coilyco-gaming/eco-app

Watch

Restore a valid SENTRY_DSN in SSM (Sentry currently disabled in prod) #44

New issue

Open

opened 2026-07-03 21:18:35 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-03 21:18:35 +00:00

Owner

Context

Follow-up to eco-app#43. The prod crash-loop was hardened away (a malformed DSN now log-and-skips), and eco-app is live again on the current image. But the root-cause misconfig is still present: /sentry-dsn/eco-mcp-app in AWS SSM holds a malformed value (64 bytes, no https:// scheme), last modified 2026-06-23.

Consequence: Sentry is silently disabled in production right now. The app boots fine and logs a warning (SENTRY_DSN is set but invalid; continuing without Sentry) on every start, but no errors are being captured.

Ask

Put the correct Sentry DSN back into SSM (SecureString), then restart the deployment so the running pod picks it up:

ward ops aws ssm put-parameter --name /sentry-dsn/eco-mcp-app --type SecureString --overwrite --value '<the real https://...@...ingest.sentry.io/... DSN>'
ward ops kubectl -- rollout restart deploy/coilysiren-eco-app-app -n coilysiren-eco-app

A valid DSN looks like https://<key>@o<org>.ingest.sentry.io/<projid>. Needs the real value, which only Kai has - not an agent action.

## Context Follow-up to eco-app#43. The prod crash-loop was hardened away (a malformed DSN now log-and-skips), and eco-app is live again on the current image. But the root-cause misconfig is still present: `/sentry-dsn/eco-mcp-app` in AWS SSM holds a malformed value (64 bytes, no `https://` scheme), last modified 2026-06-23. **Consequence:** Sentry is silently **disabled** in production right now. The app boots fine and logs a warning (`SENTRY_DSN is set but invalid; continuing without Sentry`) on every start, but no errors are being captured. ## Ask Put the correct Sentry DSN back into SSM (SecureString), then restart the deployment so the running pod picks it up: ``` ward ops aws ssm put-parameter --name /sentry-dsn/eco-mcp-app --type SecureString --overwrite --value '<the real https://...@...ingest.sentry.io/... DSN>' ward ops kubectl -- rollout restart deploy/coilysiren-eco-app-app -n coilysiren-eco-app ``` A valid DSN looks like `https://<key>@o<org>.ingest.sentry.io/<projid>`. Needs the real value, which only Kai has - not an agent action.

coilyco-ops added the

priority

label

2026-07-04 09:50:32 +00:00

coilyco-ops added the

autonomy

async-consult

label

2026-07-07 04:09:47 +00:00

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops referenced this issue

2026-07-25 13:36:45 +00:00

[interactive] Resolve remaining Eco App decisions and live checkpoints #155

coilyco-ops added

and removed

labels

2026-07-25 15:00:15 +00:00

coilyco-ops referenced this issue

2026-07-26 00:22:20 +00:00

o11y on the app server layer #121

coilyco-ops commented

2026-07-26 00:25:31 +00:00

Author

Owner

Current read-only verification confirms the issue is still live: the ExternalSecret is SecretSynced, but the current eco-app pod logs SENTRY_DSN is set but invalid with an empty-scheme BadDsn. The source parameter value, not reconciliation, is the fault.

The destination decision is now GlitchTip, not a repair back to hosted Sentry. Infrastructure#395 owns creating the real eco-app GlitchTip project and choosing a DSN hostname reachable from the kai-server pod. The operator then overwrites the existing SecureString, forces ExternalSecret refresh, restarts eco-app, sends one redacted test exception, and confirms it appears in the intended GlitchTip project. The operator must not expose the DSN in this issue.

This remains an interactive secret and live-verification checkpoint. No app code change is required.

Current read-only verification confirms the issue is still live: the ExternalSecret is `SecretSynced`, but the current eco-app pod logs `SENTRY_DSN is set but invalid` with an empty-scheme `BadDsn`. The source parameter value, not reconciliation, is the fault. The destination decision is now GlitchTip, not a repair back to hosted Sentry. Infrastructure#395 owns creating the real `eco-app` GlitchTip project and choosing a DSN hostname reachable from the kai-server pod. The operator then overwrites the existing SecureString, forces ExternalSecret refresh, restarts eco-app, sends one redacted test exception, and confirms it appears in the intended GlitchTip project. The operator must not expose the DSN in this issue. This remains an `interactive` secret and live-verification checkpoint. No app code change is required.

coilyco-ops added

priority

and removed

priority

labels

2026-07-29 06:20:07 +00:00

~~coilyco-ops referenced this issue from coilyco-gaming/.github 2026-08-01 17:15:36 +00:00~~

Define the gaming-wide portfolio triage pattern #3

coilyco-ops added

priority

autonomy

async-consult