Disabling new org creation in self hosted multi-tenant setup.

[fabiankaestner]

It should be possible to disable the creation of new orgs in a self hosted multi-tenant setup. Otherwise anybody on the internet can come along and create new applications on your system, unless it sits inside a VPN or an authenticating reverse proxy.

@shogunpurple

[PatrickHuetter]

I've seen a configuration param in values.yaml for that:

multiTenancy: "0" # set to 0 to disable multiple orgs, set to 1 to enable multiple orgs

Maybe it helps? Does budibase work for you with the current helm chart? I don't get it working yet.

[PatrickHuetter]

Yes no problem. My current values.yaml is the following (complete):

    ingress:
      enabled: true
      nginx: false
      className: ""
      annotations:
        kubernetes.io/ingress.class: nginx
        cert-manager.io/cluster-issuer: letsencrypt-production
      hosts:
        - host: budibase.somedomain.io
          paths:
            - path: /
              pathType: Prefix
              backend:
                service:
                  name: proxy-service
                  port:
                    number: 10000
      tls:
        - hosts:
            - budibase.somedomain.io
          secretName: budibase-cert-tls
    #globals:
      #enableAnalytics: false
      #selfHosted: 1
    services:
      objectStore:
        url: "minio-service:9000"
    #selfHosted: 1

[shogunpurple]

It appears your globals.selfHosted variable has been commented out - this needs to be 1 - I think that could be why your server is trying to go to s3.

[PatrickHuetter]

@shogunpurple I did everything you said and problem still exists (globals.selfHosted = 1). Also the creation of apps doesn't work really.

[fabiankaestner]

I've created a PR to default MINIO_URL to that for both worker and app-service when it's not set in the values.yaml.

#3099

Once merged you should be able to just pull the latest helm chart and get the above functionality.

This should have been already included in my PR, did I miss something?

[shogunpurple]

@PatrickHuetter I think this is possibly something to do with the SSL setup - the server is forwarding a request on port 443 when it should be straight up HTTP.

Could I see your worker and server logs when you try to create an app?

It also seems like your values.yaml is heavily modified - is MinIO definitely up? minio: true is missing from the values.yaml and all the redis config as well.

@fabiankaestner nope, it was fine - your changes just needed merged into master, which I have done.

[AiCaptain]

Hi guys,
are there any plans to implement the behavior @fabiankaestner described in the initial post?

I think the multitenancy is a nice feature but the creation of tenants should be under control of the admin(s) and in the moment it's a little bit error prone that a typo will lead to new tenant ...

Thank you in advance,
André

[shogunpurple]

@AiCaptain full multitenancy will be an enterprise feature in future - in its current form it isn’t really meant to be used in self hosted installations and it’s just an escape hatch for development