119 lines
4.3 KiB
YAML
119 lines
4.3 KiB
YAML
# Compose overlay for the upstream getsentry/self-hosted stack pinned at
|
|
# 25.12.1. This file is copied into `upstream/self-hosted/` by `install.sh`
|
|
# and merged on top of the upstream `docker-compose.yml`.
|
|
#
|
|
# Scope of overrides:
|
|
# 1. Pin all volumes onto Coolify's host-mount path (`/data/coolify/services/sentry/...`)
|
|
# so backups + log-rotation use the same disk plane as every other Coolify stack.
|
|
# 2. Attach the `nginx` (HTTP entry) service to Coolify's external `coolify` network
|
|
# and add Traefik labels (see traefik.labels.yml for the canonical label set).
|
|
# 3. Enforce SSL-aware behavior (TLS terminated by Traefik in front of `nginx`).
|
|
# 4. Pass through the project-specific env-vars from `.env`.
|
|
# 5. Keep Postgres / ClickHouse / Kafka / Redis on the internal network ONLY —
|
|
# we never expose them with a `ports:` mapping (see Security Notes in detail-MD).
|
|
#
|
|
# Anything not mentioned here inherits from upstream. Do NOT redeclare full services;
|
|
# Compose merge handles partials cleanly.
|
|
|
|
version: "3.8"
|
|
|
|
# Coolify-managed external network. Created by Coolify itself; we just join it.
|
|
networks:
|
|
default:
|
|
# Internal Sentry-only network; upstream calls this `default` already.
|
|
name: sentry-net
|
|
coolify:
|
|
external: true
|
|
|
|
services:
|
|
# ----- HTTP entry point: Traefik-routed, no host port-mapping -----
|
|
nginx:
|
|
networks:
|
|
- default
|
|
- coolify
|
|
# Remove any host port-publish from upstream — Traefik handles ingress.
|
|
ports: !reset []
|
|
environment:
|
|
SENTRY_USE_SSL: "1"
|
|
labels:
|
|
# Canonical Traefik labels live in traefik.labels.yml. Coolify also injects
|
|
# its own labels; the ones below are the project-specific routing rules.
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=coolify"
|
|
- "traefik.http.routers.sentry.rule=Host(`sentry.boiler.saas-ctrl.com`)"
|
|
- "traefik.http.routers.sentry.entrypoints=https"
|
|
- "traefik.http.routers.sentry.tls=true"
|
|
- "traefik.http.routers.sentry.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.sentry.loadbalancer.server.port=80"
|
|
# HTTP -> HTTPS redirect
|
|
- "traefik.http.routers.sentry-http.rule=Host(`sentry.boiler.saas-ctrl.com`)"
|
|
- "traefik.http.routers.sentry-http.entrypoints=http"
|
|
- "traefik.http.routers.sentry-http.middlewares=sentry-https-redirect"
|
|
- "traefik.http.middlewares.sentry-https-redirect.redirectscheme.scheme=https"
|
|
|
|
# ----- Sentry web (Django) -----
|
|
web:
|
|
environment:
|
|
SENTRY_USE_SSL: "1"
|
|
SENTRY_SINGLE_ORGANIZATION: "true"
|
|
SENTRY_ADMIN_EMAIL: ${SENTRY_ADMIN_EMAIL:?must be set in .env}
|
|
# Mount our overlay sentry.conf.py on top of the upstream default so the
|
|
# hardened settings (no public signup, OTLP feature flag, empty symbol
|
|
# sources) are loaded at process start.
|
|
volumes:
|
|
- ./sentry/sentry.conf.py:/etc/sentry/sentry.conf.py:ro
|
|
|
|
# ----- Workers + cron share the same image; same overlay applies -----
|
|
worker:
|
|
environment:
|
|
SENTRY_USE_SSL: "1"
|
|
SENTRY_SINGLE_ORGANIZATION: "true"
|
|
volumes:
|
|
- ./sentry/sentry.conf.py:/etc/sentry/sentry.conf.py:ro
|
|
|
|
cron:
|
|
environment:
|
|
SENTRY_USE_SSL: "1"
|
|
SENTRY_SINGLE_ORGANIZATION: "true"
|
|
volumes:
|
|
- ./sentry/sentry.conf.py:/etc/sentry/sentry.conf.py:ro
|
|
|
|
# ----- Relay: enable OTLP via custom config.yml overlay -----
|
|
relay:
|
|
volumes:
|
|
- ./relay/config.yml:/etc/relay/config.yml:ro
|
|
|
|
# ----- Postgres: pin onto Coolify-disk volume, NO host port -----
|
|
postgres:
|
|
ports: !reset []
|
|
volumes:
|
|
- /data/coolify/services/sentry/postgres-data:/var/lib/postgresql/data
|
|
|
|
# ----- ClickHouse: pin onto Coolify-disk volume, NO host port -----
|
|
clickhouse:
|
|
ports: !reset []
|
|
volumes:
|
|
- /data/coolify/services/sentry/clickhouse-data:/var/lib/clickhouse
|
|
|
|
# ----- Kafka + Zookeeper: internal only -----
|
|
kafka:
|
|
ports: !reset []
|
|
volumes:
|
|
- /data/coolify/services/sentry/kafka-data:/var/lib/kafka/data
|
|
|
|
zookeeper:
|
|
ports: !reset []
|
|
volumes:
|
|
- /data/coolify/services/sentry/zookeeper-data:/var/lib/zookeeper/data
|
|
|
|
# ----- Redis: internal only -----
|
|
redis:
|
|
ports: !reset []
|
|
volumes:
|
|
- /data/coolify/services/sentry/redis-data:/data
|
|
|
|
# ----- Symbolicator: no external sym sources (see sentry.conf.py) -----
|
|
symbolicator:
|
|
volumes:
|
|
- /data/coolify/services/sentry/symbolicator-data:/data
|