SLP_Software/slp-modular-cms
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

Warns against copying the reference project's nginx Sentry tunnel

Browse Source 
The backend already serves /sentry-tunnel itself with its own rate
limit, payload cap, and DSN-derived destination - exactly what that
nginx block exists to avoid needing. Proxying the same path at nginx
intercepts it first and silently drops all three protections.
This commit is contained in:
Sluijsens
2026-07-29 13:43:33 +02:00
parent 50c1a5106d
commit c438ec8b1d
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
aidlc-docs/features/gitea-deployment-workflow/audit.md
+10
View File
@@ -1399,3 +1399,13 @@ by Infrastructure Design. U5 carries REF-U3-01's Umami origin gate plus FR-21 an
**Context**: OPERATIONS — Deployment Setup, reverse-proxy topology corrected across Operations and Construction docs
---
## Deployment Setup — nginx Sentry Tunnel Block Shadows the Backend's Own Tunnel
**Timestamp**: 2026-07-29T00:50:00Z
**User Input**: Shared their actual proxy-Pi nginx config, which includes a `location /sentry-tunnel { proxy_pass https://o4511795618185216.ingest.de.sentry.io/...; }` block carried over from the reference project, and asked whether it's still needed.
**AI Response**: "Confirmed this is a real conflict, not just redundancy: SentryTunnelExtensions.cs (U4) already serves /sentry-tunnel on the backend itself, with its own rate limiter, TunnelMaxPayloadBytes cap, and a destination derived dynamically from Observability__SentryDsn. The code's own comment says the reference project's nginx-tunnel approach is exactly what this backend feature was built to avoid. The user's nginx block intercepts the same path before it reaches pi-main, bypassing all three backend protections and hardcoding the Sentry org/project ID as a second place that must be kept in sync with the app config. Recommended removing the nginx block entirely and letting /sentry-tunnel fall through to pi-main like any other request. Added an explicit warning in deployment-instructions.md § 1.7 telling readers not to carry this nginx block over from the reference project."
**Context**: OPERATIONS — Deployment Setup, real host config revealed the reference project's nginx Sentry-tunnel pattern was carried over unnecessarily and conflicts with this app's own built-in tunnel
---