resolve failed handshake connection with https://wixur.ir:3000

.cursor/rules/dyolink-overview.mdc

@@ -40,7 +40,7 @@ QR + URL for **sent** cases; focus page `/lab-case/[token]`. Auth redirect via `
 
 ## API errors
 
-Logical failures: `AppException(ErrorCode.X)` → `errors.X` in en/fa/nl. UI: `getUserFacingError`. Skill: `.cursor/skills/api-errors/SKILL.md`. Appointments/working hours: client IANA `timeZone` (never Node local `getHours()`).
+Logical failures: `AppException(ErrorCode.X)` → `errors.X` in en/fa/nl. UI: `getUserFacingError`. Unexpected 500s / client crashes: GlitchTip via Sentry SDKs (`SENTRY_DSN` / `NEXT_PUBLIC_SENTRY_DSN`). Skill: `.cursor/skills/api-errors/SKILL.md`. Appointments/working hours: client IANA `timeZone` (never Node local `getHours()`).
 
 ## Notifications (inbox + live tabs)
 

.cursor/rules/error-tracking.mdc

@@ -0,0 +1,20 @@
+---
+description: GlitchTip error tracking via Sentry SDKs — 500s only, no PHI
+alwaysApply: true
+---
+
+# Error tracking (GlitchTip)
+
+Self-hosted GlitchTip at `https://errors.wixur.ir`. Apps use official Sentry SDKs (`@sentry/nestjs`, `@sentry/nextjs`) pointed at that DSN — not sentry.io.
+
+## What to report
+
+- Backend: HTTP **500+** in `HttpExceptionFilter` only. Do **not** send `AppException` 4xx.
+- Frontend: render crashes (`error.tsx` / `global-error.tsx`) and axios **5xx / network** failures only.
+- No session replay. Scrub cookies, JWT, request bodies, emails.
+
+## Config
+
+- Backend DSN: `SENTRY_DSN` in `backend.env` / `backend.staging.env` (runtime).
+- Frontend DSN: `NEXT_PUBLIC_SENTRY_DSN` baked at Docker build (Gitea var `NEXT_PUBLIC_SENTRY_DSN`).
+- Empty DSN = tracking off (local default).

.gitea/workflows/prod-tag-deploy.yml

@@ -11,6 +11,7 @@
 #   REGISTRY_OWNER         Gitea user/org for packages
 #   CLONE_HOST             git clone, e.g. 127.0.0.1:3000
 #   PROD_PUBLIC_BASE_URL   https://nudentic.ir  (no trailing slash)
+#   NEXT_PUBLIC_SENTRY_DSN  GlitchTip frontend project DSN
 #   PROD_REGISTRY_HOST     Linux pull host, e.g. wixur.ir:3000  (HTTP; insecure-registries on the VPS)
 #   PROD_INFRA_DIR         /opt/dyolink/infrastructure
 #
@@ -112,6 +113,7 @@ jobs:
       - name: Build and push frontend (nudentic.ir baked in)
         env:
           PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
         run: |
           $ErrorActionPreference = 'Stop'
           $tag = "${{ steps.meta.outputs.image_tag }}"
@@ -122,6 +124,8 @@ jobs:
             --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
             --build-arg "NEXT_PUBLIC_APP_URL=$base" `
             --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
+            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
             -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
             ./frontend
           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"

.gitea/workflows/registry-build-deploy.yml

@@ -7,6 +7,7 @@
 #   REGISTRY_HOST        Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000
 #   REGISTRY_OWNER       Gitea user or org that owns the packages
 #   PUBLIC_BASE_URL      URL users open in the browser, e.g. http://wixur.ir  (no trailing slash, no :8088)
+#   NEXT_PUBLIC_SENTRY_DSN  GlitchTip frontend project DSN (https://…@errors.wixur.ir/…)
 #   DEPLOY_SECRETS_DIR   absolute path on runner, e.g. C:/dyolink/secrets
 #
 # Optional:
@@ -103,6 +104,7 @@ jobs:
       - name: Build and push frontend
         env:
           PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
+          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
         run: |
           $ErrorActionPreference = 'Stop'
           $tag = "${{ steps.meta.outputs.image_tag }}"
@@ -111,6 +113,8 @@ jobs:
             --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
             --build-arg "NEXT_PUBLIC_APP_URL=$base" `
             --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
+            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
+            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
             -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
             -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
             ./frontend

