From be48a82d16f07f5586469ae4036fb08fb8ba878f Mon Sep 17 00:00:00 2001 From: Gray Williams Date: Tue, 4 Aug 2026 17:54:18 +0100 Subject: [PATCH] Update fleet-server-configuration.md adding allow_private_network (#50422) Adds the `server_allow_private_network_integrations` flag information For #49727 --------- Co-authored-by: Rachael Shaw --- docs/Configuration/fleet-server-configuration.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md index 2fd9c409bc..05eb11884d 100644 --- a/docs/Configuration/fleet-server-configuration.md +++ b/docs/Configuration/fleet-server-configuration.md @@ -801,6 +801,20 @@ Setting to true will disable the origin check. websockets_allow_unsafe_origin: true ``` +### server_allow_private_network_integrations + +Allows Fleet's HTTP client to make outbound requests to RFC 1918 and other private network addresses. Enable this if Fleet needs to reach an integration over HTTP. (Examples include SSO/IdP, EJBCA, Jira, or SCEP server, or an `HTTP_PROXY`/`HTTPS_PROXY` hosted on a private network.) + +This does not affect the always-blocked loopback (`127.0.0.0/8`) and cloud metadata (`169.254.0.0/16`) ranges. + +- Default value: `false` +- Environment variable: `FLEET_SERVER_ALLOW_PRIVATE_NETWORK_INTEGRATIONS` +- Config file format: +```yaml +server: + allow_private_network_integrations: true +``` + ### server_force_h2c Setting this will force the Go webserver to attempt HTTP2. By default, HTTP2 support is only negotiated if the Go webserver