Feature: on-prem relay agent for GitLab integration

A customer has requested a deployable on-prem relay/agent component — similar to reverse-call agents offered by ResolveAI, ConductorOne, or ServiceNow — that would be installed inside their network and communicate outbound to Sentry SaaS via polling. The agent would handle the GitLab integration locally, removing the requirement for Sentry to reach a private GitLab instance directly over the internet.

Current behavior

• GitLab integrations require Sentry SaaS to make inbound connections to the customer's GitLab instance.
• Customers with air-gapped or firewall-restricted networks cannot expose their GitLab to external traffic, blocking the integration.

Gap

• No outbound-only relay component exists; customers must either open firewall rules or forgo the GitLab integration entirely.
• This is a recurring blocker for enterprise/on-prem customers whose security policies prohibit inbound internet access to internal services.

Options

• Deployable relay agent that polls Sentry SaaS and proxies GitLab API calls outbound (no inbound required).
• Alternatively, a generic reverse-proxy / tunneling solution that could cover multiple integrations beyond GitLab.

Action taken on behalf of colin.kawai.

The issue names no files, tests, or entry points. Start by reviewing the existing GitLab integration and the current inbound connection flow, then compare the relay-agent and generic reverse-proxy options against the outbound-only and air-gapped requirements. Done means an agreed design and implementation scope for the selected approach.