NGINX automatic SSL

[mhkarimi1383]

Problem Statement

When I setup my self-hosted sentry instances, I have to run a separate webserver (like traefik) and point it to the NGINX service

Solution Brainstorm

Just like GitLab, We can Embed an ACME resolver (Like goacme/lego or certbot or acme.sh [I would prefer lego since it has a lot of native integrations and it is easier to configure specially if a user wants to get certificate using DNS01]) and handle TLS Termination natively

And by making it configurable, Users are able to Provide their own certificate too

Also by that We can make sentry to ask for user's domain on setup So It will set other configurations that should set while setting up sentry to work with a domain

If it is an accepted thing I Would like to make a PR for that

[aldy505]

I don't think this is a feature we should have on the repository. Users can edit the nginx.conf themselves, and create a branch on top of the release branches. Having an external reverse proxy would also validate whether the Docker Compose is down or not.

What do you think, does that makes sense to you?

[mhkarimi1383]

First of all Adding a new Reverse Proxy on top of NGINX adds another layer that Should handle connections and adds a bit of docker network overhead of top of that, Or some users may expose Sentry unencrypted to the internet or use CDN Services. For advanced users or users with their own proxy, They can just simply disable the functionality and keep the older behavior

If we don't want to do it here, We should Include some example of connecting a reverse proxy (like traefik to the docs)

[aldy505]

We already have that: https://develop.sentry.dev/self-hosted/production-enhancements/reverse-proxy/#reverse-proxy-examples