Document Sentry self-hosted deployment

docs/security.md

@@ -151,6 +151,7 @@ Publicly exposed services:
 * Jitsi Web
 * BaGet
 * Nextcloud
+* Sentry
 
 High-sensitivity exposure:
 
@@ -158,6 +159,7 @@ High-sensitivity exposure:
 * Xray exposes tunneling capability and must be monitored for abuse, unexpected traffic and unauthorized use.
 * Portainer exposes Docker management and must be restricted to trusted administrators.
 * Nextcloud exposes private file storage and must require strong user authentication, HTTPS and prompt security updates.
+* Sentry exposes application error data and must require strong authentication, HTTPS and careful project/token management.
 
 Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
 
@@ -168,13 +170,15 @@ Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
 * `cicd.silveressence.net` is intentionally enabled as a frequently changing prototype deployment endpoint.
 * `exactsyncer.silveressence.net` is intentionally enabled as a client-facing Exact Online syncer demo endpoint.
 * `cloud.silveressence.net` is enabled for Nextcloud with WebSocket and Block Exploits enabled, but SSL Force, HTTP/2 and HSTS disabled and no access list.
+* `sentry.silveressence.net` is enabled for Sentry with SSL Force, HTTP/2, WebSocket and Block Exploits enabled; HSTS is disabled and no access list is assigned.
 
 Priority hardening:
 
 1. Enable SSL Force for all HTTPS public service routes unless there is a documented exception.
 2. Enable SSL Force, HTTP/2 and HSTS for Nextcloud unless there is a documented exception.
-3. Add an access list or equivalent restriction for DbGate and Portainer.
-4. Define explicit exposure and authentication expectations for prototype and demo endpoints.
+3. Enable HSTS for Sentry unless there is a documented exception.
+4. Add an access list or equivalent restriction for DbGate and Portainer.
+5. Define explicit exposure and authentication expectations for prototype and demo endpoints.
 
 ---
 
@@ -310,6 +314,7 @@ Network model:
 * Isolated stack networks are used for Jitsi, Xray and CI/CD runner separation.
 * `xray_default` currently exists without a running container attached; the active `xray` container is attached to `proxy`.
 * `nextcloud_nextcloud_internal` isolates Nextcloud database and Redis traffic from the public proxy layer.
+* `sentry-self-hosted_default` isolates Sentry databases, queues, workers and event processing services from shared application networks.
 
 ---
 
@@ -359,6 +364,8 @@ Periodically verify:
 * Nextcloud security advisories are reviewed and the image is updated promptly
 * Nextcloud database and Redis ports remain internal-only
 * Nextcloud proxy route uses HTTPS with SSL Force, HTTP/2 and HSTS enabled unless there is a documented exception
+* Sentry upstream self-hosted release notes are reviewed before updates
+* Sentry internal services remain inaccessible except through the public Sentry web or nginx entry layer
 * Public services are still routed only through Nginx Proxy Manager
 * Removed proxy hosts and unused certificates stay removed unless explicitly approved
 * Prototype and demo proxy hosts have documented owners and exposure expectations