mirror of
https://github.com/makeplane/plane.git
synced 2026-07-10 12:37:13 +02:00
761c999e0c
* fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets The IP-based allowlist alone isn't practical for containerised deployments where service IPs are dynamic. Adds a hostname-based bypass for trusted internal services (e.g. Silo via docker-compose / k8s service DNS) and makes the previously hardcoded ["plane.so"] domain blocklist configurable via WEBHOOK_DISALLOWED_DOMAINS. - validate_url accepts allowed_hosts (exact, case-insensitive match; skips DNS lookup for trusted names) - WebhookSerializer wires both settings through and lets allowlisted hosts bypass the disallowed-domain check - Exposes WEBHOOK_ALLOWED_HOSTS in aio/cli deployment env files * fix: default WEBHOOK_DISALLOWED_DOMAINS to empty for self-hosted * fix: pass WEBHOOK_ALLOWED_HOSTS to send-time webhook re-validation
92 lines
2.2 KiB
Bash
92 lines
2.2 KiB
Bash
APP_DOMAIN=localhost
|
|
APP_RELEASE=stable
|
|
|
|
WEB_REPLICAS=1
|
|
SPACE_REPLICAS=1
|
|
ADMIN_REPLICAS=1
|
|
API_REPLICAS=1
|
|
WORKER_REPLICAS=1
|
|
BEAT_WORKER_REPLICAS=1
|
|
LIVE_REPLICAS=1
|
|
|
|
LISTEN_HTTP_PORT=80
|
|
LISTEN_HTTPS_PORT=443
|
|
|
|
WEB_URL=http://${APP_DOMAIN}
|
|
DEBUG=0
|
|
CORS_ALLOWED_ORIGINS=http://${APP_DOMAIN}
|
|
API_BASE_URL=http://api:8000
|
|
|
|
#DB SETTINGS
|
|
PGHOST=plane-db
|
|
PGDATABASE=plane
|
|
POSTGRES_USER=plane
|
|
POSTGRES_PASSWORD=plane
|
|
POSTGRES_DB=plane
|
|
POSTGRES_PORT=5432
|
|
PGDATA=/var/lib/postgresql/data
|
|
DATABASE_URL=
|
|
|
|
# REDIS SETTINGS
|
|
REDIS_HOST=plane-redis
|
|
REDIS_PORT=6379
|
|
REDIS_URL=
|
|
|
|
# RabbitMQ Settings
|
|
RABBITMQ_HOST=plane-mq
|
|
RABBITMQ_PORT=5672
|
|
RABBITMQ_USER=plane
|
|
RABBITMQ_PASSWORD=plane
|
|
RABBITMQ_VHOST=plane
|
|
AMQP_URL=
|
|
|
|
# If SSL Cert to be generated, set CERT_EMAIl="email <EMAIL_ADDRESS>"
|
|
CERT_ACME_CA=https://acme-v02.api.letsencrypt.org/directory
|
|
TRUSTED_PROXIES=0.0.0.0/0
|
|
SITE_ADDRESS=:80
|
|
CERT_EMAIL=
|
|
|
|
|
|
|
|
# For DNS Challenge based certificate generation, set the CERT_ACME_DNS, CERT_EMAIL
|
|
# CERT_ACME_DNS="acme_dns <CERT_DNS_PROVIDER> <CERT_DNS_PROVIDER_API_KEY>"
|
|
CERT_ACME_DNS=
|
|
|
|
|
|
# Secret Key
|
|
SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5
|
|
|
|
# DATA STORE SETTINGS
|
|
USE_MINIO=1
|
|
AWS_REGION=
|
|
AWS_ACCESS_KEY_ID=access-key
|
|
AWS_SECRET_ACCESS_KEY=secret-key
|
|
AWS_S3_ENDPOINT_URL=http://plane-minio:9000
|
|
AWS_S3_BUCKET_NAME=uploads
|
|
FILE_SIZE_LIMIT=5242880
|
|
|
|
# Gunicorn Workers
|
|
GUNICORN_WORKERS=1
|
|
|
|
# UNCOMMENT `DOCKER_PLATFORM` IF YOU ARE ON `ARM64` AND DOCKER IMAGE IS NOT AVAILABLE FOR RESPECTIVE `APP_RELEASE`
|
|
# DOCKER_PLATFORM=linux/amd64
|
|
|
|
# Force HTTPS for handling SSL Termination
|
|
MINIO_ENDPOINT_SSL=0
|
|
|
|
# API key rate limit
|
|
API_KEY_RATE_LIMIT=60/minute
|
|
|
|
# Live server environment variables
|
|
# WARNING: You must set a secure value for LIVE_SERVER_SECRET_KEY in production environments.
|
|
LIVE_SERVER_SECRET_KEY=
|
|
|
|
# Webhook IP allowlist — comma-separated IPs or CIDR ranges allowed as webhook targets
|
|
# even if they resolve to private networks (e.g. "10.0.0.0/8,192.168.1.0/24,172.16.0.5")
|
|
WEBHOOK_ALLOWED_IPS=
|
|
|
|
# Webhook hostname allowlist — comma-separated hostnames that bypass the private-IP
|
|
# SSRF check. Useful for trusted internal services whose container/service IPs are
|
|
# dynamic (e.g. "silo,silo.namespace.svc.cluster.local")
|
|
WEBHOOK_ALLOWED_HOSTS=
|