AGENTS.md

@@ -85,7 +85,7 @@ backend/src/
   prisma/                       → schema, migrations, seed
 ```
 
-Errors: `AppException` + `ErrorCode` → frontend `getUserFacingError()`. Never throw raw strings for user-facing failures.
+Errors: `AppException` + `ErrorCode` → frontend `getUserFacingError()`. Unexpected 500s: GlitchTip (`SENTRY_DSN`). Never throw raw strings for user-facing failures.
 
 ## Git & commits
 

backend/.env.example

@@ -72,3 +72,7 @@ OPENROUTER_API_KEY=
 # plus processing takes ten seconds at minimum — so it is purely an abuse guard.
 # VOICE_THROTTLE_TTL=60
 # VOICE_THROTTLE_LIMIT=6
+
+# GlitchTip (optional). Leave empty for local unless you want to send events.
+# SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/1
+# SENTRY_ENVIRONMENT=development

backend/package-lock.json

@@ -25,6 +25,7 @@
         "@nestjs/throttler": "^6.5.0",
         "@nestjs/websockets": "^11.1.28",
         "@prisma/client": "^6.19.2",
+        "@sentry/nestjs": "^10.72.0",
         "adminjs": "^7.8.17",
         "axios": "^1.13.5",
         "bcrypt": "^6.0.0",
@@ -4649,6 +4650,119 @@
         "npm": ">=5.10.0"
       }
     },
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
+      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/api-logs": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.220.0.tgz",
+      "integrity": "sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/core": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.10.0.tgz",
+      "integrity": "sha512-/wNZ8twnEQQA4HoHu22+vcsdru6pWPWxW+7w+FlxT6Id7PE/WIbZmVKkte+PF72e0F2dnImFeHD2syyE1Mw6MQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/instrumentation": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.220.0.tgz",
+      "integrity": "sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.220.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/resources": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.10.0.tgz",
+      "integrity": "sha512-q6MMm2zhggzsHVNbabYwut+a6nbuQQe3URUoxaojM/8K1IBfwwPzvxIjNi2/lI1TFe+fMHMW9MWhrtDLEXEnkA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.10.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace/-/sdk-trace-2.10.0.tgz",
+      "integrity": "sha512-MfQGq3GRmTh5fM/y+OjaO0vj6+luCB1XO2gfXCalKCfgKw0eHL++sm75DNweC6ohlp+aFvACqeE0fYayqdRaoQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.10.0",
+        "@opentelemetry/resources": "2.10.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace-base": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.10.0.tgz",
+      "integrity": "sha512-GuYQQT7QD2EeO8lcZLRQzcbOyhqAzL+6WWTKTU9mSUBYBazkEDl+VrQcXQhbB08OWM9anD1aHleVadzulpOaUQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.10.0",
+        "@opentelemetry/resources": "2.10.0",
+        "@opentelemetry/sdk-trace": "2.10.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.43.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.43.0.tgz",
+      "integrity": "sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@paralleldrive/cuid2": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/@paralleldrive/cuid2/-/cuid2-2.3.1.tgz",
@@ -5333,6 +5447,138 @@
       "hasInstallScript": true,
       "license": "Apache-2.0"
     },
+    "node_modules/@sentry/conventions": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.16.0.tgz",
+      "integrity": "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@sentry/core": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.72.0.tgz",
+      "integrity": "sha512-UJMHZfbjP4qk+g4AQhZmzosMdICC2D9p0/hLrm1LofPsp+WBfcSnv9jsY1a9TfmpS4WCAmTx8nANYTIXifcBjA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/nestjs": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/nestjs/-/nestjs-10.72.0.tgz",
