Skip to content

[IMP] security bash in single block #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
emjay0921 merged 1 commit into from
Sep 2, 2025
Merged

[IMP] security bash in single block #86

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 6 additions & 20 deletions docs/user_guide/administration/security_tuning.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,16 @@ This guide provides essential recommendations for securing your OpenSPP instance
After initial setup and database creation, it's strongly recommended to:

```bash
# Edit the configuration
sudo nano /etc/openspp/odoo.conf
```

# Set list_db to False for production
Set list_db to False for production
```ini
list_db = False
```

# Restart the service
Restart the service
```bash
sudo systemctl restart openspp
```

Expand All @@ -41,29 +44,17 @@ sudo systemctl restart openspp
### 2. Firewall Configuration

```bash
# Install UFW firewall
sudo apt-get install -y ufw

# Allow SSH (adjust port if needed)
sudo ufw allow 22/tcp

# Allow OpenSPP web interface
sudo ufw allow 8069/tcp

# Allow OpenSPP longpolling (if using real-time features)
sudo ufw allow 8072/tcp

# Enable firewall
sudo ufw enable
Comment on lines 47 to 51

@gemini-code-assist gemini-code-assist Bot Sep 2, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The comments explaining the purpose of each firewall rule have been removed. While this makes the block cleaner for copy-pasting, it reduces clarity for users who may not be familiar with the default ports for OpenSPP. These comments are valuable for understanding what each command does. Consider adding them back as inline comments to maintain both clarity and a compact block.

Suggested change
sudo apt-get install -y ufw
# Allow SSH (adjust port if needed)
sudo ufw allow 22/tcp
# Allow OpenSPP web interface
sudo ufw allow 8069/tcp
# Allow OpenSPP longpolling (if using real-time features)
sudo ufw allow 8072/tcp
# Enable firewall
sudo ufw enable
sudo apt-get install -y ufw
sudo ufw allow 22/tcp # Allow SSH (adjust port if needed)
sudo ufw allow 8069/tcp # Allow OpenSPP web interface
sudo ufw allow 8072/tcp # Allow OpenSPP longpolling (if using real-time features)
sudo ufw enable

```

### 3. SSL/TLS with Nginx (Recommended for Production)

```bash
# Install Nginx
sudo apt-get install -y nginx certbot python3-certbot-nginx

# Create Nginx configuration
sudo nano /etc/nginx/sites-available/openspp
```

Expand Down Expand Up @@ -119,12 +110,9 @@ server {

Enable the site and get SSL certificate:
```bash
# Enable the site
sudo ln -s /etc/nginx/sites-available/openspp /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# Get SSL certificate
sudo certbot --nginx -d your-domain.com
```

Expand Down Expand Up @@ -160,8 +148,6 @@ echo "Backup completed: $DATE"
Make it executable and schedule:
```bash
sudo chmod +x /usr/local/bin/openspp-backup.sh

# Add to crontab (daily at 2 AM)
echo "0 2 * * * /usr/local/bin/openspp-backup.sh" | sudo crontab -

@gemini-code-assist gemini-code-assist Bot Sep 2, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The removed comment # Add to crontab (daily at 2 AM) provided useful context about the cron schedule, which isn't immediately obvious to all users from the cron syntax 0 2 * * *. To improve clarity, please consider moving this explanation into the text preceding the code block. For example, you could change 'Make it executable and schedule:' to 'Make it executable and schedule it to run daily at 2 AM:'.

```

Expand Down