Skip to content

[bug]: prime-cli compose sets WEBHOOK_ALLOWED_HOSTS from an undefined ${WEB_URL}, so the GitHub integration's Connect does nothing #10133

Open

Description

@MaolmeoX

Version: Plane Commercial v3.3.3, Docker Compose, installed with prime-cli setup --behind-proxy, instance on a private IP.

Current behavior: The compose file prime-cli generates in /var/plane/docker-compose.yml has, on all five backend services:

WEB_URL: http://192.168.105.110
WEBHOOK_ALLOWED_HOSTS: ${WEB_URL}
WEBHOOK_ALLOWED_IPS: ""

WEB_URL is written as a literal service variable, but ${WEB_URL} is Compose interpolation, resolved from the shell or from a .env file next to the compose file, and prime-cli creates neither. WEBHOOK_ALLOWED_HOSTS is therefore empty. Even if it were set, WEB_URL holds a URL with a scheme, while WEBHOOK_ALLOWED_HOSTS expects comma-separated host names.

On an instance whose domain resolves to a private address, the SSRF guard introduced in #8884 then rejects the webhook Plane sends to its own Silo service when a workspace connects GitHub: clicking Connect in Workspace settings > Integrations > GitHub does nothing, and the internal webhook call fails with a 400.

Workaround: create /var/plane/.env with WEB_URL=<host>,<domain> (host names only), then prime-cli restart.

Expected behavior: prime-cli fills WEBHOOK_ALLOWED_HOSTS with the instance's host names, or the compose file takes them from a variable prime-cli defines.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions