docs(self-hosting): add FIPS-enabled deployment guide - #306
docs(self-hosting): add FIPS-enabled deployment guide#306pratapalakshmi wants to merge 3 commits into
Conversation
Adds the FIPS deployment guide for the makeplane/*-commercial-fips image set under the Commercial Edition install methods, matching the sibling pages' hidden/noindex convention (search:false, sidebar:false, robots noindex, added to the LLM ignoreFiles list). Covers the host fips=1 prerequisite (the single most-missed step), the full -commercial-fips image list (and why there is no FIPS AIO image), the docker-compose-fips.yml deploy + verify-fips.sh flow, the FIPS-only config defaults (LDAP_TLS_REQUIRE_CERT, SAML_REJECT_DEPRECATED_ALGORITHM, SECRET_ENCRYPTION_V2, USAGE_ID_DIGEST) with overrides, non-root/OpenShift arbitrary-UID guidance, and an honest scope-of-coverage section (bundled data plane is not FIPS; modules are certified, not Plane as a product). Supersedes makeplane/docs#484 — self-hosting content lives on developers.plane.so. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 54 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a FIPS deployment guide for Plane Enterprise. The guide covers image selection, host prerequisites, Compose deployment, verification, security defaults, Kubernetes/OpenShift operation, datastore boundaries, and certification scope. Navigation includes the page, and LLM generation excludes it. ChangesFIPS deployment documentation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/self-hosting/methods/install-methods-commercial/fips-deployment.md`:
- Line 98: Update the log-output fenced code block in the FIPS deployment
documentation to specify the text language identifier, changing the opening
fence to use text while preserving the block contents.
- Around line 107-110: Update the FIPS deployment documentation around the
verify-fips.sh reference to remove claims about invoking or describing checks
from a nonexistent committed script, unless the script is added to the
repository first. Keep the documented FIPS validation guidance accurate and
avoid listing exact assertions or exit behavior without an available script
implementing them.
- Around line 118-129: Update the settings table’s USAGE_ID_DIGEST row to state
that sha256 is required with FIPS-mode Postgres and explicitly mark md5 as
incompatible, rather than implying it is a supported FIPS override. Keep the
existing digest purpose and migration context intact.
- Around line 146-153: Update the OpenShift security-context guidance in the
FIPS deployment documentation to avoid unconditionally setting runAsGroup: 0 or
fsGroup: 0, since restricted-v2 rejects fsGroup 0 unless the namespace
supplemental-group range permits it. State that these group settings are
conditional on supported namespace configuration, otherwise omit them, and
document that bundled proxy deployments may use an SCC explicitly allowing
NET_BIND_SERVICE instead of requiring a custom SCC.
- Around line 61-71: Split the FIPS host setup section by distribution and RHEL
version instead of grouping all hosts under “RHEL-family.” Keep fips-mode-setup
and the separate /boot requirement only for supported RHEL versions, document
RHEL 10 as requiring installation with fips=1 without post-install switching,
and provide Amazon Linux 2023 instructions without requiring a separate /boot or
boot=UUID=... configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1c43bdb4-e450-4d3d-9b49-bef375f472c0
📒 Files selected for processing (2)
docs/.vitepress/config.mtsdocs/self-hosting/methods/install-methods-commercial/fips-deployment.md
Add a "FIPS deployment" entry to the "Self-host Plane" sidebar group in both the root and /self-hosting/ sidebars, and drop `search: false` / `sidebar: false` from the page frontmatter so it renders with the nav and is found by in-site (⌘K) search. Keep the robots noindex tag — discoverable within the docs site, not indexed by public search engines (matching its commercial-feature nature). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Host setup: split by distro/version. AL2023 + RHEL 8/9 use fips-mode-setup (AL2023 keeps /boot on root; RHEL needs a mounted separate /boot if present). RHEL 10 removed fips-mode-setup — FIPS must be enabled at install with fips=1; post-install switching is unsupported. - OpenShift: don't set runAsUser/runAsGroup/fsGroup under restricted-v2 — the SCC assigns the UID and allocates fsGroup from the namespace supplemental-group range, so an explicit fsGroup: 0 is rejected unless that range includes 0. The runAsGroup/fsGroup: 0 guidance now applies only to plain Kubernetes. Proxy note reworded to "an SCC that permits NET_BIND_SERVICE". - USAGE_ID_DIGEST: clarify md5 is incompatible under FIPS (sha256 required), not an either-direction override. - verify-fips.sh: attribute to the plane-ee repo and soften wording (it is not committed to this docs repo). - Add the `text` language tag to the startup-log fenced block. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
What
Adds the FIPS-enabled deployment guide for the
makeplane/*-commercial-fipsimage set, under the Commercial Edition install methods (self-hosting/methods/install-methods-commercial/fips-deployment.md).This supersedes makeplane/docs#484 — self-hosting content lives on
developers.plane.so, so the guide belongs in this repo rather than the general docs site. That PR is being closed in favour of this one.Placement & conventions
Placed beside the other Commercial Edition install pages (
docker-compose.md,kubernetes.md) and follows their exact convention:search: false,sidebar: false,robots: noindex, nofollow, and added to thevitepress-plugin-llmsignoreFileslist inconfig.mts. Reached by direct link like its siblings.Contents
fips=1boot requirement (the single most-missed step: a FIPS image on a non-FIPS host looks fine but provides nothing).-commercial-fipsimages; note there is deliberately no FIPS AIO image (Alpine base has no validated crypto).docker-compose-fips.ymlflow and theverify-fips.shposture check.LDAP_TLS_REQUIRE_CERT,SAML_REJECT_DEPRECATED_ALGORITHM,SECRET_ENCRYPTION_V2,USAGE_ID_DIGEST, each with its override and standard-image default, plus the LDAP hostname-matching gotcha.restricted-v2, plus the bundled-proxy low-port caveat. (New vs #484 — reflects the validated OpenShift arbitrary-UID work.)Points at
deployments/cli/commercial/README-FIPS.mdin plane-ee as the authoritative operations reference.Validation
prettierclean on both files.@voidzero-dev/vitepress-theme); CI's clean install + build is authoritative.🤖 Generated with Claude Code
Summary by CodeRabbit