
|
|
|
|
# Optional: GPG recipient fingerprint to encrypt the tarballs with before upload.
|
|
# If left empty, backup.sh falls back to AES256 with the SENTRY_SECRET_KEY as
|
|
# symmetric passphrase (still better than plaintext, but rotate carefully).
|
|
SENTRY_BACKUP_GPG_RECIPIENT=
|