---

Purpose

Ensure each Item has a single “order link” that:

• Can be created/updated by Support Team
• Can be set once by everyone else, then becomes locked (cannot be changed or removed)

Field used:

• Fieldname: custom_what_link_to_order_more

---

Scope

Applies to:

• Item Master data maintenance
• Purchasing / replenishment workflow
• Support Team data governance

---

SOP 1 — Add or Update the Amazon Link (Support Team)

Who can do this

✅ Users with role: Support Team

Steps

1. Go to Stock → Item
2. Search and open the Item
3. Find field: What Link to Order More
4. Paste the Amazon URL (recommended format):
   • https://www.amazon.com/dp/ASIN
5. Click Save
6. Use the Order on Amazon button (if enabled) to verify link opens correctly

Expected result

• Link is saved and clickable
• Support Team can edit again anytime

---

SOP 2 — Set Link One Time (Non-Support Users)

Who this is for

Warehouse users / staff who can edit Items but are not Support Team.

Steps

1. Open Item
2. If link field is empty:
   • Paste the correct URL
   • Click Save
3. After saving, do not attempt to change/remove the link

Expected result

• First save works
• Second change will be blocked with message:
  “This link can only be set once. Contact Support Team to modify it.”

---

SOP 3 — Admin Setup: Create the Field (One-Time Setup)

Steps

1. Go to Settings → Customize Form
2. Select DocType: Item
3. Add a field (or confirm existing):

Field configuration

• Label: What Link to Order More
• Field Type: Data
• Options: URL
• Length: 500 (or higher)
• Fieldname: custom_what_link_to_order_more

4. Click Save
5. Click Update

Expected result

• Field appears on Item form
• Long URLs allowed
• URL is clickable

---

SOP 4 — Admin Setup: “Order on Amazon” Button (Client Script)

Steps

1. Go to Settings → Client Script → New
2. Set:

• DocType: Item
• View: Form
• Enabled: ✅

3. Paste:

frappe.ui.form.on('Item', {
  refresh(frm) {
    if (frm.doc.custom_what_link_to_order_more) {
      frm.add_custom_button(__('Order on Amazon'), () => {
        window.open(frm.doc.custom_what_link_to_order_more, '_blank');
      }, __('Order'));
    }
  }
});

4. Save
5. Refresh an Item record

Expected result

• Button appears only when link exists
• Button opens link in a new tab

---

SOP 5 — Admin Setup: Enforce “Set Once” (Server Script, Sandbox-Safe)

Goal

• Support Team can edit anytime
• Everyone else: can set once, cannot change/remove after it’s set

Steps

1. Go to Settings → Server Script → New
2. Set:

• Script Type: DocType Event
• Reference DocType: Item
• DocType Event: Before Save (or Validate)
• Enabled: ✅

3. Paste:

FIELDNAME = "custom_what_link_to_order_more"
ALLOWED_ROLE = "Support Team"

current_user = frappe.session.user

user_roles = frappe.get_all(
    "Has Role",
    filters={"parent": current_user},
    pluck="role"
)

if ALLOWED_ROLE not in user_roles:
    if not doc.is_new():
        old_value = frappe.db.get_value("Item", doc.name, FIELDNAME) or ""
        new_value = doc.get(FIELDNAME) or ""

        if old_value and new_value != old_value:
            frappe.throw(
                "This link can only be set once. Contact Support Team to modify it."
            )

4. Save

Validation test

• As Support Team: edit link → allowed
• As non-Support: set link once → allowed
• As non-Support: try change/remove → blocked

---

SOP 6 — Troubleshooting

Issue A: “Method Not Allowed / Login to access”

Cause: session expired or permissions.
Fix:

• Log out/in
• Ensure you are using /app
• Confirm role permissions for Server Script/Client Script

Issue B: “AttributeError: module has no attribute has_role / get_roles”

Cause: restricted server script sandbox
Fix: use the Has Role query method (the SOP 5 script)

