fix(connectors): allow self-hosted private DB hosts via opt-in flag

Database/connector tools rejected any host resolving to a private/reserved/
loopback IP, blocking the common self-hosted topology where the DB is reached
by a Docker/K8s/Swarm service name. Add an opt-in ALLOW_PRIVATE_DATABASE_HOSTS
flag that bypasses the private-host block in validateDatabaseHost while still
resolving and pinning DNS. Blocked on the hosted platform regardless of the env
var, mirroring DISABLE_AUTH.

Fixes #4319

Author: waleedlatif1

apps/sim/.env.example

@@ -12,6 +12,9 @@ BETTER_AUTH_URL=http://localhost:3000
 # Authentication Bypass (Optional - for self-hosted deployments behind private networks)
 # DISABLE_AUTH=true  # Uncomment to bypass authentication entirely. Creates an anonymous session for all requests.
 
+# Private Database Hosts (Optional - for self-hosted deployments only)
+# ALLOW_PRIVATE_DATABASE_HOSTS=true  # Uncomment to let database/connector tools reach private/reserved/loopback hosts (e.g. Docker/K8s service names, localhost). Loosens the SSRF boundary; only enable on a trusted private network.
+
 # NextJS (Required)
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 # INTERNAL_API_BASE_URL=http://sim-app.default.svc.cluster.local:3000  # Optional: internal URL for server-side /api self-calls; defaults to NEXT_PUBLIC_APP_URL

apps/sim/lib/core/config/env-flags.ts

@@ -74,6 +74,35 @@ if (isTruthy(env.DISABLE_AUTH)) {
     })
 }
 
+/**
+ * Whether database/connector tools may connect to private, reserved, or loopback
+ * hosts (e.g. Docker/K8s service names, localhost). Off by default: the SSRF guard
+ * in {@link validateDatabaseHost} blocks these so an untrusted user cannot pivot
+ * into the deployment's internal network. Self-hosted operators can opt in when
+ * their database lives on the same private network. Blocked on the hosted platform
+ * regardless of the env var, mirroring {@link isAuthDisabled}.
+ */
+export const allowPrivateDatabaseHosts = isTruthy(env.ALLOW_PRIVATE_DATABASE_HOSTS) && !isHosted
+
+if (isTruthy(env.ALLOW_PRIVATE_DATABASE_HOSTS)) {
+  import('@sim/logger')
+    .then(({ createLogger }) => {
+      const logger = createLogger('EnvFlags')
+      if (isHosted) {
+        logger.error(
+          'ALLOW_PRIVATE_DATABASE_HOSTS is set but ignored on hosted environment. Private/reserved database hosts remain blocked for security.'
+        )
+      } else {
+        logger.warn(
+          'ALLOW_PRIVATE_DATABASE_HOSTS is enabled. Database/connector tools may reach private, reserved, and loopback hosts. Only use this in trusted private networks.'
+        )
+      }
+    })
+    .catch(() => {
+      // Fallback during config compilation when logger is unavailable
+    })
+}
+
 /**
  * Is user registration disabled
  */

apps/sim/lib/core/config/env.ts

@@ -33,6 +33,7 @@ export const env = createEnv({
     DISABLE_REGISTRATION:                  z.boolean().optional(),                 // Flag to disable new user registration
     EMAIL_PASSWORD_SIGNUP_ENABLED:         z.boolean().optional().default(true),   // Enable email/password authentication (server-side enforcement)
     DISABLE_AUTH:                          z.boolean().optional(),                 // Bypass authentication entirely (self-hosted only, creates anonymous session)
+    ALLOW_PRIVATE_DATABASE_HOSTS:          z.boolean().optional(),                 // Opt-in (self-hosted only): let database/connector tools reach private/reserved/loopback hosts (e.g. Docker/K8s service names). Loosens the SSRF boundary; ignored on the hosted platform.
     ALLOWED_LOGIN_EMAILS:                  z.string().optional(),                  // Comma-separated list of allowed email addresses for login
     ALLOWED_LOGIN_DOMAINS:                 z.string().optional(),                  // Comma-separated list of allowed email domains for login
     BLOCKED_SIGNUP_DOMAINS:                z.string().optional(),                  // Comma-separated list of email domains blocked from signing up (e.g., "gmail.com,yahoo.com")

