Add Sentry CLI, conditional source map serving, and startup upload

- Dockerfile: getsentry/sentry-cli stage copies binary to runtime image
- Caddyfile: .map requests 404 unless SERVE_SOURCE_MAPS=true
- entrypoint.sh: uploads source maps to Sentry at startup when
  SENTRY_AUTH_TOKEN, SENTRY_ORG, and SENTRY_PROJECT are all set;
  honours SENTRY_URL for self-hosted instances and SENTRY_RELEASE
  for release correlation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gmr

Caddyfile

@@ -36,6 +36,18 @@
 		reverse_proxy 127.0.0.1:8000
 	}
 
+	@sourcemaps path *.map
+	handle @sourcemaps {
+		@maps_allowed expression `{env.SERVE_SOURCE_MAPS} == "true"`
+		handle @maps_allowed {
+			root * /srv/ui
+			file_server
+		}
+		handle {
+			respond "Not Found" 404
+		}
+	}
+
 	handle {
 		root * /srv/ui
 		try_files {path} /index.html

Dockerfile

@@ -53,7 +53,12 @@ RUN uv venv --python $(which python3) $UV_PROJECT_DIRECTORY \
 FROM caddy:${CADDY_VERSION} AS caddy
 
 # ---------------------------------------------------------------------------
-# Stage 4: Final runtime image
+# Stage 4: Sentry CLI binary
+# ---------------------------------------------------------------------------
+FROM getsentry/sentry-cli AS sentry-cli
+
+# ---------------------------------------------------------------------------
+# Stage 5: Final runtime image
 # ---------------------------------------------------------------------------
 FROM python:${PYTHON_VERSION}-slim AS runtime
 
@@ -71,6 +76,9 @@ COPY --from=python-builder --chown=imbi:users /app/ /app/
 # Copy Caddy binary
 COPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy
 
+# Copy Sentry CLI binary
+COPY --from=sentry-cli /bin/sentry-cli /usr/local/bin/sentry-cli
+
 # Copy Caddyfile
 COPY Caddyfile /etc/caddy/Caddyfile
 

entrypoint.sh

@@ -97,6 +97,34 @@ esac
 
 check_errors "service '$IMBI_SERVICE'"
 
+# --------------------------------------------------------------------------
+# Optional: upload source maps to Sentry
+# --------------------------------------------------------------------------
+# Runs when SENTRY_AUTH_TOKEN, SENTRY_ORG, and SENTRY_PROJECT are all set.
+# SENTRY_RELEASE defaults to unversioned if not provided.
+# Maps remain in the image; whether they are served is controlled by
+# the SERVE_SOURCE_MAPS env var (Caddy returns 404 unless it is "true").
+
+upload_sourcemaps() {
+    if [ -z "${SENTRY_AUTH_TOKEN:-}" ] || \
+       [ -z "${SENTRY_ORG:-}" ] || \
+       [ -z "${SENTRY_PROJECT:-}" ]; then
+        return
+    fi
+    echo "Uploading source maps to Sentry..."
+    local args="--org $SENTRY_ORG --project $SENTRY_PROJECT"
+    if [ -n "${SENTRY_RELEASE:-}" ]; then
+        args="$args --release $SENTRY_RELEASE"
+    fi
+    if [ -n "${SENTRY_URL:-}" ]; then
+        args="$args --url $SENTRY_URL"
+    fi
+    sentry-cli sourcemaps upload $args /srv/ui/assets/
+    echo "Source maps uploaded."
+}
+
+upload_sourcemaps
+
 # --------------------------------------------------------------------------
 # Service startup
 # --------------------------------------------------------------------------