Issue C: Field still editable after save

Cause: server script disabled or wrong DocType event
Fix:

• Confirm Server Script is Enabled
• Confirm DocType = Item
• Confirm Event = Before Save or Validate

---

SOP 7 — Rollback / Undo Changes

Disable enforcement (keep script for later)

• Settings → Server Script → open script → uncheck Enabled → Save

Remove the button

• Disable or delete the Client Script for Item

Remove UI lock (if you ever set Read Only Depends On)

• Customize Form → Item → field → clear Read Only Depends On → Save/Update

---

1️⃣ Create a dedicated sysctl file

sudo nano /etc/sysctl.d/99-disable-ipv6.conf

Paste exactly this:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Save and exit.

---

2️⃣ Apply immediately (no reboot needed)

sudo sysctl --system

---

3️⃣ Verify IPv6 is disabled

ip a | grep inet6

✅ Expected result: no output
(or only ::1 disappears as well)

Also check:

cat /proc/sys/net/ipv6/conf/all/disable_ipv6

Should return:

1

Firewalls are a foundational component of any secure Linux system. On Ubuntu and other Debian-based distributions, UFW (Uncomplicated Firewall) provides a simple yet powerful interface for managing firewall rules.

In this post, we’ll break down the following UFW rule, explain what it does, and discuss when and why you might use it:

sudo ufw allow from 10.8.0.2 to any port 8123 proto tcp

---

What Is UFW?

UFW is a frontend for iptables designed to make firewall configuration easier and less error-prone. Instead of dealing with complex rule chains, UFW lets administrators define intent-based rules that are readable and maintainable.

---

Breaking Down the Rule

Let’s look at each part of the command in detail.

sudo

Firewall rules require administrative privileges. sudo ensures the command is executed with root permissions.

ufw allow

This tells UFW to permit traffic that matches the rule. UFW rules typically fall into three categories:

• allow
• deny
• reject

In this case, we are explicitly allowing traffic.

from 10.8.0.2

This restricts the rule to traffic originating only from the IP address 10.8.0.2.

This is an important security control:
instead of opening a port to the entire internet, access is limited to a trusted host.
IP addresses in the 10.0.0.0/8 range are private addresses, commonly used for:

• VPNs (OpenVPN, WireGuard)
• Internal networks
• Secure tunnels between services

to any port 8123

This specifies the destination:

• Any local interface on the machine
• Port 8123

Port 8123 is often used by applications such as:

• Home Assistant
• Custom web dashboards
• Internal APIs
• Development or monitoring tools

proto tcp

This limits the rule to TCP traffic only.

That matters because:

• TCP is connection-oriented and reliable
• UDP traffic to the same port would still be blocked unless explicitly allowed

---

What This Rule Accomplishes

In plain language, this rule means:

“Allow TCP connections to port 8123 on this server, but only if they come from 10.8.0.2.”

Everything else—other IPs, other ports, or other protocols—remains blocked by default.

---

Why This Is a Best Practice

This rule demonstrates several strong security principles:

✅ Principle of Least Privilege

Only a single IP address is allowed access, rather than opening the port globally.

✅ Reduced Attack Surface

Even if port scans are performed, the service is unreachable from unauthorized sources.

✅ Clear Intent

The rule is readable and self-documenting, which makes long-term maintenance easier.

---

Verifying the Rule

After adding the rule, you can confirm it with:

sudo ufw status verbose

You should see an entry similar to:

8123/tcp ALLOW IN From 10.8.0.2

---

Common Use Cases

This type of rule is commonly used for:

• Allowing VPN clients to access internal services
• Restricting admin dashboards to a jump host
• Securing IoT or automation services
• Protecting internal APIs from public exposure

---

Final Thoughts

The command:

sudo ufw allow from 10.8.0.2 to any port 8123 proto tcp

is a great example of how UFW can be both simple and secure. By combining IP-based restrictions, port targeting, and protocol control, you can expose only what’s necessary—nothing more.

If you’re managing services that don’t need public access, rules like this should be your default approach.