Add Cloudflare Access auth to sentry

crates/bootstrap_mtc_worker/src/lib.rs

@@ -41,7 +41,20 @@ static ROOTS: OnceLock<CertPool> = OnceLock::new();
 /// without sentry support.
 pub(crate) fn init_sentry(env: &Env) {
     if let Ok(dsn) = env.var("SENTRY_DSN") {
-        let _ = generic_log_worker::obs::sentry::init(&dsn.to_string(), env!("DEPLOY_ENV"));
+        let access_id = env
+            .var("SENTRY_ACCESS_CLIENT_ID")
+            .ok()
+            .map(|v| v.to_string());
+        let access_secret = env
+            .secret("SENTRY_ACCESS_CLIENT_SECRET")
+            .ok()
+            .map(|v| v.to_string());
+        let _ = generic_log_worker::obs::sentry::init(
+            &dsn.to_string(),
+            env!("DEPLOY_ENV"),
+            access_id.as_deref(),
+            access_secret.as_deref(),
+        );
     }
 }
 

crates/ct_worker/src/lib.rs

@@ -39,7 +39,20 @@ static WITNESS_KEY_MAP: OnceLock<HashMap<String, OnceLock<Ed25519SigningKey>>> =
 /// without sentry support.
 pub(crate) fn init_sentry(env: &Env) {
     if let Ok(dsn) = env.var("SENTRY_DSN") {
-        let _ = generic_log_worker::obs::sentry::init(&dsn.to_string(), env!("DEPLOY_ENV"));
+        let access_id = env
+            .var("SENTRY_ACCESS_CLIENT_ID")
+            .ok()
+            .map(|v| v.to_string());
+        let access_secret = env
+            .secret("SENTRY_ACCESS_CLIENT_SECRET")
+            .ok()
+            .map(|v| v.to_string());
+        let _ = generic_log_worker::obs::sentry::init(
+            &dsn.to_string(),
+            env!("DEPLOY_ENV"),
+            access_id.as_deref(),
+            access_secret.as_deref(),
+        );
     }
 }
 

crates/generic_log_worker/src/obs/sentry.rs

@@ -44,6 +44,13 @@ use sha2::{Digest, Sha256};
 pub struct WorkerTransport {
     dsn: sentry_core::types::Dsn,
     envelopes: Mutex<Vec<Envelope>>,
+    /// Cloudflare Access service-token client ID (`CF-Access-Client-ID`
+    /// header). Required when the Sentry ingest endpoint is behind
+    /// Cloudflare Access.
+    access_client_id: Option<String>,
+    /// Cloudflare Access service-token client secret
+    /// (`CF-Access-Client-Secret` header).
+    access_client_secret: Option<String>,
 }
 
 impl Transport for &'static WorkerTransport {
@@ -81,7 +88,12 @@ static PANIC_HOOK_TRANSPORT: OnceLock<WorkerTransport> = OnceLock::new();
 /// when `SENTRY_DSN` is not configured.
 #[must_use]
 #[allow(clippy::too_many_lines)] // Panic-hook event construction is deliberately inline; see safety comments.
-pub fn init(dsn: &str, environment: &str) -> Option<&'static WorkerTransport> {
+pub fn init(
+    dsn: &str,
+    environment: &str,
+    access_client_id: Option<&str>,
+    access_client_secret: Option<&str>,
+) -> Option<&'static WorkerTransport> {
     use std::sync::Once;
     static HOOK: Once = Once::new();
 
@@ -93,6 +105,8 @@ pub fn init(dsn: &str, environment: &str) -> Option<&'static WorkerTransport> {
     let transport = PANIC_HOOK_TRANSPORT.get_or_init(|| WorkerTransport {
         dsn: parsed_dsn.clone(),
         envelopes: Mutex::default(),
+        access_client_id: access_client_id.map(String::from),
+        access_client_secret: access_client_secret.map(String::from),
     });
     let client = sentry_core::Client::from(ClientOptions {
         dsn: Some(parsed_dsn),
@@ -374,6 +388,12 @@ pub async fn flush() {
                 if let Ok(h) = r.headers_mut() {
                     let _ = h.set("Content-Type", "application/x-sentry-envelope");
                     let _ = h.set("X-Sentry-Auth", &auth);
+                    if let Some(id) = &transport.access_client_id {
+                        let _ = h.set("CF-Access-Client-ID", id);
+                    }
+                    if let Some(secret) = &transport.access_client_secret {
+                        let _ = h.set("CF-Access-Client-Secret", secret);
+                    }
                 }
                 r
             }

crates/witness_worker/src/lib.rs

@@ -213,7 +213,20 @@ static WITNESS_SIGNER: OnceLock<WitnessSigner> = OnceLock::new();
 /// without sentry support.
 pub(crate) fn init_sentry(env: &Env) {
     if let Ok(dsn) = env.var("SENTRY_DSN") {
-        let _ = generic_log_worker::obs::sentry::init(&dsn.to_string(), env!("DEPLOY_ENV"));
+        let access_id = env
+            .var("SENTRY_ACCESS_CLIENT_ID")
+            .ok()
+            .map(|v| v.to_string());
+        let access_secret = env
+            .secret("SENTRY_ACCESS_CLIENT_SECRET")
+            .ok()
+            .map(|v| v.to_string());
+        let _ = generic_log_worker::obs::sentry::init(
+            &dsn.to_string(),
+            env!("DEPLOY_ENV"),
+            access_id.as_deref(),
+            access_secret.as_deref(),
+        );
     }
 }