Content
View differences
Updated by Christophe Bliard 7 days ago
**As** a \[enter role of user\]
**I want to** \[enter objective\]
**so that** \[enter desired result\]
When used on-premises, jira dc is always installed using a private IP address and always needs enablement with `OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST`. `OPENPROJECT_SSRF**PROTECTION**IP__ALLOWLIST`. Currently we show a link to the documentation but it may not be enough.
During a customer migration, the user was a bit lost about what should be done. It was actually a matter of running two commands:
`sudo openproject config:set OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST=10.120.0.0/16`
`sudo openproject restart`
We did not have to find the actual ip of the jira server because the user knew which ip range to enable, but it could be another friction point
Maybe the documentation could be improved to be more explicit about what is needed
**Acceptance criteria**
* Improved doc or error message to indicate the user that there are two steps needed:
* first step is adding the server to the allowed list
* second step is restart
* documentation should be as helpful as possible
* indicate how to retrieve the ip address of the server.
* Can it be indicated in the error message?
* have one section per installatino method with detailed instructions for each
* packaged installation
* `sudo openproject config:set OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST="a.b.c.d 10.x.y.z/16"`
* `sudo openproject restart`
* What about adding a new command `openproject ssrf-allow jira.mycompany.com`? It could allow ip, ip range or hostname, do some sanity checks and properly modify the env var.
* docker compose installation
* indicate where the `OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST` should be added
* kubernetes
* indicate where the `OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST` should be added
**Technical notes**
* <br>
**Permissions and visibility considerations**
* _To whom is this feature visible?_
* _When is it not visible?_
**Translation considerations**
* _Key terms and phrases in the key languages_
**Out of scope**
* <br>
_Set the_ **To be informed/consulted teams** _field to include all teams necessary to be informed of the changes._
**I want to** \[enter objective\]
**so that** \[enter desired result\]
When used on-premises, jira dc is always installed using a private IP address and always needs enablement with `OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST`.
During a customer migration, the user was a bit lost about what should be done. It was actually a matter of running two commands:
`sudo openproject config:set OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST=10.120.0.0/16`
`sudo openproject restart`
We did not have to find the actual ip of the jira server because the user knew which ip range to enable, but it could be another friction point
Maybe the documentation could be improved to be more explicit about what is needed
**Acceptance criteria**
* Improved doc or error message to indicate the user that there are two steps needed:
* first step is adding the server to the allowed list
* second step is restart
* documentation should be as helpful as possible
* indicate how to retrieve the ip address of the server.
* Can it be indicated in the error message?
* have one section per installatino method with detailed instructions for each
* packaged installation
* `sudo openproject config:set OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST="a.b.c.d 10.x.y.z/16"`
* `sudo openproject restart`
* What about adding a new command `openproject ssrf-allow jira.mycompany.com`? It could allow ip, ip range or hostname, do some sanity checks and properly modify the env var.
* docker compose installation
* indicate where the `OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST` should be added
* kubernetes
* indicate where the `OPENPROJECT_SSRF__PROTECTION__IP__ALLOWLIST` should be added
**Technical notes**
* <br>
**Permissions and visibility considerations**
* _To whom is this feature visible?_
* _When is it not visible?_
**Translation considerations**
* _Key terms and phrases in the key languages_
**Out of scope**
* <br>
_Set the_ **To be informed/consulted teams** _field to include all teams necessary to be informed of the changes._