Firewall allowlist

Use this page if your network blocks outbound traffic by default and you need to tell your network team which addresses to allow (sometimes called a whitelist).

Lunar Paper does not need internet access to run. It uses the internet to download its images when you install or upgrade, for licence checks and telemetry, and for the features listed below. You only need to allow the addresses for the features you use.

Almost all of this traffic comes from the Lunar Paper server, not from people’s browsers. When someone opens a feature that needs an outside file, such as an audio sample or a font, their browser asks the Lunar Paper server, and the server fetches the file. So most rules only need to apply to the server.

All addresses below use HTTPS on port 443 unless the table says otherwise.

Installing and upgrading

Docker, not Lunar Paper, downloads the images. These rules apply to the server that runs Docker, and only while you install or upgrade. If Docker must use a proxy, configure it in Docker’s own settings.

Address	Why
`ghcr.io`, `pkg-containers.githubusercontent.com`	The Lunar Paper images, from GitHub Container Registry
`registry-1.docker.io`, `auth.docker.io`, `production.cloudflare.docker.com`	The Redis, SeaweedFS, Caddy and Alpine images, from Docker Hub

To see which versions exist, a browser also needs to open github.com.

Lunar Paper services

Address	Why	If you block it
`live.dodopayments.com`	Activates and checks your licence. Used only after you enter a licence key.	Lunar Paper keeps working for 7 days after the last successful check, then switches to Free mode.
`telemetry.lunarpaper.com`	Sends the weekly telemetry report.	Nothing else changes. You can also turn telemetry off.

Features that fetch outside files

The server fetches these when someone uses the feature. If you block one, only that feature is affected.

Address	Feature
`cdn.jsdelivr.net`	Code editor, charts, maths formulas, MP3 export and instrument samples
`tonejs.github.io`	Piano samples
`fonts.googleapis.com`, `fonts.gstatic.com`	Google Fonts used in brand settings
`nominatim.openstreetmap.org`	Address search in forms and map images in emails
`staticmap.openstreetmap.de`	Map images in emails, when no Google or Mapbox key is set
`img.youtube.com`, `vimeo.com`, `i.vimeocdn.com`, `www.dailymotion.com`, `fast.wistia.net`, `cdn.loom.com`, `play.vidyard.com`	Video thumbnails in the email builder
`api.crossref.org`	Citation lookup by DOI
`pubchem.ncbi.nlm.nih.gov`	Chemical structure images
`lospec.com`	Pixel-art palettes
`api.apis.guru`	The public API catalogue

Integrations you set up

These are only used after an administrator connects the service. Allow the address you enter in Lunar Paper; the common ones are listed here.

Integration	Addresses
AI providers	The endpoint you enter, such as `api.openai.com`, `api.anthropic.com`, `<resource>.openai.azure.com` or `openrouter.ai`
Microsoft sign-in, directory sync and email	`login.microsoftonline.com`, `graph.microsoft.com`
Google sign-in	`accounts.google.com`, `oauth2.googleapis.com`, `www.googleapis.com`
Gmail API email	`oauth2.googleapis.com`, `gmail.googleapis.com`
Other single sign-on	Your identity provider’s address, such as your Okta or Keycloak URL
SMTP email	Your mail server, usually on port 587 or 465
Google Places address lookup	`maps.googleapis.com`
Mapbox address lookup	`api.mapbox.com`
Data Hub sources	The host and port of each source, such as `api.airtable.com`, `api.notion.com`, `coda.io`, `<account>.snowflakecomputing.com`, or a database on port 5432 (PostgreSQL), 3306 (MySQL) or 1433 (SQL Server)
Webhooks, workflow HTTP steps, web research and remote images	The addresses your users enter

Services on your own network, such as a database or a self-hosted address server, must also be added under Administration → Network → Private Targets. Lunar Paper refuses private addresses until you do.

Traffic that does not use the proxy

Most traffic follows the proxy settings, but these connections always go directly to their destination, so the firewall must allow them without the proxy:

Data Hub sources on Snowflake, Databricks, BigQuery, Oracle and IBM Db2.
Workflow steps and triggers that connect to a database.
PDF and image exports. If the content includes images or fonts from other websites, the export fetches them directly.

Publishing instances

A publishing instance adds two connections:

The Lunar Paper server sends published content to the instance’s address, by default on port 8081.
The instance sends submissions and uploads back to the Lunar Paper server at its APP_URL. The instance needs no other internet access, because its outbound requests go through the Lunar Paper server.

HTTPS with a public domain

If you use the HTTPS guide with a public domain and tls you@example.com, Caddy gets a certificate from Let’s Encrypt:

Inbound: ports 80 and 443 from the internet to the server, so Let’s Encrypt can confirm you own the domain.
Outbound: acme-v02.api.letsencrypt.org. If Let’s Encrypt fails, Caddy tries ZeroSSL at acme.zerossl.com.

With an internal name and tls internal, Caddy needs no internet access.

People’s browsers

Browsers only need to reach your APP_URL. There are four exceptions:

Single sign-on. The sign-in page belongs to your identity provider, such as login.microsoftonline.com or accounts.google.com.
Connecting a Microsoft 365 or Gmail mailbox. The administrator’s browser opens the Microsoft or Google consent page once.
Email previews. An email template that uses Google Fonts loads them from fonts.googleapis.com and fonts.gstatic.com in the preview.
Embedded videos. Videos load straight from the video site. By default that is YouTube (www.youtube.com, www.youtube-nocookie.com) and Vimeo (player.vimeo.com). Administrators choose the sites under Video embeds.

Links that people add to their work open like links on any other web page.

Optional drivers

Building the image with an optional driver downloads much more than a normal installation: the base image from Docker Hub, packages from deb.debian.org, apt.postgresql.org and registry.npmjs.org, a browser from cdn.playwright.dev, and the IBM driver from public.dhe.ibm.com, with github.com and raw.githubusercontent.com as fallbacks. Build the image on a computer with open internet access if you can.