+      "integrity": "sha512-+1wdX+fkv8zIZ+lI66Se1DKwPXoa6edxoHuAgWDwcqv3bKF8R75NqzXj+4U7FcgBI05i6HFiZJuyvx9BCECy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/instrumentation": "^0.220.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0",
+        "@sentry/node": "10.72.0",
+        "@sentry/server-utils": "10.72.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@nestjs/common": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/core": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0"
+      }
+    },
+    "node_modules/@sentry/node": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/node/-/node-10.72.0.tgz",
+      "integrity": "sha512-eQHQFxSX26MhG/nB+tAY4QRslnPvJse7pww/hd3zXAqNULRa5lFtjSLALcHx/KUVDCZdTPdUVZEj4nGidcHrow==",
+      "license": "MIT",
+      "dependencies": {
+        "@opentelemetry/api": "^1.9.1",
+        "@opentelemetry/instrumentation": "^0.220.0",
+        "@opentelemetry/sdk-trace-base": "^2.9.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0",
+        "@sentry/node-core": "10.72.0",
+        "@sentry/opentelemetry": "10.72.0",
+        "@sentry/server-utils": "10.72.0",
+        "import-in-the-middle": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/node-core": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/node-core/-/node-core-10.72.0.tgz",
+      "integrity": "sha512-xYuYWmWEWnN8h3YHa7mds212ANFgrxfrbmLvVg0p0wf9m6MFjLowOTmjaiK0XW20sM/veSelicre650bx8UFtQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0",
+        "@sentry/opentelemetry": "10.72.0",
+        "import-in-the-middle": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/core": "^1.30.1 || ^2.1.0",
+        "@opentelemetry/exporter-trace-otlp-http": ">=0.57.0 <1",
+        "@opentelemetry/instrumentation": ">=0.57.1 <1",
+        "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0"
+      },
+      "peerDependenciesMeta": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@opentelemetry/core": {
+          "optional": true
+        },
+        "@opentelemetry/exporter-trace-otlp-http": {
+          "optional": true
+        },
+        "@opentelemetry/instrumentation": {
+          "optional": true
+        },
+        "@opentelemetry/sdk-trace-base": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@sentry/opentelemetry": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-10.72.0.tgz",
+      "integrity": "sha512-ZVbAM1rGU/awN7cH/jvC87WpQw0NOJx5id6dKnnefStXpP/kUnZXYhtX9gfBnofYvJWa5I5VUSeuKCLUcKL75w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.9.0",
+        "@opentelemetry/core": "^1.30.1 || ^2.1.0",
+        "@opentelemetry/sdk-trace-base": "^1.30.1 || ^2.1.0"
+      }
+    },
+    "node_modules/@sentry/server-utils": {
+      "version": "10.72.0",
+      "resolved": "https://registry.npmjs.org/@sentry/server-utils/-/server-utils-10.72.0.tgz",
+      "integrity": "sha512-CWpHMYW81RDBSVBdnxulGUvvBhkBb/OpSr72ubSe1UkKTcgT0NDMCWxE3dLFXqSxzT4DaF5UlUVv9ii5Sse53w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.72.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@sinclair/typebox": {
       "version": "0.34.49",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
@@ -8352,7 +8598,6 @@
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
       "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/class-transformer": {
@@ -9222,10 +9467,9 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.1.0",
+      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
