feat: replace PostHog with first-party feedback (#1665)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/bright-feedback-inbox.md

@@ -0,0 +1,12 @@
+---
+"hephaestus": minor
+---
+
+Instance administrators can publish workspace-targeted surveys and review survey responses and product feedback
+without sending data to an external analytics service. Contributors can send feedback, respond to surveys, or
+permanently dismiss them; submissions remain in the instance database.
+
+**Operators:** the PostHog integration is removed entirely. `POSTHOG_ENABLED`, `POSTHOG_API_HOST`,
+`POSTHOG_PROJECT_ID`, `POSTHOG_PROJECT_API_KEY`, and `POSTHOG_PERSONAL_API_KEY` are no longer read
+and can be deleted from your `.env`; no replacement variable is needed and no other action is
+required.

.changeset/core-web-vitals-reach-analytics.md

@@ -1,9 +1,4 @@
 ---
-"hephaestus": minor
 ---
 
-Instances that run PostHog now receive Core Web Vitals — largest contentful paint, cumulative layout
-shift, first contentful paint and interaction to next paint — for the web application, so a slow
-page is visible in analytics rather than only in a complaint. The application never measured them
-before. Nothing is captured without the analytics consent that already gates every other event, and
-network request timing stays off.
+Superseded before release by the first-party feedback replacement in this pull request.

.github/workflows/deploy-locked-compose.yml

@@ -76,8 +76,6 @@ jobs:
           SECRET_NATS_USERNAME: ${{ secrets.NATS_USERNAME }}
           SECRET_NATS_PASSWORD: ${{ secrets.NATS_PASSWORD }}
           SECRET_OUTLINE_OAUTH_CLIENT_SECRET: ${{ secrets.OUTLINE_OAUTH_CLIENT_SECRET }}
-          SECRET_POSTHOG_PERSONAL_API_KEY: ${{ secrets.POSTHOG_PERSONAL_API_KEY }}
-          SECRET_POSTHOG_PROJECT_API_KEY: ${{ secrets.POSTHOG_PROJECT_API_KEY }}
           SECRET_SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           SECRET_WEBHOOK_SECRET: ${{ secrets.WEBHOOK_SECRET }}
         run: |

.migration/bright-feedback-inbox.md

@@ -0,0 +1,17 @@
+#### 🔴 The PostHog integration is removed
+
+**Affected**: deployments that carry PostHog settings in their `.env` or pass them as deploy
+secrets. Deployments that never configured PostHog need no changes.
+
+**Before**: the stack read `POSTHOG_ENABLED`, `POSTHOG_API_HOST`, `POSTHOG_PROJECT_ID`,
+`POSTHOG_PROJECT_API_KEY`, and `POSTHOG_PERSONAL_API_KEY`, and the webapp could load the PostHog
+client and its cloud-backed surveys when they were set.
+
+**After**: none of these variables are read anywhere; product feedback and surveys are stored in
+the instance's own PostgreSQL and reviewed in **Administration → Feedback**. No replacement
+variable exists.
+
+**Migration**: delete the `POSTHOG_*` lines from your `.env` and remove any corresponding deploy
+or preview secrets; leftover values are ignored but keep an unused credential in circulation, so
+also revoke the PostHog personal API key in PostHog itself if one was ever issued. The schema
+migration for the new feedback tables runs automatically.

CHANGELOG.md

@@ -1102,7 +1102,6 @@
 
   The user guide now matches the shipped multi-workspace GitHub and GitLab setup, current Heph chat, practice-feedback delivery, optional leaderboard and leagues, and configurable Slack digest. Account settings now state clearly that turning off pull-request comments controls delivery only; reviews still run and observations remain available to workspace admins.
 
-  The TUM privacy statement now describes the self-service data export, consent-gated PostHog and Sentry storage, comment-delivery preference, and absence of HTTP access logs as implemented.
 
