docs: fix Firewall / DNS Allowlist page

[arikalon1]

• Rewrite relay.robusta.dev and sp.robusta.dev per region (EU/AP) in the region selector, matching the existing api/platform handling — EU and AP accounts use relay.eu/.ap.robusta.dev and sp.eu/.ap.robusta.dev
• Fix sp.robusta.dev description: platform storage, not platform analytics
• Split the allowlist into Runtime / Installation / Add-ons sections
• Add sp.robusta.dev to the allowlist verification command
• Drop the region selector from the image-mirroring lists, which contain no region-dependent addresses

Claude-Session: https://claude.ai/code/session_016zhBq5qKJEeZNCaWHADRCA

[github-actions]

✅ Docker image ready for 32372c5 (built in 3m 48s)

• us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:32372c5

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:32372c5
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:32372c5 me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:32372c5
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:32372c5

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:32372c5

[coderabbitai]

Walkthrough

Region-aware URL handling now recognizes relay and sp subdomains. Proxy documentation was reorganized into runtime, installation, and add-on allowlists, with updated connectivity checks and text-rendered image lists.

Changes

Region routing and proxy documentation

Layer / File(s)	Summary
Additional region-aware subdomains docs/_static/region-selector.js	URL rewriting and target detection now recognize relay.robusta.dev and sp.robusta.dev alongside existing platform subdomains.
Categorized proxy allowlist guidance docs/setup-robusta/proxies.rst	Allowlist guidance is organized by runtime, installation, and add-on access, the verification command checks sp.robusta.dev, and image lists use text code blocks.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• robusta-dev/robusta#2086: Introduces the region selector rewrite mechanism extended by this change.

Suggested reviewers: aantn, moshemorad

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the docs-focused Firewall / DNS Allowlist changes.
Description check	✅ Passed	The description accurately summarizes the region selector and allowlist documentation updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/firewall-dns-allowlist-bugs-42cr1w

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/setup-robusta/proxies.rst`:
- Around line 34-37: Update the outbound traffic note in the proxy documentation
to state that connections originate from the relevant pod or node, rather than
always from the runner. Ensure the wording covers HolmesGPT pod requests and
installation image pulls from the node or container runtime, while preserving
the existing inbound-connection and HTTPS/TCP 443 details.
- Around line 46-53: Clarify the regional host coverage in the Robusta SaaS
platform section around the *.robusta.dev entry. Add the required regional
wildcards, including *.eu.robusta.dev and *.ap.robusta.dev, or explicitly note
that proxy rules must allow exact region-qualified hosts such as
api.eu.robusta.dev.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2441f6b7-7008-47a8-86d5-fb5c4b63ad80

📥 Commits

Reviewing files that changed from the base of the PR and between 30d54ee and 7284fa0.

📒 Files selected for processing (2)

• docs/_static/region-selector.js
• docs/setup-robusta/proxies.rst