Restrict production to an office network

This guide restricts payments-api / production so that its contents are served only to people in the office, to the production servers, and to CI tokens bound to the right repository. Everything else gets a refusal.

Example. Kiteline is a fictional company. Its office uses 203.0.113.0/24 and its production servers 198.51.100.0/24. Priya, an owner, sets up the rule.

Before you start, read Network rules. A network rule is enforced by the server, not by encryption, and it can't take back contents already served.

Only owners and admins set network rules. On a self-hosted server, check first that the server sees real client addresses: run doctor with the operator token and look at the client address check.

1. Find out what address the server sees

Open Networks. The top of the page shows The server sees your address as, for example 203.0.113.10. That's the address the rule will be checked against, not your laptop's local address. Everyone behind the same NAT or proxy shares it.

2. Create network lists

In Networks, under Network lists, choose New list…:

• office with 203.0.113.0/24;
• prod-servers with 198.51.100.0/24.

A list holds up to 1,000 networks, each with an optional label. IPv4 and IPv6 are separate: if your office also uses IPv6, add its IPv6 network too. Lists are signed by you, and other rules can reuse them.

3. Set the environment's rule

Open payments-api / production, then Networks for that environment, and set each column:

Why each one:

• People in the office get the contents. Anyone else, including an owner working from home, is refused.
• Machines connect from the server network. A machine pass lets a machine keep working for 24 hours if its address changes, as long as it was last seen from inside. Choose 0 for no passes, or between 1 hour and 7 days.
• Service tokens on cloud CI runners come from shared address ranges, so addresses say little. Requiring a CI binding admits only tokens bound to your repository and branch. Machines are never admitted under that option.

If one person or machine needs a different rule, such as the person on call from any address, add it under Exceptions.

Then choose for Share links: Blocked while the restriction is active is the safe choice for production.

Before saving, use the preview of who the rule would cut off. Based on last known addresses, it shows who with access would keep it and who would lose it.

4. Sign and save

Choose Save…. The Save restriction? window shows what gets wider and what gets narrower, then choose Sign and save. The rule is signed with your key.

A stricter rule takes effect at once. The environment now shows Content is served only to allowed networks, and, if you're in the office, Content is served to you: your address is in the allowed networks.

5. Check from outside

From an address outside the office:

• the web app shows the environment and its history, but not its values;
• crunu run --env payments-api/production -- … exits with code 7 and names the address the server sees;
• the refusal shows up under Network denials in Networks, and a member's refusal raises a warning alert.

When you need access from outside

An owner outside the allowed networks can open Break-glass access… in Networks: for chosen environments, from their current address, for at most 60 minutes, with a reason. Every owner and admin gets an alert and an email. Break-glass access also allows writing, so an owner can rotate the key of a restricted environment from outside.

Loosening the rule later

Any change that admits more addresses, drops the CI binding requirement, allows share links or lengthens machine passes is a relaxation. It waits 15 minutes, and every owner gets an alert. During that time an owner or admin can Cancel relaxation. Another owner or admin can Confirm with a second signature to apply it at once.

Things to keep in mind

• Members' personal environments aren't covered by network rules. Don't keep production values there.
• New recipients of a restricted environment get a key or file copy only after an explicit confirmation by someone inside.
• Restricted environments are left out of exports and offline copies, and crunu pull asks before writing them to disk.
• A compromised server won't follow the rule, so keep grants small and use CI bindings as well.