 - When a review has more to say than one comment can hold, the suggestions that survive are now chosen by how much of your change they were actually seen in, rather than by how sure the reviewer said it felt. Previously every observation carried a self-reported confidence score, and that score decided which suggestions made the cut and which strength got acknowledged. Measured across 580 real observations it never once dropped below 90% and was a flat 100% more than half the time — so it was deciding those cuts on noise. It is gone.
 

docker/.env.example

@@ -238,12 +238,6 @@ OUTLINE_OAUTH_CLIENT_SECRET=
 SENTRY_DSN=
 SENTRY_ENVIRONMENT=production
 
-# PostHog analytics
-POSTHOG_ENABLED=false
-POSTHOG_API_HOST=https://app.posthog.com
-POSTHOG_PROJECT_API_KEY=
-POSTHOG_PROJECT_ID=
-POSTHOG_PERSONAL_API_KEY=
 
 # Enable TanStack Devtools in the webapp (keep false in production)
 TANSTACK_DEVTOOLS_ENABLED=false

docker/compose.app.yaml

@@ -45,9 +45,6 @@ services:
       LEGAL_PROFILE: ${LEGAL_PROFILE:-}
       SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT}
       SENTRY_DSN: ${SENTRY_DSN}
-      POSTHOG_ENABLED: ${POSTHOG_ENABLED:-false}
-      POSTHOG_PROJECT_API_KEY: ${POSTHOG_PROJECT_API_KEY}
-      POSTHOG_API_HOST: ${POSTHOG_API_HOST}
       TANSTACK_DEVTOOLS_ENABLED: ${TANSTACK_DEVTOOLS_ENABLED:-false}
     ports:
       - "80"
@@ -180,10 +177,6 @@ services:
       LEADERBOARD_SCHEDULE_DAY: ${LEADERBOARD_SCHEDULE_DAY:-2}
       LEADERBOARD_SCHEDULE_TIME: ${LEADERBOARD_SCHEDULE_TIME:-9}
       SENTRY_DSN: ${SENTRY_DSN}
-      POSTHOG_ENABLED: ${POSTHOG_ENABLED:-false}
-      POSTHOG_API_HOST: ${POSTHOG_API_HOST:-https://app.posthog.com}
-      POSTHOG_PROJECT_ID: ${POSTHOG_PROJECT_ID:-}
-      POSTHOG_PERSONAL_API_KEY: ${POSTHOG_PERSONAL_API_KEY:-}
       WEBHOOK_SECRET: ${WEBHOOK_SECRET}
       # WEBHOOK_EXTERNAL_URL intentionally unset: GitLab auto-registration defaults it to
       # APPLICATION_HOST_URL (same origin here), then appends /webhooks/gitlab itself.

docker/preview/compose.app.yaml

@@ -336,7 +336,6 @@ services:
       TANSTACK_DEVTOOLS_ENABLED: "true"
       SENTRY_ENVIRONMENT: preview
       SENTRY_DSN: ""
-      POSTHOG_ENABLED: "false"
     depends_on:
       appserver:
         condition: service_healthy

docker/self-host/.env.example

@@ -109,11 +109,7 @@ GH_AUTH_TOKEN=
 # Sentry error tracking. Leave blank to disable.
 SENTRY_DSN=
 SENTRY_ENVIRONMENT=production
-# PostHog product analytics — disabled unless POSTHOG_ENABLED=true; the keys below
 # do nothing on their own. Leave the two keys present (blank is fine) either way.
-#POSTHOG_ENABLED=false
-POSTHOG_PROJECT_API_KEY=
-POSTHOG_API_HOST=
 
 # Container memory limits for the two JVMs. Each sizes its heap from its own limit, so lowering a
 # limit lowers the heap with it. Lower both before the first start on a host below 8 GB RAM.

docs/admin/buildpacks-cds-decision.md

@@ -20,7 +20,9 @@ The training run boots under the `cds-training` profile (`application-cds-traini
 
 ## Why not Spring AOT processing (`spring.aot.enabled=true`)
 
-AOT processing evaluates `@Conditional` at **build time**, baking the build-time environment into the image ([reference](https://docs.spring.io/spring-boot/reference/packaging/aot.html)). The codebase has ~70 `@ConditionalOn*` sites (Sentry, Slack, PostHog, Resilience4j, etc.) that depend on env vars intentionally absent in CI — enabling AOT now would silently drop those beans from the production image. Revisit when the JDK move to Java 25 LTS lands (epic #1096); [JEP 483 AOT cache](https://openjdk.org/jeps/483) then supersedes CDS via `BP_JVM_AOTCACHE_ENABLED=true`.
+AOT evaluates conditional bean registration at build time. Hephaestus selects integrations and runtime roles from
+deployment configuration, so an image built in CI cannot safely fix those choices without omitting beans needed in
+production. CDS preserves runtime configuration while improving startup.
 
 ## Why not GraalVM Native Image