From b73ce3252d880fe13040ed292ca8e461d920108e Mon Sep 17 00:00:00 2001 From: "Qays H. Poonawala" Date: Thu, 23 Jul 2026 10:25:54 -0700 Subject: [PATCH 1/2] Secure manual Firestore rules --- server/installation-guides/manual-setup.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/server/installation-guides/manual-setup.md b/server/installation-guides/manual-setup.md index 668e318..6284094 100644 --- a/server/installation-guides/manual-setup.md +++ b/server/installation-guides/manual-setup.md @@ -39,7 +39,25 @@ The name of the project does not have to be **BlueBubblesApp** if you already ha 3. Next, **Create database** and press **Next > Enable.** You can change the database location if you are not based in North America so it is closer to you. 4. If Cloud Firestore glitches and does not show you the database page, simply refresh the page. 5. In the tabs near the top, click **Rules** -6. Set the rule's condition from `allow read, write: if false;` to `allow read, write: if true;` (Change false to true) and click **Publish**. +6. Replace the rules with the following configuration and click **Publish**: + +```text +rules_version = '2'; +service cloud.firestore { + match /databases/{database}/documents { + match /server/config { + allow read; + } + + match /server/commands { + allow write; + } + } +} +``` + +This permits public reads only from the `server/config` document and public writes only to the `server/commands` document. Requests to unmatched paths are denied by default. The BlueBubbles server uses the Admin SDK with the service account generated below, so its database access bypasses these client security rules. The two listed operations remain public for BlueBubbles clients; this configuration limits their scope but does not add user authentication. + 7. Click the gear cog in the top left and click **Project Settings**. 8. In the tabs near the top, navigate to **Service Accounts**. Generate a new private key and save this locally. **This will download file 1 / 2 needed for the manual setup.** 9. Next, navigate to the **General** tab. From 8e7bbadc8f11ae355a38391d1df3ebec0af033b7 Mon Sep 17 00:00:00 2001 From: "Qays H. Poonawala" Date: Mon, 27 Jul 2026 23:49:56 -0700 Subject: [PATCH 2/2] docs: link canonical Firestore rule source --- server/installation-guides/manual-setup.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/server/installation-guides/manual-setup.md b/server/installation-guides/manual-setup.md index 6284094..fffd5da 100644 --- a/server/installation-guides/manual-setup.md +++ b/server/installation-guides/manual-setup.md @@ -56,6 +56,8 @@ service cloud.firestore { } ``` +The server's [`FCMService.setFirestoreRulesForApp`](https://github.com/BlueBubblesApp/bluebubbles-server/blob/development/packages/server/src/server/services/fcmService/index.ts#L154-L172) implementation is the source of truth for this policy. Compare this block with that implementation whenever either changes. + This permits public reads only from the `server/config` document and public writes only to the `server/commands` document. Requests to unmatched paths are denied by default. The BlueBubbles server uses the Admin SDK with the service account generated below, so its database access bypasses these client security rules. The two listed operations remain public for BlueBubbles clients; this configuration limits their scope but does not add user authentication. 7. Click the gear cog in the top left and click **Project Settings**.