We have a Forge app for Jira that calls a remote backend declared with region-pinned baseUrls, following Remote realm pinning. The remote computes and stores nothing, hence operations: [compute].
The manifest, abridged:
remotes:
- key: calculator
baseUrl:
default: https://<service>-uc.a.run.app # us-central1
US: https://<service>-uc.a.run.app # us-central1
EU: https://<service>-ey.a.run.app # europe-west3, Frankfurt
GB: https://<service>-nw.a.run.app # europe-west2, London
operations:
- compute
The question
At install time, what happens when the installing site’s data residency realm is one that this baseUrl object does not declare — a tenant pinned to Germany, Switzerland or Australia, say, given the manifest above?
Concretely, does the installation:
- (a) fail, or otherwise be prevented, or
- (b) succeed, and route that tenant’s calls to
default?
We have not found this documented either way. The realm pinning page says the baseUrl defined for a region “is still used during installation if the app supports the region where the Atlassian app is provisioned”, which tells us the behaviour when the realm is supported; the manifest reference for remotes shows only US and EU in its example.
Why it matters to us
default above is a US region. If the answer is (b), a customer pinned to Germany would have their data processed in the United States without anybody having chosen that — which we would much rather refuse than do silently. If the answer is (a), an undeclared realm is a commercial decision for us (add the region when a customer needs one) rather than a correctness problem, and we would plan accordingly.
Two follow-ups
-
If the answer is (b) — is there any supported way for an app to decline installation on a realm it does not declare, rather than falling back to
default? -
Is there a published list of the valid realm keys for a remote’s
baseUrl? We established thatGBis one empirically:forge lintacceptsGBand rejects an invalid key withMANIFEST_INVALID_RULEand a schema error namingregionalBaseUrl. We would rather not infer the remaining keys from the data residency location names.
Context
The app is deployed to development only, with no external installations yet. We are deciding which regions to declare before the first install, because adding a region afterwards is a major version change and a reinstall for every customer — so the cost of guessing wrong here is not recoverable later.