Production opens only from the networks you allow
Restrict an environment by network, and the server serves its contents only to addresses in your allowed lists. The restriction covers people, machines and service tokens, owners and admins included.
- IPv4 and IPv6 ranges
- Signed policies, delayed relaxing
- Break-glass access for owners
Network lists and environment policies
Network lists are signed lists of address ranges, such as Office and VPN. An environment network policy says who gets the contents and from where, and saving it needs a signature from an owner or admin.
- People, machines, tokensSet separate ranges for people and for machines, and turn share links off while the restriction is on.
- Writes are limited tooNew versions are accepted only from allowed networks.
- CI with OIDC onlyA policy can require that service tokens have a CI binding.
Tighten now, relax with a delay
Tightening a policy takes effect immediately. Relaxing it waits 15 minutes, with an alert to owners and a Cancel relaxation button, unless a second admin signs it too.
| Change | Takes effect |
|---|---|
| Tighten a policy | Immediately |
| Relax a policy | After 15 minutes, with an alert to owners and a Cancel relaxation button |
| Relax right away | Only with a second signature from another admin |
Clients remember the latest policy they accepted and won’t take an older one.
For the moments the rule gets in the way
Servers change addresses and owners travel. The exceptions are built in, time-limited and loud.
- Machine passesWhen a machine’s external address changes, a pass keeps contents flowing from the new address for a while, 24 hours by default.
- Break-glass accessAn owner can bypass the policy for up to 60 minutes, with a written reason and an alert.
- Denials are visibleAll denials show on the Denials tab. A denial to a machine or a token raises a critical alert; to a person, a warning.
- The agent knows whyA machine refused by network policy exits with code 7, so scripts can tell it apart from other failures.
A rule on the server, not a layer of encryption
Your values are encrypted either way. The restriction decides who the server will serve ciphertext to.
- Enforced by the serverA server that’s been taken over won’t follow it. Signatures only make a swapped policy visible to clients that saw a newer one.
- The address the server seesEveryone behind the same NAT or proxy shares one address. Behind a proxy, set TRUST_PROXY so the server reads the real one.
- Delivered stays deliveredContents received before the restriction stay on devices and in agents’ memory.
- A pass is a windowA machine key stolen together with an active pass can fetch contents until the pass ends.
Answers to common questions
Something else? Write to support@crunu.com
Does the restriction apply to owners and admins?
Yes. It covers people, machines and service tokens alike. Owners have break-glass access for up to 60 minutes when they need it, with a reason and an alert.
What if someone loosens the policy with a stolen session?
Changing a policy needs a signature from an owner’s or admin’s key, and a stolen session token alone can’t produce one. Even a signed relaxation waits 15 minutes and alerts owners, who can cancel it.
Our server’s IP changed overnight. Will it stop working?
Not right away. A machine pass keeps contents flowing from the new address for 24 hours by default, and raises an alert.
Is this the same as encrypting by location?
No. It’s a rule the server enforces on top of encryption. Your values are encrypted either way; the restriction decides who the server will serve ciphertext to.
Does it support IPv6?
Yes. Network lists take IPv4 and IPv6 ranges.
Keep production inside your networks
Create a network list for your office and VPN, then restrict one environment.