Add OpenSensor API Sentry monitoring

.github/workflows/build_api/action.yml

@@ -48,6 +48,7 @@ runs:
       shell: bash
       run: >
         docker build ${{ inputs.docker_build_context }}
+        --build-arg SENTRY_RELEASE="opensensor-api@${GITHUB_SHA}"
         -f ${{ inputs.dockerfile }}
         -t ${{ steps.image_tags.outputs.sha }}
         -t ${{ steps.image_tags.outputs.latest }}

Dockerfile

@@ -39,4 +39,10 @@ USER opensensor-api
 ENV TZ=UTC
 
 # Start opensensor API
+# Public Sentry ingestion key; upload credentials are never part of the image.
+ARG SENTRY_RELEASE
+ENV SENTRY_DSN=https://f342f997ac7c582759f18b6d46a71956@o4512337837686784.ingest.us.sentry.io/4512337894637568 \
+    SENTRY_ENVIRONMENT=production \
+    SENTRY_RELEASE=${SENTRY_RELEASE}
+
 CMD ["/usr/src/.venv/bin/uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8010", "--timeout-keep-alive", "30", "--log-level", "info"]

Pipfile

@@ -4,6 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
+sentry-sdk = "==2.73.0"
 fastapi = "*"
 uvicorn = "*"
 pydantic = "*"

main.py

@@ -3,6 +3,9 @@
 from opensensor.app import app
 from opensensor.collection_apis import router as collection_apis_router
 from opensensor.devices import router as device_apis_router
+from opensensor.observability import init_sentry
+
+init_sentry()
 
 
 @app.get("/")

opensensor/observability.py

@@ -0,0 +1,46 @@
+"""Opt-in Sentry error and trace capture; no request payloads or local variables."""
+
+import os
+from urllib.parse import urlsplit, urlunsplit
+
+import sentry_sdk
+
+
+def scrub_event(event, hint):
+    request = event.get("request")
+    if request:
+        for key in ("data", "cookies", "headers", "query_string"):
+            request.pop(key, None)
+        if request.get("url"):
+            parts = urlsplit(request["url"])
+            request["url"] = urlunsplit((parts.scheme, parts.netloc, parts.path, "", ""))
+    event.pop("user", None)
+    event.pop("extra", None)
+    event["breadcrumbs"] = {"values": []}
+    return event
+
+
+def init_sentry() -> None:
+    dsn = os.environ.get("SENTRY_DSN")
+    if not dsn or os.environ.get("SENTRY_ENABLED", "true").lower() == "false":
+        return
+    sentry_sdk.init(
+        dsn=dsn,
+        environment=os.environ.get("SENTRY_ENVIRONMENT", "production"),
+        release=os.environ.get("SENTRY_RELEASE") or None,
+        traces_sample_rate=0.1,
+        data_collection={
+            "user_info": False,
+            "cookies": {"mode": "off"},
+            "http_headers": {"request": {"mode": "off"}},
+            "http_bodies": [],
+            "url_query_params": {"mode": "off"},
+            "database_query_data": False,
+            "queues": False,
+            "stack_frame_variables": False,
+            "gen_ai": {"inputs": False, "outputs": False},
+            "graphql": {"document": False, "variables": False},
+        },
+        before_send=scrub_event,
+        before_send_transaction=scrub_event,
+    )