docs: add FIPS-enabled deployment guide - #484
Open
pratapalakshmi wants to merge 1 commit into
Open
Conversation
Deployment guide for the makeplane/*-commercial-fips image set, for handoff to the docs team ahead of the FIPS release. Covers the host fips=1 prerequisite (the most-missed step), the full image list, the Compose deploy and verify flow, the FIPS-only configuration defaults (LDAP TLS validation, SAML SHA-1 rejection, at-rest secret format, usage-ledger digest) with their env-var overrides, and an honest scope section (bundled data plane is not FIPS; validation applies to the modules, not to Plane as a product). Added under docs/self-hosting/ with a sidebar entry beside the existing "Self-host Plane" link. Note: self-hosting content otherwise lives on developers.plane.so; the docs team may prefer to relocate this there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughChangesFIPS deployment documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/self-hosting/fips-deployment.md`:
- Around line 92-95: Specify the fenced block language as text for the
startup-log block containing the FIPS mode message, updating the opening fence
while preserving the log content.
- Around line 3-7: Update the page heading in the FIPS deployment documentation
to exactly match the sidebar label “FIPS deployment” defined in the
documentation configuration, changing only the heading text.
- Around line 72-87: Update the deployment command block in the FIPS deployment
instructions to explicitly change into plane-ee/deployments/cli/commercial/
before referencing variables.env and docker-compose-fips.yml, ensuring all
subsequent commands run from the directory containing those files.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 63b92280-487e-427b-a814-af07fbd38f4f
📒 Files selected for processing (2)
docs/.vitepress/config.tsdocs/self-hosting/fips-deployment.md
Comment on lines
+3
to
+7
| sidebar_label: FIPS deployment | ||
| description: Deploy the FIPS variant of Plane Enterprise on a FIPS-enforcing host, including prerequisites, image list, verification, and scope of coverage. | ||
| --- | ||
|
|
||
| # FIPS-enabled deployment |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Match the page heading to the sidebar label.
docs/.vitepress/config.ts uses FIPS deployment, while Line 7 uses # FIPS-enabled deployment. Use the same exact label in both places.
Proposed fix
-# FIPS-enabled deployment
+# FIPS deploymentAs per coding guidelines, page headings (#) must match the sidebar label defined in docs/.vitepress/config.ts.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| sidebar_label: FIPS deployment | |
| description: Deploy the FIPS variant of Plane Enterprise on a FIPS-enforcing host, including prerequisites, image list, verification, and scope of coverage. | |
| --- | |
| # FIPS-enabled deployment | |
| sidebar_label: FIPS deployment | |
| description: Deploy the FIPS variant of Plane Enterprise on a FIPS-enforcing host, including prerequisites, image list, verification, and scope of coverage. | |
| --- | |
| # FIPS deployment |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/self-hosting/fips-deployment.md` around lines 3 - 7, Update the page
heading in the FIPS deployment documentation to exactly match the sidebar label
“FIPS deployment” defined in the documentation configuration, changing only the
heading text.
Source: Coding guidelines
Comment on lines
+72
to
+87
| The Compose file and its supporting files live in the plane-ee repository under | ||
| `deployments/cli/commercial/`: | ||
|
|
||
| - `docker-compose-fips.yml` — the FIPS stack | ||
| - `variables.env` — environment template | ||
| - `README-FIPS.md` — the authoritative operations reference | ||
| - `verify-fips.sh` — the verification script (see [Verify](#verify)) | ||
|
|
||
| ```bash | ||
| # 1. Confirm the host is in FIPS mode (above). | ||
| # 2. Prepare the environment file. | ||
| cp variables.env .env | ||
| # Edit at least: DOMAIN_NAME, WEB_URL, SECRET_KEY, MACHINE_SIGNATURE. | ||
|
|
||
| # 3. Bring the stack up. | ||
| docker compose -f docker-compose-fips.yml up -d |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the Compose working directory explicit.
The commands use variables.env and docker-compose-fips.yml, but the page does not state that they must run from plane-ee/deployments/cli/commercial/. A reader who runs the block elsewhere cannot find these files. Add a cd step or state the required working directory.
Proposed fix
+# From the plane-ee repository root:
+cd deployments/cli/commercial
cp variables.env .env📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| The Compose file and its supporting files live in the plane-ee repository under | |
| `deployments/cli/commercial/`: | |
| - `docker-compose-fips.yml` — the FIPS stack | |
| - `variables.env` — environment template | |
| - `README-FIPS.md` — the authoritative operations reference | |
| - `verify-fips.sh` — the verification script (see [Verify](#verify)) | |
| ```bash | |
| # 1. Confirm the host is in FIPS mode (above). | |
| # 2. Prepare the environment file. | |
| cp variables.env .env | |
| # Edit at least: DOMAIN_NAME, WEB_URL, SECRET_KEY, MACHINE_SIGNATURE. | |
| # 3. Bring the stack up. | |
| docker compose -f docker-compose-fips.yml up -d | |
| The Compose file and its supporting files live in the plane-ee repository under | |
| `deployments/cli/commercial/`: | |
| - `docker-compose-fips.yml` — the FIPS stack | |
| - `variables.env` — environment template | |
| - `README-FIPS.md` — the authoritative operations reference | |
| - `verify-fips.sh` — the verification script (see [Verify](`#verify`)) | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/self-hosting/fips-deployment.md` around lines 72 - 87, Update the
deployment command block in the FIPS deployment instructions to explicitly
change into plane-ee/deployments/cli/commercial/ before referencing
variables.env and docker-compose-fips.yml, ensuring all subsequent commands run
from the directory containing those files.
Comment on lines
+92
to
+95
| ``` | ||
| plane: FIPS mode ACTIVE (host kernel reports fips_enabled=1) | ||
| ``` | ||
|
|
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Specify the fenced block language.
markdownlint-cli2 reports MD040 for Lines 92-95. Mark this startup-log block as text.
Proposed fix
-```
+```text
plane: FIPS mode ACTIVE (host kernel reports fips_enabled=1)</details>
<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>
> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
```suggestion
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 92-92: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/self-hosting/fips-deployment.md` around lines 92 - 95, Specify the
fenced block language as text for the startup-log block containing the FIPS mode
message, updating the opening fence while preserving the log content.
Source: Linters/SAST tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a FIPS-enabled deployment guide for the
makeplane/*-commercial-fipsimage set, for the docs team to pick up ahead of the FIPS release. The images become available once the plane-ee FIPS release PR is merged and a release build publishes them.New page:
docs/self-hosting/fips-deployment.md, wired into the sidebar (config.ts) beside the existing Self-host Plane link.Contents
fips=1boot requirement, the single most-missed step (a FIPS image on a non-FIPS host looks fine but provides nothing).-commercial-fipsimages; note that there is deliberately no FIPS AIO image.docker-compose-fips.ymlflow and theverify-fips.shposture check.LDAP_TLS_REQUIRE_CERT,SAML_REJECT_DEPRECATED_ALGORITHM,SECRET_ENCRYPTION_V2,USAGE_ID_DIGEST, each with its override and the standard-image default, plus the LDAP hostname-matching gotcha.Points at
deployments/cli/commercial/README-FIPS.mdin plane-ee as the authoritative operations reference.For the docs team
Placement question: self-hosting content otherwise lives on
developers.plane.so/self-hosting/*, and this product-docs repo only links out to it. This page is added here because that's where the handoff was requested, but you may prefer to relocate it to the developers site — the content is portable as-is.pnpm check:formatpasses.🤖 Generated with Claude Code
Summary by CodeRabbit