apps/sim/lib/core/security/input-validation.server.ts

@@ -6,7 +6,7 @@ import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import * as ipaddr from 'ipaddr.js'
 import { Agent, type RequestInit as UndiciRequestInit, fetch as undiciFetch } from 'undici'
-import { isHosted } from '@/lib/core/config/env-flags'
+import { allowPrivateDatabaseHosts, isHosted } from '@/lib/core/config/env-flags'
 import { type ValidationResult, validateExternalUrl } from '@/lib/core/security/input-validation'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 
@@ -152,6 +152,12 @@ export async function validateUrlWithDNS(
  * database hostnames (e.g. underscores in Docker/K8s service names). It only
  * blocks localhost and private/reserved IPs.
  *
+ * Self-hosted operators can set `ALLOW_PRIVATE_DATABASE_HOSTS` to reach databases
+ * on their private network (e.g. a Docker/Swarm service name that resolves to an
+ * internal IP). The opt-in only bypasses the private/reserved/loopback block; DNS
+ * is still resolved so the caller can pin the connection to the resolved IP. The
+ * bypass is never honored on the hosted platform (see {@link allowPrivateDatabaseHosts}).
+ *
  * @param host - The database hostname to validate
  * @param paramName - Name of the parameter for error messages
  * @returns AsyncValidationResult with resolved IP
@@ -166,18 +172,18 @@ export async function validateDatabaseHost(
 
   const lowerHost = host.toLowerCase()
 
-  if (lowerHost === 'localhost') {
+  if (lowerHost === 'localhost' && !allowPrivateDatabaseHosts) {
     return { isValid: false, error: `${paramName} cannot be localhost` }
   }
 
-  if (ipaddr.isValid(lowerHost) && isPrivateOrReservedIP(lowerHost)) {
+  if (ipaddr.isValid(lowerHost) && isPrivateOrReservedIP(lowerHost) && !allowPrivateDatabaseHosts) {
     return { isValid: false, error: `${paramName} cannot be a private IP address` }
   }
 
   try {
     const { address } = await dns.lookup(host, { verbatim: true })
 
-    if (isPrivateOrReservedIP(address)) {
+    if (isPrivateOrReservedIP(address) && !allowPrivateDatabaseHosts) {
       logger.warn('Database host resolves to blocked IP address', {
         paramName,
         hostname: host,

apps/sim/lib/core/security/input-validation.test.ts

@@ -28,6 +28,7 @@ import {
 } from '@/lib/core/security/input-validation'
 import {
   isPrivateOrReservedIP,
+  validateDatabaseHost,
   validateUrlWithDNS,
 } from '@/lib/core/security/input-validation.server'
 import { sanitizeForLogging } from '@/lib/core/security/redaction'
@@ -762,6 +763,74 @@ describe('validateUrlWithDNS', () => {
   })
 })
 
+describe('validateDatabaseHost', () => {
+  afterEach(() => {
+    envFlagsMock.allowPrivateDatabaseHosts = false
+  })
+
+  describe('default (SSRF guard on)', () => {
+    it('rejects a missing host', async () => {
+      const result = await validateDatabaseHost(undefined)
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('required')
+    })
+
+    it('rejects localhost', async () => {
+      const result = await validateDatabaseHost('localhost')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('localhost')
+    })
+
+    it('rejects a literal private IP', async () => {
+      const result = await validateDatabaseHost('10.0.0.5')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('private IP')
+    })
+
+    it('rejects a literal loopback IP', async () => {
+      const result = await validateDatabaseHost('127.0.0.1')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('private IP')
+    })
+
+    it('accepts a public IP and pins the resolved address', async () => {
+      const result = await validateDatabaseHost('1.1.1.1')
+      expect(result.isValid).toBe(true)
+      expect(result.resolvedIP).toBe('1.1.1.1')
+    })
+  })
+
+  describe('self-host opt-in (ALLOW_PRIVATE_DATABASE_HOSTS)', () => {
+    beforeEach(() => {
+      envFlagsMock.allowPrivateDatabaseHosts = true
+    })
+
+    it('allows localhost and still resolves an IP to pin', async () => {
+      const result = await validateDatabaseHost('localhost')
+      expect(result.isValid).toBe(true)
+      expect(result.resolvedIP).toBeDefined()
+    })
+
+    it('allows a literal private IP and pins it', async () => {
+      const result = await validateDatabaseHost('10.0.0.5')
+      expect(result.isValid).toBe(true)
+      expect(result.resolvedIP).toBe('10.0.0.5')
+    })
+
+    it('allows a literal loopback IP and pins it', async () => {
+      const result = await validateDatabaseHost('127.0.0.1')
+      expect(result.isValid).toBe(true)
+      expect(result.resolvedIP).toBe('127.0.0.1')
+    })
+
+    it('still surfaces unresolvable hostnames', async () => {
+      const result = await validateDatabaseHost('this-host-does-not-exist.invalid')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('could not be resolved')
+    })
+  })
+})
+
 describe('validateInteger', () => {
   describe('valid integers', () => {
     it.concurrent('should accept positive integers', () => {

packages/testing/src/mocks/env-flags.mock.ts

@@ -17,6 +17,7 @@ export const envFlagsMock = {
   isBillingEnabled: false,
   isEmailVerificationEnabled: false,
   isAuthDisabled: false,
+  allowPrivateDatabaseHosts: false,
   isRegistrationDisabled: false,
   isEmailPasswordEnabled: false,
   isTriggerDevEnabled: false,