Skip to content

Update self-hosted to clarify LAUNCHPAD_RPC_SHARED_SECRET #19346

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
geoffg-sentry wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update self-hosted to clarify LAUNCHPAD_RPC_SHARED_SECRET #19346

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7253308
Update self-hosted to clarify LAUNCHPAD_RPC_SHARED_SECRET
geoffg-sentry Sep 10, 2026
0e594a5
clarification
geoffg-sentry Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions develop-docs/self-hosted/configuration/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,12 @@ You can find more about configuring Sentry at [the configuration section of our

Sentry comes with a cleanup cron job that prunes events older than `90 days` by default. If you want to change that, you can edit the `SENTRY_EVENT_RETENTION_DAYS` environment variable in `.env` or simply override it in your environment.

### Internal RPC Shared Secret
### Launchpad RPC shared secret

The `taskbroker` and `launchpad` services authenticate internal RPC calls to each other using the `LAUNCHPAD_RPC_SHARED_SECRET` environment variable. This ships with a hardcoded default in `.env` that's fine for local testing but too weak for production.
`LAUNCHPAD_RPC_SHARED_SECRET` is shared by the `launchpad-taskworker` and `web` services. Launchpad uses it to HMAC its HTTP calls to `web`. It is not the credential for Launchpad's gRPC connection to `taskbroker`. It ships with a hardcoded default in `.env` that is fine for local testing but too weak for production.

<Alert title="Warning" level="warning">
Comment thread
geoffg-sentry marked this conversation as resolved.
Override <code>LAUNCHPAD_RPC_SHARED_SECRET</code> in your <code>.env.custom</code> file with a strong, randomly generated value to secure internal communication between the <code>taskbroker</code> and <code>launchpad</code> services.
Set a unique random <code>LAUNCHPAD_RPC_SHARED_SECRET</code> in <code>.env.custom</code>. Treat it like <code>system.secret-key</code>: it must be unique to this install.
</Alert>

### Installing a specific SHA
Expand Down
Loading