Documentation
¶
Overview ¶
Package obs is the observability layer of glabs-web: it reports errors to a Sentry-compatible backend (GlitchTip) and owns the scrubber that decides what may leave this host.
The scrubber is the security-relevant part. Read this file before adding anything that sends.
It is the counterpart of plexams.go's obs package and tallox.go's internal/obs, and deliberately keeps their shape, so that a fix found in one repository reads the same in the others. Where it differs, the difference is marked and is a difference in what glabs HOLDS, not a difference of opinion.
The one that matters: glabs-web is not a self-contained service. It imports the shared config, gitlab, gitlab/report and reporter packages — the same code the CLI runs — and those log at Error level with fields naming students: email, student, user, name, project, projectPath, group, groupPath. Every one of those lines reaches this scrubber. tallox's allow list would have let some through, which is why this one was built from what glabs logs rather than copied.
Index ¶
Constants ¶
const SkipField = "sentry_skip"
SkipField set on a zerolog line drops that line from the error report while leaving it in the local log:
log.Error().Err(err).Bool(obs.SkipField, true).Msg("...")
Reach for sentry.ignoreerrors in the configuration first — this one needs a deploy. It exists for the single call site that is known noise.
Variables ¶
This section is empty.
Functions ¶
func Flush ¶
func Flush()
Flush waits for pending events. Always safe to call, including when reporting was never configured.
func Init ¶
func Init(cfg Config) (zerolog.LevelWriter, error)
Init starts error reporting and returns the zerolog writer that feeds it.
The writer is the whole capture path: glabs handles its errors by logging them, so a log line at Error level or above IS the error report. The caller hangs it into the logger with zerolog.MultiLevelWriter; a nil return means "not configured" and the logger stays exactly as it was.
Note what that means here: the writer sits on the GLOBAL zerolog logger, so it also captures the shared gitlab, config and reporter packages that glabs-web calls into. That is intended — a GitLab call failing is exactly what one wants to hear about — and it is why scrub.go's allow list is built around what those packages log, not around what web/ logs.
One client, not two. sentryzerolog.New would build a second one from its own ClientOptions — with a second BeforeSend and its own buffer — so a Flush on either would miss half the events and the scrubber would have to be installed twice. NewWithHub binds the writer to the client sentry.Init just created.
func RepoRelativeCaller ¶
RepoRelativeCaller renders the caller field as a path inside the repository: gitlab/archive.go:47, not /home/whoever/src/glabs/gitlab/... . Assign it to zerolog.CallerMarshalFunc wherever the logger is configured.
zerolog's default is the compiler's absolute path, which is the BUILD machine's, so the same line reads differently in the container than it does here. That matters more than tidiness: scrub.go fingerprints log events on this field, so with the default a bug reproduced locally lands in a different issue than the production one it was meant to explain — silently, because both look perfectly fine on their own.
It lives HERE rather than in bootstrap because the package that depends on the format should own it: anything that reports — including this package's own tests — then gets the right paths without having to remember a second call.
Types ¶
type Config ¶
type Config struct {
// DSN is the ingest URL. Empty — the default, and the whole of local
// development — disables reporting: Init then does nothing at all and
// returns a nil writer.
DSN string
// Environment separates production from a test installation in the UI.
Environment string
// Release is the version this binary was built as, so an issue points at a
// release rather than at "some time in the last three months".
Release string
// IgnoreErrors drops events whose message matches one of these patterns.
// Shipped empty on purpose: filling it before a week of real traffic is
// guessing at which noise exists.
IgnoreErrors []string
// Debug makes the SDK log what it does with every event.
Debug bool
// contains filtered or unexported fields
}
Config is the error-reporting configuration. The DSN comes from the environment, everything else from the build info and .glabs-web.yaml.
Source Files