@@ -10649,6 +10893,20 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/import-in-the-middle": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.3.3.tgz",
+      "integrity": "sha512-AiohS3H80sXO6owEltjGX+glb7qXaDhBoJb9XcQVH4UI207xu/bDLUcadVKp7Qe576reg9yr/PXZjV5qx8gfbA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "cjs-module-lexer": "^2.2.0",
+        "es-module-lexer": "^2.2.0",
+        "module-details-from-path": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/import-local": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
@@ -12517,6 +12775,12 @@
         "node": ">=16 || 14 >=14.17"
       }
     },
+    "node_modules/module-details-from-path": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
+      "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==",
+      "license": "MIT"
+    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -14205,6 +14469,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-in-the-middle": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz",
+      "integrity": "sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.3.5",
+        "module-details-from-path": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=9.3.0 || >=8.10.0 <9.0.0"
+      }
+    },
     "node_modules/resolve": {
       "version": "1.22.12",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",

backend/package.json

@@ -46,6 +46,7 @@
     "@nestjs/throttler": "^6.5.0",
     "@nestjs/websockets": "^11.1.28",
     "@prisma/client": "^6.19.2",
+    "@sentry/nestjs": "^10.72.0",
     "adminjs": "^7.8.17",
     "axios": "^1.13.5",
     "bcrypt": "^6.0.0",

backend/src/app.module.ts

@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { ThrottlerModule } from '@nestjs/throttler';
+import { SentryModule } from '@sentry/nestjs/setup';
 import configurations from './configs/configurations';
 import { AuthModule } from './modules/auth/auth.module';
 import { AppController } from './app.controller';
@@ -25,6 +26,7 @@ import { VoiceModule } from './modules/voice/voice.module';
 
 @Module({
   imports: [
+    SentryModule.forRoot(),
     ConfigModule.forRoot({
       isGlobal: true,
       load: [configurations],

backend/src/common/errors/http-exception.filter.ts

@@ -6,6 +6,7 @@ import {
   HttpStatus,
   Logger,
 } from '@nestjs/common';
+import * as Sentry from '@sentry/nestjs';
 import type { Response } from 'express';
 import { AppException, type AppErrorResponse } from './app.exception';
 import { ErrorCode, type ErrorCodeValue } from './error-codes';
@@ -42,6 +43,9 @@ export class HttpExceptionFilter implements ExceptionFilter {
       this.logger.error(
         exception instanceof Error ? exception.stack : String(exception),
       );
+      if (Sentry.getClient()) {
+        Sentry.captureException(exception);
+      }
     }
 
     response.status(statusCode).json(body);

backend/src/instrument.ts

@@ -0,0 +1,36 @@
+import { config } from 'dotenv';
+import * as Sentry from '@sentry/nestjs';
+
+config();
+
+const dsn = process.env.SENTRY_DSN?.trim();
+
+if (dsn) {
+  Sentry.init({
+    dsn,
+    environment:
+      process.env.SENTRY_ENVIRONMENT?.trim() ||
+      process.env.NODE_ENV ||
+      'development',
+    release: process.env.SENTRY_RELEASE?.trim() || undefined,
+    sendDefaultPii: false,
+    tracesSampleRate: 0,
+    beforeSend(event) {
+      if (event.request) {
+        delete event.request.cookies;
+        delete event.request.data;
+        if (event.request.headers) {
+          delete event.request.headers.cookie;
+          delete event.request.headers.authorization;
+          delete event.request.headers.Authorization;
+        }
+      }
+      if (event.user) {
+        delete event.user.email;
+        delete event.user.ip_address;
+        delete event.user.username;
+      }
+      return event;
+    },
+  });
+}

backend/src/main.ts

@@ -1,4 +1,5 @@
 // backend/src/main.ts
+import './instrument';
 import { NestFactory } from '@nestjs/core';
 import { urlencoded } from 'express';
 import { AppModule } from './app.module';

frontend/.env.example

@@ -5,3 +5,7 @@ NEXT_PUBLIC_API_URL=http://localhost:3000/api
 NEXT_PUBLIC_APP_NAME=DyoLink
 # URL where users open the frontend (used for metadata, images, etc.)
 NEXT_PUBLIC_APP_URL=http://localhost:3001
+
+# GlitchTip frontend project DSN (optional locally). Baked into the Docker image in CI.
+# NEXT_PUBLIC_SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/2
+# NEXT_PUBLIC_SENTRY_ENVIRONMENT=development

frontend/Dockerfile

@@ -18,12 +18,16 @@ COPY . .
 ARG NEXT_PUBLIC_API_URL
 ARG NEXT_PUBLIC_APP_URL
 ARG NEXT_PUBLIC_APP_NAME
+ARG NEXT_PUBLIC_SENTRY_DSN
+ARG NEXT_PUBLIC_SENTRY_ENVIRONMENT
 
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NODE_ENV=production
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
 ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
 ENV NEXT_PUBLIC_APP_NAME=${NEXT_PUBLIC_APP_NAME}
+ENV NEXT_PUBLIC_SENTRY_DSN=${NEXT_PUBLIC_SENTRY_DSN}
+ENV NEXT_PUBLIC_SENTRY_ENVIRONMENT=${NEXT_PUBLIC_SENTRY_ENVIRONMENT}
 
 RUN npm run build
 

frontend/messages/en.json

@@ -18,6 +18,9 @@
     "redirecting": "Redirecting…",
     "readOnlyAccess": "Read-only access for this organization.",
     "errorGeneric": "Something went wrong",
+    "pageErrorTitle": "Something went wrong",
+    "pageErrorBody": "This page failed to load. You can try again.",
+    "tryAgain": "Try again",
     "loadingEllipsis": "Loading...",
     "search": "Search",
     "action": "Action",

frontend/messages/fa.json

@@ -18,6 +18,9 @@
     "redirecting": "در حال انتقال...",
     "readOnlyAccess": "دسترسی فقط خواندنی برای این سازمان.",
     "errorGeneric": "خطایی رخ داده است",
+    "pageErrorTitle": "خطایی رخ داده است",
+    "pageErrorBody": "این صفحه بارگذاری نشد. می‌توانید دوباره تلاش کنید.",
+    "tryAgain": "تلاش دوباره",
     "loadingEllipsis": "در حال بارگذاری...",
     "search": "جستجو",
     "action": "عملیات",

frontend/messages/nl.json

@@ -18,6 +18,9 @@
     "redirecting": "Bezig met doorsturen...",
     "readOnlyAccess": "Alleen-lezen toegang voor deze organisatie.",
     "errorGeneric": "Er is iets misgegaan",
+    "pageErrorTitle": "Er is iets misgegaan",
+    "pageErrorBody": "Deze pagina kon niet worden geladen. U kunt het opnieuw proberen.",
+    "tryAgain": "Opnieuw proberen",
     "loadingEllipsis": "Laden...",
     "search": "Zoeken",
     "action": "Actie",

frontend/next.config.ts

@@ -1,4 +1,5 @@
 import type { NextConfig } from 'next';
+import { withSentryConfig } from '@sentry/nextjs';
 import createNextIntlPlugin from 'next-intl/plugin';
 
 const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
@@ -35,9 +36,15 @@ const nextConfig: NextConfig = {
     NEXT_PUBLIC_APP_NAME: process.env.NEXT_PUBLIC_APP_NAME,
     NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
     NEXT_PUBLIC_API_URL: process.env.NEXT_PUBLIC_API_URL,
+    NEXT_PUBLIC_SENTRY_DSN: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    NEXT_PUBLIC_SENTRY_ENVIRONMENT: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT,
   },
   output: 'standalone',
   compress: true,
 };
 
-export default withNextIntl(nextConfig);
+export default withSentryConfig(withNextIntl(nextConfig), {
+  silent: true,
+  sourcemaps: { disable: true },
+  disableLogger: true,
+});

frontend/package.json

@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "@hookform/resolvers": "^5.2.2",
+    "@sentry/nextjs": "^10.72.0",
     "@tanstack/react-query": "^5.90.21",
     "axios": "^1.13.6",
     "js-cookie": "^3.0.5",

frontend/src/app/[locale]/error.tsx

@@ -0,0 +1,30 @@
+'use client';
+
+import { useEffect } from 'react';
+import { useTranslations } from 'next-intl';
+import * as Sentry from '@sentry/nextjs';
+import { Button } from '@/components/ui/shared/Button';
+
+export default function LocaleError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  const t = useTranslations('common');
+
+  useEffect(() => {
+    Sentry.captureException(error);
+  }, [error]);
+
+  return (
+    <div className="flex min-h-[50vh] flex-col items-center justify-center gap-4 px-4 text-center">
+      <h1 className="text-lg font-semibold">{t('pageErrorTitle')}</h1>
+      <p className="max-w-md text-sm text-text-secondary">{t('pageErrorBody')}</p>
+      <Button type="button" onClick={() => reset()}>
+        {t('tryAgain')}
+      </Button>
+    </div>
+  );
+}

frontend/src/app/global-error.tsx

@@ -0,0 +1,44 @@
+'use client';
+
+import { useEffect } from 'react';
+import * as Sentry from '@sentry/nextjs';
+
+export default function GlobalError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string };
+  reset: () => void;
+}) {
+  useEffect(() => {
+    Sentry.captureException(error);
+  }, [error]);
+
+  return (
+    <html lang="en">
+      <body>
+        <div
+          style={{
+            display: 'flex',
+            minHeight: '100vh',
+            flexDirection: 'column',
+            alignItems: 'center',
+            justifyContent: 'center',
+            gap: '1rem',
+            padding: '1rem',
+            textAlign: 'center',
+            fontFamily: 'system-ui, sans-serif',
+          }}
+        >
+          <h1 style={{ fontSize: '1.125rem', fontWeight: 600 }}>Something went wrong</h1>
+          <p style={{ maxWidth: '28rem', fontSize: '0.875rem' }}>
+            The page failed to load. You can try again.
+          </p>
+          <button type="button" onClick={() => reset()}>
+            Try again
+          </button>
+        </div>
+      </body>
+    </html>
+  );
+}

frontend/src/components/ui/today/TodayWidgetErrorBoundary.tsx

@@ -1,5 +1,6 @@
 'use client';
 
+import * as Sentry from '@sentry/nextjs';
 import { Component, type ErrorInfo, type ReactNode } from 'react';
 
 interface TodayWidgetErrorBoundaryProps {
@@ -23,6 +24,7 @@ export class TodayWidgetErrorBoundary extends Component<
 
   componentDidCatch(error: Error, info: ErrorInfo) {
     console.error('Today widget render error:', error, info);
+    Sentry.captureException(error, { extra: { componentStack: info.componentStack } });
   }
 
   render() {

frontend/src/instrumentation-client.ts

@@ -0,0 +1,15 @@
+import * as Sentry from '@sentry/nextjs';
+import { sentrySharedOptions } from '@/lib/error-tracking/sentrySharedOptions';
+
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN?.trim();
+
+if (dsn) {
+  Sentry.init({
+    dsn,
+    environment:
+      process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT?.trim() ||
+      process.env.NODE_ENV ||
+      'development',
+    ...sentrySharedOptions(),
+  });
+}

frontend/src/instrumentation.ts

@@ -0,0 +1,9 @@
+import * as Sentry from '@sentry/nextjs';
+
+export async function register(): Promise<void> {
+  if (process.env.NEXT_RUNTIME === 'nodejs') {
+    await import('./lib/error-tracking/sentry.server.config');
+  }
+}
+
+export const onRequestError = Sentry.captureRequestError;

frontend/src/lib/api/client.ts

@@ -2,6 +2,7 @@
 import axios, { AxiosError, InternalAxiosRequestConfig } from 'axios';
 import type { ApiError } from '@/types/api';
 import { notifyAccessTokenRefreshed } from '@/lib/auth/accessTokenEvents';
+import { reportUnexpectedApiFailure } from '@/lib/error-tracking/reportUnexpectedApiFailure';
 
 interface CustomAxiosRequestConfig extends InternalAxiosRequestConfig {
   _retry?: boolean;
@@ -46,6 +47,7 @@ function shouldSkipRefreshRetry(url: string | undefined): boolean {
 apiClient.interceptors.response.use(
   (response) => response,
   async (error: AxiosError) => {
+    reportUnexpectedApiFailure(error);
     const originalRequest = error.config as CustomAxiosRequestConfig;
 
     if (

frontend/src/lib/error-tracking/reportUnexpectedApiFailure.ts

@@ -0,0 +1,20 @@
+import * as Sentry from '@sentry/nextjs';
+import type { AxiosError } from 'axios';
+
+/** Report network failures and HTTP 5xx only — not coded 4xx AppExceptions. */
+export function reportUnexpectedApiFailure(error: AxiosError): void {
+  const status = error.response?.status;
+  if (status !== undefined && status < 500) {
+    return;
+  }
+
+  Sentry.captureException(error, {
+    tags: {
+      api_status: status ? String(status) : 'network',
+    },
+    extra: {
+      url: error.config?.url,
+      method: error.config?.method,
+    },
+  });
+}

frontend/src/lib/error-tracking/sentry.server.config.ts

@@ -0,0 +1,15 @@
+import * as Sentry from '@sentry/nextjs';
+import { sentrySharedOptions } from '@/lib/error-tracking/sentrySharedOptions';
+
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN?.trim();
+
+if (dsn) {
+  Sentry.init({
+    dsn,
+    environment:
+      process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT?.trim() ||
+      process.env.NODE_ENV ||
+      'development',
+    ...sentrySharedOptions(),
+  });
+}

frontend/src/lib/error-tracking/sentrySharedOptions.ts

@@ -0,0 +1,28 @@
+import type { ErrorEvent } from '@sentry/core';
+
+/** Shared Sentry/GlitchTip options — no session replay, no PII in payloads. */
+export function sentrySharedOptions() {
+  return {
+    sendDefaultPii: false as const,
+    tracesSampleRate: 0,
+    replaysSessionSampleRate: 0,
+    replaysOnErrorSampleRate: 0,
+    beforeSend(event: ErrorEvent): ErrorEvent {
+      if (event.request) {
+        delete event.request.cookies;
+        delete event.request.data;
+        if (event.request.headers) {
+          delete event.request.headers.cookie;
+          delete event.request.headers.authorization;
+          delete event.request.headers.Authorization;
+        }
+      }
+      if (event.user) {
+        delete event.user.email;
+        delete event.user.ip_address;
+        delete event.user.username;
+      }
+      return event;
+    },
+  };
+}

infrastructure/DEPLOY.md

@@ -439,6 +439,19 @@ docker volume rm dyolink_postgres_data_prod
 
 Add `"insecure-registries": ["wixur.ir:3000"]` to `/etc/docker/daemon.json` and restart Docker.
 
+### `connection reset by peer` while pulling `:v*` from Gitea
+
+`docker login` succeeded, then `compose pull` failed on a frontend/backend manifest or layer from `wixur.ir:3000`. Auth is fine — the Windows Gitea registry dropped the TCP connection (common right after a large push, or when both images pull in parallel).
+
+Images are already in the registry. Re-run only the **deploy** job, or on the VPS:
+
+```bash
+cd /opt/dyolink/infrastructure
+./scripts/prod-remote-deploy.sh v1.0.2
+```
+
+`prod-remote-deploy.sh` pulls backend then frontend with retries. If every attempt RSTs, check Gitea is up and `insecure-registries` includes `wixur.ir:3000`.
+
 ### View logs
 
 ```bash

infrastructure/backend.prod.env.example

@@ -20,3 +20,7 @@ COOKIE_SECURE=true
 # SMS (sms.ir)
 SMS_IR_API_KEY=CHANGE_ME_SMS_IR_API_KEY
 SMS_IR_TEMPLATE_ID=123456
+
+# GlitchTip (Sentry SDK). Empty = disabled. Use the dyolink-backend project DSN.
+# SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/1
+# SENTRY_ENVIRONMENT=production

infrastructure/backend.staging.env.example

@@ -18,3 +18,7 @@ COOKIE_SECURE=true
 # SMS (sms.ir)
 SMS_IR_API_KEY=CHANGE_ME_SMS_IR_API_KEY
 SMS_IR_TEMPLATE_ID=123456
+
+# GlitchTip (Sentry SDK). Empty = disabled. Use the dyolink-backend project DSN.
+# SENTRY_DSN=https://PUBLIC_KEY@errors.wixur.ir/1
+# SENTRY_ENVIRONMENT=staging

infrastructure/docker-compose.prod.yml

@@ -48,6 +48,8 @@ services:
       NODE_ENV: production
       TZ: UTC
       PORT: "3000"
+      SENTRY_ENVIRONMENT: production
+      SENTRY_RELEASE: ${TAG:-latest}
     expose:
       - "3000"
     networks:

infrastructure/docker-compose.registry.yml

@@ -47,6 +47,8 @@ services:
       NODE_ENV: production
       TZ: UTC
       PORT: "3000"
+      SENTRY_ENVIRONMENT: staging
+      SENTRY_RELEASE: ${IMAGE_TAG:-latest}
     expose:
       - "3000"
     networks:

infrastructure/docker-compose.staging.yml

@@ -43,6 +43,7 @@ services:
       NODE_ENV: production
       TZ: UTC
       PORT: "3000"
+      SENTRY_ENVIRONMENT: staging
     expose:
       - "3000"
     networks:
@@ -63,6 +64,8 @@ services:
         NEXT_PUBLIC_API_URL: ${STAGING_NEXT_PUBLIC_API_URL:-http://wixur.ir/api}
         NEXT_PUBLIC_APP_URL: ${STAGING_NEXT_PUBLIC_APP_URL:-http://wixur.ir}
         NEXT_PUBLIC_APP_NAME: ${STAGING_NEXT_PUBLIC_APP_NAME:-Dyolink}
+        NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN:-}
+        NEXT_PUBLIC_SENTRY_ENVIRONMENT: staging
     container_name: dyolink_frontend_staging
     depends_on:
       - backend

infrastructure/scripts/prod-remote-deploy.sh

@@ -18,8 +18,33 @@ if ! grep -q '^REGISTRY_PREFIX=.\+' .env; then
 fi
 
 export TAG
+
+# Windows Gitea often RSTs concurrent or long pulls (connection reset by peer).
+# Pull one image at a time with backoff so a flake does not fail the whole tag.
+pull_one() {
+  local service="$1"
+  local attempt=1
+  local max=5
+  local delay=8
+  while [ "$attempt" -le "$max" ]; do
+    echo "Pulling $service :$TAG (attempt $attempt/$max)"
+    if docker compose -f docker-compose.prod.yml --env-file .env pull "$service"; then
+      return 0
+    fi
+    if [ "$attempt" -eq "$max" ]; then
+      echo "Failed to pull $service after $max attempts"
+      return 1
+    fi
+    echo "Pull of $service failed; retrying in ${delay}s..."
+    sleep "$delay"
+    delay=$((delay * 2))
+    attempt=$((attempt + 1))
+  done
+}
+
 echo "Pulling backend/frontend :$TAG from Gitea (REGISTRY_PREFIX in .env)"
-docker compose -f docker-compose.prod.yml --env-file .env pull backend frontend
+pull_one backend
+pull_one frontend
 docker compose -f docker-compose.prod.yml --env-file .env up -d
 echo "=== Status ==="
 docker compose -f docker-compose.prod.yml --env-file .env ps