Repository: goauthentik/authentik

Issue:
internal: allow Sentry DSN to be configured by end user
## Details

The existing Sentry instrumentation is fairly valuable for performance optimization purposes, but having Sentry hard-coded to report to `https://sentry.beryju.org` makes it a pain to override during local development.

## Changes

### New Features

* Allow the Sentry DSN to be overridden via `AUTHENTIK_ERROR_REPORTING__SENTRY_DSN`.

## Additional

I updated the configuration docs to list the new configuration setting, and _slightly_ tweaked the wording of the surrounding documentation to explain the dichotomy between the default DSN -- useful for debugging issues in collaboration with authentik devs, anonymous performance data, etc -- and specifying a custom one.


Discussion:
### <span aria-hidden="true">✅</span> Deploy Preview for *authentik* ready!


|  Name | Link |
|---------------------------------|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 09ede8776c0e4010701adf802134310e2feabc46 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/authentik/deploys/634f392d6de1d700092b5050 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-3813--authentik.netlify.app](https://deploy-preview-3813--authentik.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTM4MTMtLWF1dGhlbnRpay5uZXRsaWZ5LmFwcCJ9.x4HDBJAkBaNgMaiNqZRH2RLQos72jLBd6Vp6VvzhC8k)<br /><br />_Use your smartphone camera to open QR code link._</details> |
---

_To edit notification comments on pull requests, go to your [Netlify site settings](https://app.netlify.com/sites/authentik/settings/deploys#deploy-notifications)._
I haven't made this configurable in the past, as the DSN is also in the Web Interface and the Outposts, so it would have to be exposed in the authentik config, and I'm not sure how people would feel about that.

Using it for development purposes is certainly valid, but if it's a setting it should also be set for the embedded outpost (see https://github.com/goauthentik/authentik/blob/c22dae868c0791b405fb800c57edfed0af2d9b53/cmd/server/main.go)
# [Codecov](https://codecov.io/gh/goauthentik/authentik/pull/3813?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik) Report
Base: **92.59**% // Head: **92.60**% // Increases project coverage by **`+0.01%`** :tada:
> Coverage data is based on head [(`6d091a3`)](https://codecov.io/gh/goauthentik/authentik/pull/3813?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik) compared to base [(`8385dd7`)](https://codecov.io/gh/goauthentik/authentik/commit/8385dd77cc74e56f07e60fd190540833d0134220?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik).
> Patch coverage: 100.00% of modified lines in pull request are covered.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #3813      +/-   ##
==========================================
+ Coverage   92.59%   92.60%   +0.01%     
==========================================
  Files         470      470              
  Lines       22777    22778       +1     
==========================================
+ Hits        21089    21091       +2     
+ Misses       1688     1687       -1     
```

| Flag | Coverage Δ | |
|---|---|---|
| e2e | `54.33% <100.00%> (+0.01%)` | :arrow_up: |
| integration | `27.98% <100.00%> (+0.01%)` | :arrow_up: |
| unit | `89.17% <100.00%> (+0.01%)` | :arrow_up: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/goauthentik/authentik/pull/3813?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik) | Coverage Δ | |
|---|---|---|
| [authentik/lib/sentry.py](https://codecov.io/gh/goauthentik/authentik/pull/3813/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik#diff-YXV0aGVudGlrL2xpYi9zZW50cnkucHk=) | `96.00% <100.00%> (+0.06%)` | :arrow_up: |
| [authentik/lib/config.py](https://codecov.io/gh/goauthentik/authentik/pull/3813/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik#diff-YXV0aGVudGlrL2xpYi9jb25maWcucHk=) | `100.00% <0.00%> (+0.83%)` | :arrow_up: |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik)

</details>

[:umbrella: View full report at Codecov](https://codecov.io/gh/goauthentik/authentik/pull/3813?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik).   
:loudspeaker: Do you have feedback about the report comment? [Let us know in this issue](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goauthentik).

I'll take a look at the link you sent and see about making it configurable there, too.

> I haven't made this configurable in the past, as the DSN is also in the Web Interface and the Outposts, so it would have to be exposed in the authentik config, and I'm not sure how people would feel about that.

It's not clear to me why an otherwise internet-accessible Sentry DSN being in the configuration would be something people don't like. There's passwords and _actual_ credentials in there. What am I missing?




Resolving patch:
diff --git a/authentik/api/v3/config.py b/authentik/api/v3/config.py
--- a/authentik/api/v3/config.py
+++ b/authentik/api/v3/config.py
@@ -35,6 +35,7 @@ class ErrorReportingConfigSerializer(PassiveSerializer):
     """Config for error reporting"""
 
     enabled = BooleanField(read_only=True)
+    sentry_dsn = CharField(read_only=True)
     environment = CharField(read_only=True)
     send_pii = BooleanField(read_only=True)
     traces_sample_rate = FloatField(read_only=True)
@@ -77,6 +78,7 @@ def get_config(self) -> ConfigSerializer:
             {
                 "error_reporting": {
                     "enabled": CONFIG.y("error_reporting.enabled"),
+                    "sentry_dsn": CONFIG.y("error_reporting.sentry_dsn"),
                     "environment": CONFIG.y("error_reporting.environment"),
                     "send_pii": CONFIG.y("error_reporting.send_pii"),
                     "traces_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.4)),
diff --git a/authentik/lib/sentry.py b/authentik/lib/sentry.py
--- a/authentik/lib/sentry.py
+++ b/authentik/lib/sentry.py
@@ -34,7 +34,6 @@
 from authentik.lib.utils.reflection import class_to_path, get_env
 
 LOGGER = get_logger()
-SENTRY_DSN = "https://a579bb09306d4f8b8d8847c052d3a1d3@sentry.beryju.org/8"
 
 
 class SentryWSMiddleware(BaseMiddleware):
@@ -71,7 +70,7 @@ def sentry_init(**sentry_init_kwargs):
     kwargs.update(**sentry_init_kwargs)
     # pylint: disable=abstract-class-instantiated
     sentry_sdk_init(
-        dsn=SENTRY_DSN,
+        dsn=CONFIG.y("error_reporting.sentry_dsn"),
         integrations=[
             DjangoIntegration(transaction_style="function_name"),
             CeleryIntegration(),


Test patch:
diff --git a/internal/outpost/ak/test.go b/internal/outpost/ak/test.go
--- a/internal/outpost/ak/test.go
+++ b/internal/outpost/ak/test.go
@@ -19,7 +19,7 @@ func TestSecret() string {
 
 func MockConfig() api.Config {
 	return *api.NewConfig(
-		*api.NewErrorReportingConfig(false, "test", false, 0.0),
+		*api.NewErrorReportingConfig(false, "https://foo.bar/9", "test", false, 0.0),
 		[]api.CapabilitiesEnum{},
 		100,
 		100,