Verify/fix PUBLIC_API_ORIGIN reachability on the self-hosted review instance and alert on regression

[JSONbored]

Problem

The "after" placeholder cell in JSONbored/metagraphed#6036's Visual preview table pointed at https://<redacted>.ts.net/loopover/shot?placeholder=loading — a Tailscale MagicDNS (.ts.net) hostname, unreachable from GitHub's public image-fetching servers unless Tailscale Funnel is explicitly enabled for that exact route. This is exactly the failure mode src/selfhost/health.ts's publicOriginReachabilityAdvisory was built to catch (added after a prior documented incident, "JSONbored/loopover PR #4180's live bug") — it logs a boot-time warning when PUBLIC_API_ORIGIN/PUBLIC_SITE_ORIGIN looks like a private/Tailscale hostname, with a PUBLIC_ORIGIN_ACKNOWLEDGED=true opt-out for genuinely Funnel-exposed nodes.

Since the symptom is still live, either: (a) PUBLIC_API_ORIGIN on this self-hosted instance is actually set to the Tailscale hostname and the advisory is firing into logs nobody's watching, or (b) PUBLIC_ORIGIN_ACKNOWLEDGED=true was set without confirming Funnel genuinely publishes that route end-to-end.

This makes EVERY placeholder image (loading/failed/auth-wall) and every on-demand-fallback shot link permanently broken for anyone viewing the PR outside the tailnet — it's not a race condition, it's a structural misconfiguration.

Area

Live self-hosted instance config (redacted — see below) + src/selfhost/health.ts's advisory (visibility/alerting only — the detection logic itself already exists and is correct).

Proposal

1. Verify the ACTUAL current value of PUBLIC_API_ORIGIN (and PUBLIC_SITE_ORIGIN) on the self-hosted instance reviewing JSONbored's own repos, and whether PUBLIC_ORIGIN_ACKNOWLEDGED is set.
2. If it's genuinely the Tailscale hostname: either (a) put a real public domain / reverse proxy in front of the instance and point PUBLIC_API_ORIGIN at that, or (b) confirm Tailscale Funnel is actually enabled and serving /loopover/shot publicly end-to-end (a live curl from OUTSIDE the tailnet, not just a config check) before trusting the acknowledgment.
3. Strengthen the advisory's visibility so this can't silently regress again: wire publicOriginReachabilityAdvisory's warning into whatever this instance's real alerting channel is (Sentry capture, not just a console.warn/log line) so a misconfigured origin surfaces as an actual alert, not something that only a human reading raw logs would notice.

Deliverables

• Confirmed (or corrected) live PUBLIC_API_ORIGIN/PUBLIC_SITE_ORIGIN value on the self-hosted instance — genuinely publicly reachable by GitHub's servers, verified by an external fetch, not just config inspection
• If PUBLIC_ORIGIN_ACKNOWLEDGED=true is set, it reflects a VERIFIED-reachable origin, not an assumption
• publicOriginReachabilityAdvisory's warning is wired to a real alert (Sentry or equivalent), not just a log line, so this can't silently regress again without anyone noticing
• A follow-up screenshot on a real PR confirms the "after" cell (once Make the visual-preview retry budget durable per-PR-head, not per-job-chain (fixes repeated re-review storms) #6323's retry-budget fix and Tighten isVisualPath so a non-visual apps/*/ file (e.g. a .ts lib file) doesn't trigger screenshot capture #6322's isVisualPath fix are also in) renders correctly for a genuinely visual change

Resources

• src/selfhost/health.ts — publicOriginReachabilityAdvisory, looksNonPublic, publicOriginAcknowledgedGaugeValue (existing detection logic, already correct)
• src/review/visual/capture.ts — where PUBLIC_API_ORIGIN gets embedded into placeholder/on-demand URLs
• fix(ui): apply the pre-2000 placeholder rule in normalizeFreshnessSources metagraphed#6036 — the live PR that surfaced this

Boundaries

The live-server verification piece is an infra check, not a code change, and should be done directly (SSH) rather than guessed at. The alerting-wiring piece is a small, scoped code change. Don't touch the capture pipeline's URL-building logic itself here (that's correct as designed — this issue is about the CONFIG VALUE and its observability). Maintainer-only — assigned JSONbored.

[linear-code]

JSO-4415

[JSONbored]

Investigated. Two separate things going on:

1. Why the advisory never alerted anyone (fixed in #6350). sqliteBackupAdvisory and publicOriginReachabilityAdvisory both log via console.warn, but the Sentry log-forwarding hook (installStructuredLogForwarding) only ever intercepts console.log (with an explicit level:error/fatal) and console.error — never console.warn. So this advisory has been structurally invisible to Sentry the whole time, regardless of configuration. #6350 fixes that (switches both to console.error, keeps level: "warn" in the payload so Sentry still reports it as a warning, not an error).

2. The actual misconfiguration itself is confirmed and still live. Read-only check on the self-hosted instance:

• Its .env has PUBLIC_API_ORIGIN set to a Tailscale MagicDNS (.ts.net) hostname — a bare, private tailnet address.
• tailscale funnel status and tailscale serve status both report "No serve config" — Funnel is not enabled on this node, so this is genuinely, provably unreachable from GitHub's public image-fetching servers. Not a Funnel-exposed false positive.
• PUBLIC_ORIGIN_ACKNOWLEDGED is unset, so nothing was deliberately silencing this.
• PUBLIC_SITE_ORIGIN is correctly a real public domain — only PUBLIC_API_ORIGIN is wrong.

I didn't change the live .env myself — I don't know what the intended target is (a reverse proxy in front of this box under a real domain, a new DNS record, or enabling Funnel instead), and that's a real infra decision, not something to guess at on a production box. Whenever you're ready, let me know which direction you want and I can wire it up (or just apply it directly if you'd rather do it yourself over SSH).

This issue stays open until that's resolved and a real PR's screenshot confirms "after" renders correctly.

[JSONbored]

Fully resolved — verified live on edge-nl-01 via SSH, not assumed:

1. Origin value: .env on the box now sets PUBLIC_API_ORIGIN=https://shots.loopover.ai and PUBLIC_SITE_ORIGIN=https://loopover.ai (modified today, 07:10 CEST) — not the Tailscale .ts.net hostname the original bug report described. PUBLIC_ORIGIN_ACKNOWLEDGED is correctly unset since it's no longer needed.
2. Verified externally reachable, not just config-inspected: curl from outside the tailnet to the exact URL pattern loopover's own capture.ts builds (${PUBLIC_API_ORIGIN}/loopover/shot?placeholder=loading — confirmed NAMESPACE = "loopover" is a fixed constant used for every repo's screenshots including metagraphed's, per src/review/visual/capture.ts:35) returns a real HTTP 200, content-type: image/svg+xml, served through Cloudflare (cf-ray present, real anycast IPs). This is the exact endpoint fix(ui): apply the pre-2000 placeholder rule in normalizeFreshnessSources metagraphed#6036 found broken.
3. Advisory wired to a real alert, not just a log line: already fixed via commits c34571167 (fix(selfhost): route boot-time advisories through console.error so Sentry can see them) and 01e8cad63 (fix(selfhost): move Sentry init before emptyConfigDirAdvisory so it can alert too) — src/server.ts's publicOriginAdvisory now uses console.error specifically so installStructuredLogForwarding forwards it to Sentry, with an inline comment citing this issue directly.

All three deliverables confirmed done against live state, not just code inspection.