Document Sentry self-hosted deployment

docs/network.md

@@ -8,12 +8,12 @@ Current model:
 
 * `internal` for private databases and backend service traffic
 * `proxy` for HTTP and HTTPS services routed by Nginx Proxy Manager
-* Isolated stack networks for specialized infrastructure such as Jitsi, Xray, monitoring and CI/CD runners
+* Isolated stack networks for specialized infrastructure such as Jitsi, Xray, monitoring, Sentry and CI/CD runners
 
 Verified runtime snapshot:
 
 ```text
-2026-06-24 10:15 CEST, with Nextcloud evidence added from 2026-07-08 13:21:13 +02:00
+2026-06-24 10:15 CEST, with Nextcloud and Sentry evidence added from 2026-07-08 server output
 ```
 
 ---
@@ -74,6 +74,7 @@ Public services:
 * Jitsi Web
 * BaGet
 * Nextcloud
+* Sentry
 
 Internal monitoring services:
 
@@ -111,6 +112,7 @@ jitsi-docker-jitsi-meet-aa76415_meet.jitsi
 xray_default
 gitea-runner_default
 monitoring stack network
+sentry-self-hosted_default
 ```
 
 #### jitsi-docker-jitsi-meet-aa76415_meet.jitsi
@@ -248,6 +250,35 @@ Verified subnet:
 172.27.0.0/16
 ```
 
+#### sentry-self-hosted_default
+
+Purpose:
+
+* Internal Sentry event processing, storage and worker communication
+* Keep Sentry backing services isolated from shared application networks
+
+Services:
+
+* Sentry web, relay, worker, cron and consumer services
+* Kafka
+* Snuba
+* ClickHouse
+* PostgreSQL
+* Redis
+* SeaweedFS
+
+Public attachment:
+
+* Public access is through Nginx Proxy Manager at `sentry.silveressence.net`.
+* The public entry container is `sentry-self-hosted-nginx-1`.
+* Sentry databases, queues and workers must remain internal to the Sentry deployment.
+
+Verified subnet:
+
+```text
+172.25.0.0/16
+```
+
 ---
 
 ## Runtime-Published Ports
@@ -263,6 +294,7 @@ The current Docker runtime includes these host-published ports.
 | Jitsi Web | `8000`, `8443` | `80`, `443` | `8443` allowed; `8000` not listed | Direct HTTP and HTTPS ports also published |
 | Jitsi JVB | `10000/udp` | `10000/udp` | Allowed | Required media bridge traffic |
 | Xray | `32443` | `8080` | Allowed | Public tunneling endpoint |
+| Sentry nginx | `9000` | `80` | Not listed as allowed | Nginx Proxy Manager forwards to `sentry-self-hosted-nginx-1:80`; direct host port should be reviewed |
 
 Nextcloud runtime exposure from the 2026-07-08 snapshot:
 
@@ -283,6 +315,12 @@ Database ports:
 * MSSQL exposes `1433/tcp` only inside Docker.
 * DbGate exposes `3000/tcp` only inside Docker.
 
+Sentry runtime exposure:
+
+* `sentry.silveressence.net` is routed through Nginx Proxy Manager to `sentry-self-hosted-nginx-1:80`.
+* `sentry-self-hosted-nginx-1` publishes `0.0.0.0:9000 -> 80/tcp`.
+* Sentry backing services should not publish host ports.
+
 ---
 
 ## Topology Summary
@@ -299,6 +337,7 @@ Internet
         -> Jitsi Web
         -> BaGet
         -> Nextcloud
+        -> Sentry
 
 internal network
   -> PostgreSQL
@@ -311,6 +350,7 @@ isolated networks
   -> gitea-runner_default
   -> monitoring stack network
   -> nextcloud_nextcloud_internal
+  -> sentry-self-hosted_default
 ```
 
 ---
@@ -341,10 +381,12 @@ Periodically verify:
 * Jitsi internal components remain attached to `jitsi-docker-jitsi-meet-aa76415_meet.jitsi`
 * The desired Xray attachment is reconciled with the fact that `xray_default` currently has no running containers
 * Direct host-published ports are intentional and protected by firewall policy
+* Sentry host-published port `9000` has a documented owner and firewall policy
 * UFW-only allowed ports have documented owners
 * Prometheus targets remain healthy
 * Grafana datasource connection remains healthy
 * Nextcloud remains routed through Nginx Proxy Manager without host-published database or Redis ports
+* Sentry remains routed through Nginx Proxy Manager with internal backing services isolated
 * Unused Docker networks are removed only after confirming they are not active dependencies
 
 ---