cloud: drop hardcoded VITE_PUBLIC_SENTRY_DSN from wrangler.jsonc (#382)

The frontend Sentry DSN was committed in wrangler.jsonc `vars`. Move it to a Wrangler secret (same pattern as SENTRY_DSN, DATABASE_URL, WORKOS_*) so it's not in source and persists across every deploy path (secrets are never deleted by deployments, regardless of --keep-vars). The client bundle continues to get the value at build time via Vite reading process.env.VITE_PUBLIC_SENTRY_DSN under `op run --env-file=.env.production`. One-time setup after deploying this change: op run --env-file=.env.production -- sh -c 'printf "%s" "$VITE_PUBLIC_SENTRY_DSN" | bunx wrangler secret put VITE_PUBLIC_SENTRY_DSN'

Rhys Sullivan committed 6 months ago

Commit 030f2f81 parent 8fa13572 files · +1 −1Browse files

Unified · Split

2 files

apps/cloud/src/env-augment.d.ts +1 −0
apps/cloud/wrangler.jsonc +0 −1

apps/cloud/src/env-augment.d.ts+1−0

@@ -11,6 +11,7 @@ declare global { · 10 unmodified lines
11	11	AXIOM_TRACES_URL?: string;
12	12	AXIOM_TRACES_SAMPLE_RATIO?: string;
13	13	SENTRY_DSN?: string;
	14	+ VITE_PUBLIC_SENTRY_DSN?: string;
14	15
15	16	// Datastore (dev only — prod uses HYPERDRIVE binding)
16	17	DATABASE_URL?: string;

apps/cloud/wrangler.jsonc+0−1

@@ -49,7 +49,6 @@ · 48 unmodified lines
49	49	},
50	50	],
51	51	"vars": {
52		− "VITE_PUBLIC_SENTRY_DSN": "https://e20b1bdeea27008092a4dc0ac303e97a@o4511196985556992.ingest.us.sentry.io/4511197010067456",
53	52	"VITE_PUBLIC_SITE_URL": "https://executor.sh",
54	53	},
55	54	}