Network rules

A network rule makes the server serve an environment's contents only to clients in allowed networks, and accept writes only from there. It applies to people, machines and service tokens, owners and admins included. A stolen session, CI token or machine key used from outside the allowed networks gets nothing.

What it restricts

• Restricted: the contents. That means the ciphertext of versions, environment keys, file copies and share link contents, both reading and writing. Rotating a key and delivering file copies count as writes.
• Not restricted: metadata and management. Names, history without contents, recipients and the audit log are available from anywhere, because you need them to investigate an incident. Removing access, revoking a machine and deleting an environment also work from anywhere.

The address that counts is the one the server sees. Everyone behind the same NAT or proxy has the same address. If the server can't determine the address, the request is denied and an alert is raised.

IPv4 and IPv6 are separate. An IPv4 network never admits an IPv6 address and the other way round. "Any address" means 0.0.0.0/0 together with ::/0.

Network lists

A network list is a named, signed set of up to 1,000 networks, such as your office or your production servers. Create one in Networks, under Network lists, with New list…. Rules refer to lists, so you update an address once.

Example. Kiteline is a fictional company. Its office list holds 203.0.113.0/24, and its prod-servers list holds 198.51.100.0/24.

A rule for an environment

Open the environment's Networks. The rule has three columns, one per kind of client:

Under Exceptions you can give a single person, machine or token its own rule, which replaces the rule of its column: for example, any address for the person on call, and one address for one machine. Then decide about Share links: allowed, or blocked while the restriction is active.

Sign and save signs the rule with your key. Only owners and admins can change rules, and a stolen session without the signing key can't.

Tightening is immediate, relaxing waits

• A stricter rule takes effect at once.
• A looser rule waits 15 minutes. Every owner gets an alert and an email, and an owner or admin can Cancel relaxation before it takes effect. With a second signature from another owner or admin, Confirm with a second signature, it takes effect at once.

A rule counts as looser if it admits addresses the previous one didn't, drops the CI binding requirement, allows share links, or lengthens machine passes. Extending a network list counts too.

An owner can also do a fast rollback to any version of a rule or list that was in effect during the last 24 hours. It takes effect immediately if it's no wider than the rule was at that time, and raises a critical alert.

Machine passes

A machine's external address can change. A machine pass gives it a grace period. When a machine signs in or checks the server from inside the allowed networks, the server issues or extends a pass for that environment. With a valid pass, the machine is served from another address too, until the pass runs out.

• Default length: 24 hours. It can be set from 1 hour to 7 days, or to 0 for no passes.
• Each new outside address raises an alert. Use from inside and outside within 10 minutes raises a critical alert, because the machine key seems to work in two places.
• Owners and admins revoke passes in Networks, under Machine passes. A tightened rule that removes the network a pass came from ends that pass at once.

People and service tokens don't get passes.

Break-glass access

An owner who is locked out by a rule can open Break-glass access… for themselves:

• for chosen environments, from their current address only;
• for at most 60 minutes by the server's clock;
• with a required reason and, if they have one, a fresh second factor;
• at most 3 active and 10 per day per owner.

Break-glass access allows writing too, so an owner outside the network can rotate a restricted environment's key. Each one raises a critical alert and emails every owner and admin. Another owner or an admin can revoke it. Demoting the owner, removing them or deleting their account ends it.

Service tokens on cloud CI

Cloud CI runners connect from the provider's shared address ranges, so addresses say little there. For service tokens, require a CI binding instead. A rule with that option admits only service tokens that have OIDC rules. Machines are never admitted under it.

What clients see

Clients see only the decision: whether the contents are served to them, how (by network, by pass or by break-glass access), and the address the server sees. They don't see which networks or lists the rule contains. In the terminal, a refusal gives exit code 7 with that address.

Restricted environments are left out of exports and offline copies, and crunu pull asks before writing them to disk. These are client-side safeguards against accidents, not against someone who holds the key.

Exceptions

• Members' personal environments aren't restricted, because only their owner manages them, and network rules are signed by owners and admins. Owners' and admins' personal environments can be restricted while they hold that role.
• New recipients in a restricted environment get a key or file copy only after someone confirms it explicitly. An admin outside the network can't quietly add a machine and have someone inside deliver to it.

Denials

Every denial is counted by environment, recipient and address. Network denials in Networks lists them. The first denial per day for each combination is written to the audit log. Denials are kept for 90 days.

Step by step: Restrict production to an office network.