Running Sentry On-Premise in Docker

I’ve been using Sentry for a long time. After hitting the limits of sentry.io, I decided to return to the self-hosted On-Premise version. Today I’ll show you how to quickly get Sentry running on your own server, naturally with Docker, since it has become the de facto standard in today’s world.

Installation

If you don’t have Docker installed yet, do that first:

sudo apt update
sudo apt install docker.io docker-compose

Clone the OnPremise repository onto the server where Sentry will run:

git clone https://github.com/getsentry/onpremise.git
cd onpremise

Configuration

Create an environment file to store your settings:

mv .env.example .env

Create persistent volumes for Sentry files and PostgreSQL data so they survive container restarts.

docker volume create --name=sentry-data
docker volume create --name=sentry-postgres

Generate a secret key:

docker-compose run --rm web config generate-secret-key

At the very end of the command’s output, you’ll see a key. Save it in the .env file as the value for SENTRY_SECRET_KEY.

If you need to use an external SMTP server, open the config.yml file for editing and fill in the settings. For Gmail, for example, it looks like this: mail.host: 'smtp.gmail.com' mail.port: 587 mail.username: 'example@gmail.com' mail.password: 'my_password' mail.use-tls: true

Now initialize the database:

docker-compose run --rm web upgrade

During this process, you’ll be asked to create the first account. Fill in the details so you can access the web interface. Once all the migrations have finished, Sentry will be ready to start.

If you make changes to config.yml later, you’ll need to rebuild the containers: docker-compose up --build -d

Starting Up

Use the -d flag to run the containers in the background:

docker-compose up -d

I prefer to let systemd supervise the service. To do that, add the unit below:

Create the file /etc/systemd/system/docker-sentry-onpremise.service:

[Unit]
Description=Sentry OnPremise: Docker Compose Application Service
Requires=docker.service
After=docker.service

[Service]
WorkingDirectory=</path/to/dir/onpremise>
ExecStart=/usr/bin/docker-compose up
ExecStop=/usr/bin/docker-compose down
TimeoutStartSec=0
Restart=on-failure

[Install]
WantedBy=multi-user.target

Replace </path/to/dir/onpremise> with the path to the onpremise directory you created earlier.

Now let’s enable and start our service:

sudo systemctl enable docker-sentry-onpremise
sudo systemctl start docker-sentry-onpremise

Nginx Configuration

By default, Sentry’s web server starts on port 9000. I’ve prepared an Nginx configuration to proxy requests to that port:

server {
    listen 443 ssl;
    server_name sentry.example.org;
    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;
    auth_basic "closed site";
    auth_basic_user_file htpasswd;

    location / {
        proxy_pass http://localhost:9000;
    }
}

server {
    listen 80;
    server_name sentry.example.org;
    return 301 https://$host$request_uri;
}

Read this article to learn how to get free SSL certificates from Let’s Encrypt.

If you don’t have the /etc/nginx/htpasswd file, generate it:

echo "<USERNAME>:`openssl passwd -apr1`" > /etc/nginx/htpasswd

Replace <USERNAME> with your chosen username.

Updating

If you want to update Sentry, it’s quite simple:

cd onpremise
git pull
docker-compose build
docker-compose run --rm web upgrade

Then restart the service. With systemd, you do it like this:

sudo systemctl restart docker-sentry-onpremise

That’s everything I wanted to cover. Leave your questions in the comments on this article.

If You Use Gmail

If you use Gmail as your SMTP server, you may run into an issue where Google’s servers block your Sentry service.

To resolve this, go to the “Security Settings” section of your Gmail account https://myaccount.google.com/security and allow access from “Less secure apps”: