GlitchTip - Hardened Error Tracking and Uptime Monitoring

What is GlitchTip

GlitchTip is an open-source error tracking and application monitoring platform. Applications report exceptions to it over the widely used open-source client libraries, so instrumenting one usually means installing a package and setting a single DSN environment variable. Similar events are grouped into issues carrying a stack trace, breadcrumbs, request context and release information, so you see one problem with an occurrence count instead of thousands of duplicate alerts. Alongside errors it ingests structured logs and runs uptime monitors against your endpoints. Issues can be assigned, commented on and resolved, and alerts go out by email or webhook.

GlitchTip is an independent open-source project licensed under MIT, not affiliated with or endorsed by any other error-tracking vendor. Client-library compatibility is mentioned only so you know which packages to install.

Why self-host GlitchTip

Crash reports are among the most sensitive telemetry an application produces: stack traces carry request paths, user identifiers and sometimes payload fragments. Self-hosting keeps that data in your own subscription and region, so residency and retention become configuration rather than a vendor contract.

What this VM image adds

Security hardening:

• No credentials in the image - the signing key and the database password are generated on first boot into /root/glitchtip-credentials.txt (0600), so no two deployments share a secret
• Sign-up closed after the first account - registration ships disabled, yet the first visitor can still create the administrator account. Every later attempt is refused automatically
• TLS perimeter - nginx terminates HTTPS on 443 with a per-instance certificate generated at first boot; Certbot and its nginx plugin are pre-installed for a CA-signed one
• Bundled PostgreSQL 18 and Valkey 9, off the network - both are reachable only by the application and publish no host port
• Per-project ingest keys - each project gets its own DSN, and a duplicate event is rejected rather than counted twice
• Debug mode and the test API disabled - the shipped configuration is the production one, not development defaults
• Container logs capped - a crash-looping container cannot fill the OS disk
• Purchase and donation links removed - the bundled web interface carries no external purchase or donation prompts. Product documentation links are kept
• CVE scan - every image is scanned with Trivy before release
• UFW firewall - only 22, 80 and 443 are open; the application port and both data stores are blocked
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Azure IMDS egress - pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Licences and notices - /usr/share/doc/lynxroute/LICENSES.txt lists every bundled component and its licence

Quick Start

1. Deploy the VM (Standard_D2s_v3 or larger recommended)
2. Restrict port 443 to your own address first. The first visitor claims the administrator account
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. Open https://<PUBLIC_IP>/, click Register and sign up with your own email. First boot takes 2-4 minutes and shows a loading page until it is ready
5. Create an organization, then a project. Its DSN is under Settings, Client Keys
6. Set that DSN in your application and trigger one error to confirm the round trip

Email is intentionally unconfigured, so the interface offers copy-link invitations. For password-reset and invitation mail, add an EMAIL_URL line to /opt/glitchtip/.env and restart - the credentials file shows the syntax. Uptime monitors and webhook alerts need no mail.